Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
7AYsP32Q7Y

Overview

General Information

Sample Name:7AYsP32Q7Y (renamed file extension from none to exe)
Analysis ID:562059
MD5:6ae185ce909f0b66306100824c28bad1
SHA1:5f23a2d4b2c564c95606e537e557aa8251087746
SHA256:074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867
Tags:32exeFormbooktrojan
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Sigma detected: Autorun Keys Modification
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • 7AYsP32Q7Y.exe (PID: 2940 cmdline: "C:\Users\user\Desktop\7AYsP32Q7Y.exe" MD5: 6AE185CE909F0B66306100824C28BAD1)
    • DpiScaling.exe (PID: 2984 cmdline: C:\Windows\System32\DpiScaling.exe MD5: 302B1BBDBF4D96BEE99C6B45680CEB5E)
      • explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • Iodqgrdelf.exe (PID: 1244 cmdline: "C:\Users\user\Contacts\Iodqgrdelf.exe" MD5: 6AE185CE909F0B66306100824C28BAD1)
          • DpiScaling.exe (PID: 5944 cmdline: C:\Windows\System32\DpiScaling.exe MD5: 302B1BBDBF4D96BEE99C6B45680CEB5E)
        • Iodqgrdelf.exe (PID: 4140 cmdline: "C:\Users\user\Contacts\Iodqgrdelf.exe" MD5: 6AE185CE909F0B66306100824C28BAD1)
          • logagent.exe (PID: 720 cmdline: C:\Windows\System32\logagent.exe MD5: E2036AC444AB4AD91EECC1A80FF7212F)
        • autochk.exe (PID: 4856 cmdline: C:\Windows\SysWOW64\autochk.exe MD5: 34236DB574405291498BCD13D20C42EB)
        • msiexec.exe (PID: 3912 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 12C17B5A5C2A7B97342C362CA467E9A2)
        • cscript.exe (PID: 6684 cmdline: C:\Windows\SysWOW64\cscript.exe MD5: 00D3041E47F99E48DD5FFFEDF60F6304)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.fyonkaly.com/ahc8/"], "decoy": ["methodicalservices.com", "lojahelius.com", "dxadxc.com", "keshaunharris.club", "hockeyengolfshop.online", "sherranmanning.com", "instylelimos.net", "plick-click.com", "tntexplode.com", "movement-practice.net", "nftlake.digital", "134171.com", "newhorizonseo.com", "lm-solar.com", "fahrrad-markt24.com", "creatologiest.com", "juststartmessy.com", "sady-rossii-ural.com", "blockchain-salt.com", "bestoflakegeorge.guide", "infinitymoversllc.com", "javelephant.com", "promocaozeraestoque.online", "p60p.com", "kreditineskorteleslt.com", "chronicfit.store", "onzep.store", "shafiqandmudasir.com", "vivemanku.online", "chengfengdh.xyz", "bets-bc-zrkqf.xyz", "cellparts10.com", "guardions.com", "talenue.store", "graffity-aws.com", "buddingwsetcg.top", "erikakorma.com", "playex.ltd", "jamaicarailways.com", "nfthunter.art", "ml-pilot.com", "athleteteas.com", "ruthdeliverance.info", "medicmir.store", "procurovariedades.com", "undermour01.club", "sneakeryeezy.com", "dallmann.info", "edm69.net", "micj7870.com", "silviomicalikush.xyz", "activa.store", "adeelnawaznj.com", "travispilat.com", "mercyships.kiwi", "amazon939.com", "talenterzllc.com", "sbxip.com", "phasernet.net", "taggalla.com", "pbspoolservices.com", "34gjm.xyz", "nuevochile.net", "busdijogja.com"]}

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Contacts\fledrgqdoI.urlMethodology_Shortcut_HotKeyDetects possible shortcut usage for .URL persistence@itsreallynick (Nick Carr)
  • 0x58:$hotkey: \x0AHotKey=9
  • 0x0:$url_explicit: [InternetShortcut]
C:\Users\user\Contacts\fledrgqdoI.urlMethodology_Contains_Shortcut_OtherURIhandlersDetects possible shortcut usage for .URL persistence@itsreallynick (Nick Carr)
  • 0x14:$file: URL=
  • 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x16ac9:$sqlite3step: 68 34 1C 7B E1
    • 0x16bdc:$sqlite3step: 68 34 1C 7B E1
    • 0x16af8:$sqlite3text: 68 38 2A 90 C5
    • 0x16c1d:$sqlite3text: 68 38 2A 90 C5
    • 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
    00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 76 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      7.0.DpiScaling.exe.72480000.1.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        7.0.DpiScaling.exe.72480000.1.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1ac4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        7.0.DpiScaling.exe.72480000.1.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x16ac9:$sqlite3step: 68 34 1C 7B E1
        • 0x16bdc:$sqlite3step: 68 34 1C 7B E1
        • 0x16af8:$sqlite3text: 68 38 2A 90 C5
        • 0x16c1d:$sqlite3text: 68 38 2A 90 C5
        • 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
        7.0.DpiScaling.exe.72480000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          7.0.DpiScaling.exe.72480000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x18d97:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x19e4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 85 entries

          Sigma Overview

          System Summary

          barindex
          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton: Data: Details: C:\Users\user\Contacts\fledrgqdoI.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\7AYsP32Q7Y.exe, ProcessId: 2940, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Iodqgrdelf

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.fyonkaly.com/ahc8/"], "decoy": ["methodicalservices.com", "lojahelius.com", "dxadxc.com", "keshaunharris.club", "hockeyengolfshop.online", "sherranmanning.com", "instylelimos.net", "plick-click.com", "tntexplode.com", "movement-practice.net", "nftlake.digital", "134171.com", "newhorizonseo.com", "lm-solar.com", "fahrrad-markt24.com", "creatologiest.com", "juststartmessy.com", "sady-rossii-ural.com", "blockchain-salt.com", "bestoflakegeorge.guide", "infinitymoversllc.com", "javelephant.com", "promocaozeraestoque.online", "p60p.com", "kreditineskorteleslt.com", "chronicfit.store", "onzep.store", "shafiqandmudasir.com", "vivemanku.online", "chengfengdh.xyz", "bets-bc-zrkqf.xyz", "cellparts10.com", "guardions.com", "talenue.store", "graffity-aws.com", "buddingwsetcg.top", "erikakorma.com", "playex.ltd", "jamaicarailways.com", "nfthunter.art", "ml-pilot.com", "athleteteas.com", "ruthdeliverance.info", "medicmir.store", "procurovariedades.com", "undermour01.club", "sneakeryeezy.com", "dallmann.info", "edm69.net", "micj7870.com", "silviomicalikush.xyz", "activa.store", "adeelnawaznj.com", "travispilat.com", "mercyships.kiwi", "amazon939.com", "talenterzllc.com", "sbxip.com", "phasernet.net", "taggalla.com", "pbspoolservices.com", "34gjm.xyz", "nuevochile.net", "busdijogja.com"]}
          Multi AV Scanner detection for submitted file
          Source: 7AYsP32Q7Y.exeVirustotal: Detection: 20%Perma Link
          Yara detected FormBook
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeVirustotal: Detection: 20%Perma Link
          Source: 7.0.DpiScaling.exe.72480000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 19.0.DpiScaling.exe.72480000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 22.2.msiexec.exe.2eac4e8.1.unpackAvira: Label: TR/Patched.Ren.Gen8
          Source: 20.0.logagent.exe.72480000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 7.2.DpiScaling.exe.72480000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 19.2.DpiScaling.exe.72480000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 7.0.DpiScaling.exe.72480000.2.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 20.0.logagent.exe.72480000.2.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 19.0.DpiScaling.exe.72480000.2.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 20.0.logagent.exe.72480000.1.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 20.0.logagent.exe.72480000.3.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 20.2.logagent.exe.72480000.3.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 19.0.DpiScaling.exe.72480000.1.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 19.0.DpiScaling.exe.72480000.3.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 7.0.DpiScaling.exe.72480000.1.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 7.0.DpiScaling.exe.72480000.3.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 7AYsP32Q7Y.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
          Source: Binary string: cscript.pdbUGP source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: DpiScaling.exe, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: cscript.pdb source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.fyonkaly.com/ahc8/
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.309723740.0000000000768000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
          Source: Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/D
          Source: Iodqgrdelf.exe, 00000009.00000003.408286510.000000000074F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/download?cid=C38D15779
          Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/download?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSs
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/ownload?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSs0
          Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onedrive.live.com/ve.live.com/
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/J
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410519278.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410740246.000000000075D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4m423aJ2r6bprjijqR9Zhv79BsqXWchgBZ_yRRKAukc5TAIPNB4BdYAYidrCTJ4BkE
          Source: Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4m4qzuMb9gIarzlKBTf0D1umDohf9Y3sIpL-K8zvk8UHM6XBD2Ajct4M-j4Gm20nJT
          Source: Iodqgrdelf.exe, 00000009.00000003.412998037.000000000075A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4m8TXF6mlgGvccZFUvhwUh-l9zz_V1hgmOQiTI_douTr2wu7UlvtGbODDxtwhN0e5H
          Source: Iodqgrdelf.exe, 00000009.00000003.408295630.0000000000753000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4mC-JI5vs5pbHFPeZ5KI8vSY-Zm0BYG_DfYRphHWKBbqd0ouSRcXTjDbP2g5pIoI5u
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.309723740.0000000000768000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4mPL6EaGmr7d1CmnxP8LzgR3rcH9luOFpR5APvojUZtRQCdMAq2C-_uZddZ6W0R9-N
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4mXdCXgV78z93QBfcFjKJ0ucHs8CARh8saaIpZ0Zw4IJExL4V9d7aCID-8TYoLJ0Qx
          Source: Iodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432635294.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432387332.00000000007CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://vru2ia.am.files.1drv.com/y4mqmZSB7T13rwuDyCkOltxUalsuuekof9Mak2JfMqUquSjRzSFu0dx_u0qHh2VQFIg
          Source: unknownDNS traffic detected: queries for: onedrive.live.com

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7AYsP32Q7Y.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
          Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: C:\Users\user\Contacts\fledrgqdoI.url, type: DROPPEDMatched rule: Methodology_Shortcut_HotKey author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
          Source: C:\Users\user\Contacts\fledrgqdoI.url, type: DROPPEDMatched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DD4667_2_047DD466
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472841F7_2_0472841F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E1D557_2_047E1D55
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04710D207_2_04710D20
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E2D077_2_047E2D07
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472D5E07_2_0472D5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E25DD7_2_047E25DD
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047425817_2_04742581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04736E307_2_04736E30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DD6167_2_047DD616
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E2EF77_2_047E2EF7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E1FF17_2_047E1FF1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047EDFCE7_2_047EDFCE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047EE8247_2_047EE824
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D10027_2_047D1002
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E28EC7_2_047E28EC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A07_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E20A87_2_047E20A8
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472B0907_2_0472B090
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047341207_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471F9007_2_0471F900
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E22AE7_2_047E22AE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E2B287_2_047E2B28
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D03DA7_2_047D03DA
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DDBD27_2_047DDBD2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474EBB07_2_0474EBB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E841F19_2_042E841F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0439100219_2_04391002
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A019_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A20A819_2_043A20A8
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EB09019_2_042EB090
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D0D2019_2_042D0D20
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F412019_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DF90019_2_042DF900
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A2D0719_2_043A2D07
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A1D5519_2_043A1D55
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430258119_2_04302581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042ED5E019_2_042ED5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F6E3019_2_042F6E30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A2EF719_2_043A2EF7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430EBB019_2_0430EBB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A1FF119_2_043A1FF1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: String function: 0471B150 appears 45 times
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: String function: 042DB150 appears 35 times
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759540 NtReadFile,LdrInitializeThunk,7_2_04759540
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047595D0 NtClose,LdrInitializeThunk,7_2_047595D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759660 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_04759660
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047596E0 NtFreeVirtualMemory,LdrInitializeThunk,7_2_047596E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759710 NtQueryInformationToken,LdrInitializeThunk,7_2_04759710
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759FE0 NtCreateMutant,LdrInitializeThunk,7_2_04759FE0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047597A0 NtUnmapViewOfSection,LdrInitializeThunk,7_2_047597A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759780 NtMapViewOfSection,LdrInitializeThunk,7_2_04759780
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759860 NtQuerySystemInformation,LdrInitializeThunk,7_2_04759860
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759840 NtDelayExecution,LdrInitializeThunk,7_2_04759840
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047598F0 NtReadVirtualMemory,LdrInitializeThunk,7_2_047598F0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759910 NtAdjustPrivilegesToken,LdrInitializeThunk,7_2_04759910
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047599A0 NtCreateSection,LdrInitializeThunk,7_2_047599A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759A50 NtCreateFile,LdrInitializeThunk,7_2_04759A50
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759A20 NtResumeThread,LdrInitializeThunk,7_2_04759A20
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759A00 NtProtectVirtualMemory,LdrInitializeThunk,7_2_04759A00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759560 NtWriteFile,7_2_04759560
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475AD30 NtSetContextThread,7_2_0475AD30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759520 NtWaitForSingleObject,7_2_04759520
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047595F0 NtQueryInformationFile,7_2_047595F0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759670 NtQueryInformationProcess,7_2_04759670
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759650 NtQueryValueKey,7_2_04759650
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759610 NtEnumerateValueKey,7_2_04759610
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047596D0 NtCreateKey,7_2_047596D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475A770 NtOpenThread,7_2_0475A770
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759770 NtSetInformationFile,7_2_04759770
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759760 NtOpenProcess,7_2_04759760
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759730 NtQueryVirtualMemory,7_2_04759730
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475A710 NtOpenProcessToken,7_2_0475A710
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475B040 NtSuspendThread,7_2_0475B040
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759820 NtEnumerateKey,7_2_04759820
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047598A0 NtWriteVirtualMemory,7_2_047598A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759950 NtQueueApcThread,7_2_04759950
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047599D0 NtCreateProcessEx,7_2_047599D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759A10 NtQuerySection,7_2_04759A10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759A80 NtOpenDirectoryObject,7_2_04759A80
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759B00 NtSetValueKey,7_2_04759B00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475A3B0 NtGetContextThread,7_2_0475A3B0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319860 NtQuerySystemInformation,LdrInitializeThunk,19_2_04319860
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319840 NtDelayExecution,LdrInitializeThunk,19_2_04319840
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043198F0 NtReadVirtualMemory,LdrInitializeThunk,19_2_043198F0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319910 NtAdjustPrivilegesToken,LdrInitializeThunk,19_2_04319910
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319540 NtReadFile,LdrInitializeThunk,19_2_04319540
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043199A0 NtCreateSection,LdrInitializeThunk,19_2_043199A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043195D0 NtClose,LdrInitializeThunk,19_2_043195D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319A20 NtResumeThread,LdrInitializeThunk,19_2_04319A20
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319A00 NtProtectVirtualMemory,LdrInitializeThunk,19_2_04319A00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319660 NtAllocateVirtualMemory,LdrInitializeThunk,19_2_04319660
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319A50 NtCreateFile,LdrInitializeThunk,19_2_04319A50
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043196E0 NtFreeVirtualMemory,LdrInitializeThunk,19_2_043196E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319710 NtQueryInformationToken,LdrInitializeThunk,19_2_04319710
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043197A0 NtUnmapViewOfSection,LdrInitializeThunk,19_2_043197A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319780 NtMapViewOfSection,LdrInitializeThunk,19_2_04319780
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319FE0 NtCreateMutant,LdrInitializeThunk,19_2_04319FE0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319820 NtEnumerateKey,19_2_04319820
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431B040 NtSuspendThread,19_2_0431B040
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043198A0 NtWriteVirtualMemory,19_2_043198A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431AD30 NtSetContextThread,19_2_0431AD30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319520 NtWaitForSingleObject,19_2_04319520
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319560 NtWriteFile,19_2_04319560
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319950 NtQueueApcThread,19_2_04319950
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043195F0 NtQueryInformationFile,19_2_043195F0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043199D0 NtCreateProcessEx,19_2_043199D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319610 NtEnumerateValueKey,19_2_04319610
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319A10 NtQuerySection,19_2_04319A10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319670 NtQueryInformationProcess,19_2_04319670
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319650 NtQueryValueKey,19_2_04319650
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319A80 NtOpenDirectoryObject,19_2_04319A80
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043196D0 NtCreateKey,19_2_043196D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319730 NtQueryVirtualMemory,19_2_04319730
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431A710 NtOpenProcessToken,19_2_0431A710
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319B00 NtSetValueKey,19_2_04319B00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319770 NtSetInformationFile,19_2_04319770
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431A770 NtOpenThread,19_2_0431A770
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04319760 NtOpenProcess,19_2_04319760
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431A3B0 NtGetContextThread,19_2_0431A3B0
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.301545667.0000000003710000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebPicker4 vs 7AYsP32Q7Y.exe
          Source: 7AYsP32Q7Y.exe, 00000001.00000000.299731510.0000000000474000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameWebPicker4 vs 7AYsP32Q7Y.exe
          Source: 7AYsP32Q7Y.exeStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
          Source: 7AYsP32Q7Y.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
          Source: Iodqgrdelf.exe.1.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
          Source: Iodqgrdelf.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???t.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???t.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???t.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?f???.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2?????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l .dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??i.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ????.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ?l.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???2.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ???b.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??.dllJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: 72480000 page no accessJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: 72480000 page read and writeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: 72481000 page read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page no accessJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72481000 page read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page no accessJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72480000 page read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: 72481000 page read and writeJump to behavior
          Source: 7AYsP32Q7Y.exeVirustotal: Detection: 20%
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile read: C:\Users\user\Desktop\7AYsP32Q7Y.exeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\7AYsP32Q7Y.exe "C:\Users\user\Desktop\7AYsP32Q7Y.exe"
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe"
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exe
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exeJump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Contacts\Iodqgrdelf.exe "C:\Users\user\Contacts\Iodqgrdelf.exe" Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Iodqgrdelfemgrjgzrzpbewqyzpzqin[1]Jump to behavior
          Source: classification engineClassification label: mal100.troj.evad.winEXE@13/6@7/0
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: Binary string: cscript.pdbUGP source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: DpiScaling.exe, 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmp, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: DpiScaling.exe, DpiScaling.exe, 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 00000016.00000002.579194787.0000000004E3F000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: cscript.pdb source: DpiScaling.exe, 00000007.00000002.550569455.00000000008C0000.00000040.10000000.00040000.00000000.sdmp
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0476D0D1 push ecx; ret 7_2_0476D0E4
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8906B push esp; retf 13_3_03A8907E
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8906B push esp; retf 13_3_03A8907E
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8806C push es; retf 13_3_03A8806D
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8806C push es; retf 13_3_03A8806D
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87656 push esp; retf 13_3_03A87657
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87656 push esp; retf 13_3_03A87657
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85995 push eax; iretd 13_3_03A859A9
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A85B44 push esi; iretd 13_3_03A85B47
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A870F6 push cs; iretd 13_3_03A87100
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8906B push esp; retf 13_3_03A8907E
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8906B push esp; retf 13_3_03A8907E
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8806C push es; retf 13_3_03A8806D
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A8806C push es; retf 13_3_03A8806D
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87E6E push cs; iretd 13_3_03A87E73
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87656 push esp; retf 13_3_03A87657
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeCode function: 13_3_03A87656 push esp; retf 13_3_03A87657
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0432D0D1 push ecx; ret 19_2_0432D0E4
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeFile created: C:\Users\user\Contacts\Iodqgrdelf.exeJump to dropped file
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IodqgrdelfJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IodqgrdelfJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\SysWOW64\DpiScaling.exeRDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\DpiScaling.exeRDTSC instruction interceptor: First address: 000000007248898E second address: 0000000072488994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\logagent.exeRDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\logagent.exeRDTSC instruction interceptor: First address: 000000007248898E second address: 0000000072488994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: 00000000008B8604 second address: 00000000008B860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cscript.exeRDTSC instruction interceptor: First address: 00000000008B898E second address: 00000000008B8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04756DE6 rdtsc 7_2_04756DE6
          Source: C:\Windows\SysWOW64\DpiScaling.exeAPI coverage: 5.9 %
          Source: C:\Windows\SysWOW64\DpiScaling.exeAPI coverage: 6.2 %
          Source: C:\Windows\SysWOW64\DpiScaling.exeProcess information queried: ProcessInformationJump to behavior
          Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}bwe
          Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000008.00000000.421067968.000000000875B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
          Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
          Source: explorer.exe, 00000008.00000000.392252295.00000000067C2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000008.00000000.392252295.00000000067C2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314786849.0000000000735000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363059633.0000000000735000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000008.00000000.427008416.000000000EF1B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}AppD
          Source: explorer.exe, 00000008.00000000.400081450.000000000EED4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}sapps_1
          Source: 7AYsP32Q7Y.exe, 00000001.00000003.314786849.0000000000735000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363059633.0000000000735000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW,
          Source: explorer.exe, 00000008.00000000.420887427.00000000086C9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04756DE6 rdtsc 7_2_04756DE6
          Source: C:\Windows\SysWOW64\DpiScaling.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473746D mov eax, dword ptr fs:[00000030h]7_2_0473746D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AC450 mov eax, dword ptr fs:[00000030h]7_2_047AC450
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AC450 mov eax, dword ptr fs:[00000030h]7_2_047AC450
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A44B mov eax, dword ptr fs:[00000030h]7_2_0474A44B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474BC2C mov eax, dword ptr fs:[00000030h]7_2_0474BC2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E740D mov eax, dword ptr fs:[00000030h]7_2_047E740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E740D mov eax, dword ptr fs:[00000030h]7_2_047E740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E740D mov eax, dword ptr fs:[00000030h]7_2_047E740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h]7_2_04796C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h]7_2_04796C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h]7_2_04796C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796C0A mov eax, dword ptr fs:[00000030h]7_2_04796C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1C06 mov eax, dword ptr fs:[00000030h]7_2_047D1C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D14FB mov eax, dword ptr fs:[00000030h]7_2_047D14FB
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h]7_2_04796CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h]7_2_04796CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796CF0 mov eax, dword ptr fs:[00000030h]7_2_04796CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8CD6 mov eax, dword ptr fs:[00000030h]7_2_047E8CD6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472849B mov eax, dword ptr fs:[00000030h]7_2_0472849B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473C577 mov eax, dword ptr fs:[00000030h]7_2_0473C577
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473C577 mov eax, dword ptr fs:[00000030h]7_2_0473C577
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04737D50 mov eax, dword ptr fs:[00000030h]7_2_04737D50
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04753D43 mov eax, dword ptr fs:[00000030h]7_2_04753D43
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04793540 mov eax, dword ptr fs:[00000030h]7_2_04793540
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047C3D40 mov eax, dword ptr fs:[00000030h]7_2_047C3D40
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471AD30 mov eax, dword ptr fs:[00000030h]7_2_0471AD30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DE539 mov eax, dword ptr fs:[00000030h]7_2_047DE539
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04723D34 mov eax, dword ptr fs:[00000030h]7_2_04723D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8D34 mov eax, dword ptr fs:[00000030h]7_2_047E8D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0479A537 mov eax, dword ptr fs:[00000030h]7_2_0479A537
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h]7_2_04744D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h]7_2_04744D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744D3B mov eax, dword ptr fs:[00000030h]7_2_04744D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047C8DF1 mov eax, dword ptr fs:[00000030h]7_2_047C8DF1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472D5E0 mov eax, dword ptr fs:[00000030h]7_2_0472D5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472D5E0 mov eax, dword ptr fs:[00000030h]7_2_0472D5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h]7_2_047DFDE2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h]7_2_047DFDE2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h]7_2_047DFDE2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DFDE2 mov eax, dword ptr fs:[00000030h]7_2_047DFDE2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov ecx, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04796DC9 mov eax, dword ptr fs:[00000030h]7_2_04796DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h]7_2_04741DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h]7_2_04741DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04741DB5 mov eax, dword ptr fs:[00000030h]7_2_04741DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E05AC mov eax, dword ptr fs:[00000030h]7_2_047E05AC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E05AC mov eax, dword ptr fs:[00000030h]7_2_047E05AC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047435A1 mov eax, dword ptr fs:[00000030h]7_2_047435A1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474FD9B mov eax, dword ptr fs:[00000030h]7_2_0474FD9B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474FD9B mov eax, dword ptr fs:[00000030h]7_2_0474FD9B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742581 mov eax, dword ptr fs:[00000030h]7_2_04742581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742581 mov eax, dword ptr fs:[00000030h]7_2_04742581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742581 mov eax, dword ptr fs:[00000030h]7_2_04742581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742581 mov eax, dword ptr fs:[00000030h]7_2_04742581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h]7_2_04712D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h]7_2_04712D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h]7_2_04712D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h]7_2_04712D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04712D8A mov eax, dword ptr fs:[00000030h]7_2_04712D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h]7_2_0473AE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h]7_2_0473AE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h]7_2_0473AE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h]7_2_0473AE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473AE73 mov eax, dword ptr fs:[00000030h]7_2_0473AE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472766D mov eax, dword ptr fs:[00000030h]7_2_0472766D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04727E41 mov eax, dword ptr fs:[00000030h]7_2_04727E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DAE44 mov eax, dword ptr fs:[00000030h]7_2_047DAE44
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DAE44 mov eax, dword ptr fs:[00000030h]7_2_047DAE44
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047CFE3F mov eax, dword ptr fs:[00000030h]7_2_047CFE3F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471E620 mov eax, dword ptr fs:[00000030h]7_2_0471E620
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A61C mov eax, dword ptr fs:[00000030h]7_2_0474A61C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A61C mov eax, dword ptr fs:[00000030h]7_2_0474A61C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h]7_2_0471C600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h]7_2_0471C600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471C600 mov eax, dword ptr fs:[00000030h]7_2_0471C600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04748E00 mov eax, dword ptr fs:[00000030h]7_2_04748E00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D1608 mov eax, dword ptr fs:[00000030h]7_2_047D1608
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047276E2 mov eax, dword ptr fs:[00000030h]7_2_047276E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047416E0 mov ecx, dword ptr fs:[00000030h]7_2_047416E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8ED6 mov eax, dword ptr fs:[00000030h]7_2_047E8ED6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04758EC7 mov eax, dword ptr fs:[00000030h]7_2_04758EC7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047436CC mov eax, dword ptr fs:[00000030h]7_2_047436CC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047CFEC0 mov eax, dword ptr fs:[00000030h]7_2_047CFEC0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h]7_2_047E0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h]7_2_047E0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E0EA5 mov eax, dword ptr fs:[00000030h]7_2_047E0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047946A7 mov eax, dword ptr fs:[00000030h]7_2_047946A7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AFE87 mov eax, dword ptr fs:[00000030h]7_2_047AFE87
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472FF60 mov eax, dword ptr fs:[00000030h]7_2_0472FF60
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8F6A mov eax, dword ptr fs:[00000030h]7_2_047E8F6A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472EF40 mov eax, dword ptr fs:[00000030h]7_2_0472EF40
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474E730 mov eax, dword ptr fs:[00000030h]7_2_0474E730
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04714F2E mov eax, dword ptr fs:[00000030h]7_2_04714F2E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04714F2E mov eax, dword ptr fs:[00000030h]7_2_04714F2E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473F716 mov eax, dword ptr fs:[00000030h]7_2_0473F716
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AFF10 mov eax, dword ptr fs:[00000030h]7_2_047AFF10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AFF10 mov eax, dword ptr fs:[00000030h]7_2_047AFF10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E070D mov eax, dword ptr fs:[00000030h]7_2_047E070D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E070D mov eax, dword ptr fs:[00000030h]7_2_047E070D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A70E mov eax, dword ptr fs:[00000030h]7_2_0474A70E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A70E mov eax, dword ptr fs:[00000030h]7_2_0474A70E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047537F5 mov eax, dword ptr fs:[00000030h]7_2_047537F5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04728794 mov eax, dword ptr fs:[00000030h]7_2_04728794
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797794 mov eax, dword ptr fs:[00000030h]7_2_04797794
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797794 mov eax, dword ptr fs:[00000030h]7_2_04797794
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797794 mov eax, dword ptr fs:[00000030h]7_2_04797794
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E1074 mov eax, dword ptr fs:[00000030h]7_2_047E1074
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D2073 mov eax, dword ptr fs:[00000030h]7_2_047D2073
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04730050 mov eax, dword ptr fs:[00000030h]7_2_04730050
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04730050 mov eax, dword ptr fs:[00000030h]7_2_04730050
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h]7_2_0472B02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h]7_2_0472B02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h]7_2_0472B02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472B02A mov eax, dword ptr fs:[00000030h]7_2_0472B02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474002D mov eax, dword ptr fs:[00000030h]7_2_0474002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474002D mov eax, dword ptr fs:[00000030h]7_2_0474002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474002D mov eax, dword ptr fs:[00000030h]7_2_0474002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474002D mov eax, dword ptr fs:[00000030h]7_2_0474002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474002D mov eax, dword ptr fs:[00000030h]7_2_0474002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E4015 mov eax, dword ptr fs:[00000030h]7_2_047E4015
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E4015 mov eax, dword ptr fs:[00000030h]7_2_047E4015
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797016 mov eax, dword ptr fs:[00000030h]7_2_04797016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797016 mov eax, dword ptr fs:[00000030h]7_2_04797016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04797016 mov eax, dword ptr fs:[00000030h]7_2_04797016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h]7_2_047140E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h]7_2_047140E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047140E1 mov eax, dword ptr fs:[00000030h]7_2_047140E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047158EC mov eax, dword ptr fs:[00000030h]7_2_047158EC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov ecx, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047AB8D0 mov eax, dword ptr fs:[00000030h]7_2_047AB8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474F0BF mov ecx, dword ptr fs:[00000030h]7_2_0474F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474F0BF mov eax, dword ptr fs:[00000030h]7_2_0474F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474F0BF mov eax, dword ptr fs:[00000030h]7_2_0474F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047420A0 mov eax, dword ptr fs:[00000030h]7_2_047420A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047590AF mov eax, dword ptr fs:[00000030h]7_2_047590AF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719080 mov eax, dword ptr fs:[00000030h]7_2_04719080
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04793884 mov eax, dword ptr fs:[00000030h]7_2_04793884
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04793884 mov eax, dword ptr fs:[00000030h]7_2_04793884
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471B171 mov eax, dword ptr fs:[00000030h]7_2_0471B171
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471B171 mov eax, dword ptr fs:[00000030h]7_2_0471B171
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471C962 mov eax, dword ptr fs:[00000030h]7_2_0471C962
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473B944 mov eax, dword ptr fs:[00000030h]7_2_0473B944
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473B944 mov eax, dword ptr fs:[00000030h]7_2_0473B944
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474513A mov eax, dword ptr fs:[00000030h]7_2_0474513A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474513A mov eax, dword ptr fs:[00000030h]7_2_0474513A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04734120 mov eax, dword ptr fs:[00000030h]7_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04734120 mov eax, dword ptr fs:[00000030h]7_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04734120 mov eax, dword ptr fs:[00000030h]7_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04734120 mov eax, dword ptr fs:[00000030h]7_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04734120 mov ecx, dword ptr fs:[00000030h]7_2_04734120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719100 mov eax, dword ptr fs:[00000030h]7_2_04719100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719100 mov eax, dword ptr fs:[00000030h]7_2_04719100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719100 mov eax, dword ptr fs:[00000030h]7_2_04719100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h]7_2_0471B1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h]7_2_0471B1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471B1E1 mov eax, dword ptr fs:[00000030h]7_2_0471B1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047A41E8 mov eax, dword ptr fs:[00000030h]7_2_047A41E8
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047951BE mov eax, dword ptr fs:[00000030h]7_2_047951BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047951BE mov eax, dword ptr fs:[00000030h]7_2_047951BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047951BE mov eax, dword ptr fs:[00000030h]7_2_047951BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047951BE mov eax, dword ptr fs:[00000030h]7_2_047951BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047461A0 mov eax, dword ptr fs:[00000030h]7_2_047461A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047461A0 mov eax, dword ptr fs:[00000030h]7_2_047461A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h]7_2_047D49A4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h]7_2_047D49A4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h]7_2_047D49A4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D49A4 mov eax, dword ptr fs:[00000030h]7_2_047D49A4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047969A6 mov eax, dword ptr fs:[00000030h]7_2_047969A6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742990 mov eax, dword ptr fs:[00000030h]7_2_04742990
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473C182 mov eax, dword ptr fs:[00000030h]7_2_0473C182
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474A185 mov eax, dword ptr fs:[00000030h]7_2_0474A185
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0475927A mov eax, dword ptr fs:[00000030h]7_2_0475927A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047CB260 mov eax, dword ptr fs:[00000030h]7_2_047CB260
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047CB260 mov eax, dword ptr fs:[00000030h]7_2_047CB260
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8A62 mov eax, dword ptr fs:[00000030h]7_2_047E8A62
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DEA55 mov eax, dword ptr fs:[00000030h]7_2_047DEA55
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047A4257 mov eax, dword ptr fs:[00000030h]7_2_047A4257
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719240 mov eax, dword ptr fs:[00000030h]7_2_04719240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719240 mov eax, dword ptr fs:[00000030h]7_2_04719240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719240 mov eax, dword ptr fs:[00000030h]7_2_04719240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04719240 mov eax, dword ptr fs:[00000030h]7_2_04719240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04754A2C mov eax, dword ptr fs:[00000030h]7_2_04754A2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04754A2C mov eax, dword ptr fs:[00000030h]7_2_04754A2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04715210 mov eax, dword ptr fs:[00000030h]7_2_04715210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04715210 mov ecx, dword ptr fs:[00000030h]7_2_04715210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04715210 mov eax, dword ptr fs:[00000030h]7_2_04715210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04715210 mov eax, dword ptr fs:[00000030h]7_2_04715210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471AA16 mov eax, dword ptr fs:[00000030h]7_2_0471AA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471AA16 mov eax, dword ptr fs:[00000030h]7_2_0471AA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DAA16 mov eax, dword ptr fs:[00000030h]7_2_047DAA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047DAA16 mov eax, dword ptr fs:[00000030h]7_2_047DAA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04733A1C mov eax, dword ptr fs:[00000030h]7_2_04733A1C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04728A0A mov eax, dword ptr fs:[00000030h]7_2_04728A0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742AE4 mov eax, dword ptr fs:[00000030h]7_2_04742AE4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742ACB mov eax, dword ptr fs:[00000030h]7_2_04742ACB
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472AAB0 mov eax, dword ptr fs:[00000030h]7_2_0472AAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0472AAB0 mov eax, dword ptr fs:[00000030h]7_2_0472AAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474FAB0 mov eax, dword ptr fs:[00000030h]7_2_0474FAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h]7_2_047152A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h]7_2_047152A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h]7_2_047152A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h]7_2_047152A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047152A5 mov eax, dword ptr fs:[00000030h]7_2_047152A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474D294 mov eax, dword ptr fs:[00000030h]7_2_0474D294
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474D294 mov eax, dword ptr fs:[00000030h]7_2_0474D294
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04743B7A mov eax, dword ptr fs:[00000030h]7_2_04743B7A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04743B7A mov eax, dword ptr fs:[00000030h]7_2_04743B7A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471DB60 mov ecx, dword ptr fs:[00000030h]7_2_0471DB60
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E8B58 mov eax, dword ptr fs:[00000030h]7_2_047E8B58
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471F358 mov eax, dword ptr fs:[00000030h]7_2_0471F358
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0471DB40 mov eax, dword ptr fs:[00000030h]7_2_0471DB40
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D131B mov eax, dword ptr fs:[00000030h]7_2_047D131B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047403E2 mov eax, dword ptr fs:[00000030h]7_2_047403E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0473DBE9 mov eax, dword ptr fs:[00000030h]7_2_0473DBE9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047953CA mov eax, dword ptr fs:[00000030h]7_2_047953CA
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047953CA mov eax, dword ptr fs:[00000030h]7_2_047953CA
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h]7_2_04744BAD
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h]7_2_04744BAD
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04744BAD mov eax, dword ptr fs:[00000030h]7_2_04744BAD
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047E5BA5 mov eax, dword ptr fs:[00000030h]7_2_047E5BA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04742397 mov eax, dword ptr fs:[00000030h]7_2_04742397
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_0474B390 mov eax, dword ptr fs:[00000030h]7_2_0474B390
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047D138A mov eax, dword ptr fs:[00000030h]7_2_047D138A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_047CD380 mov ecx, dword ptr fs:[00000030h]7_2_047CD380
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04721B8F mov eax, dword ptr fs:[00000030h]7_2_04721B8F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04721B8F mov eax, dword ptr fs:[00000030h]7_2_04721B8F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h]19_2_042EB02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h]19_2_042EB02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h]19_2_042EB02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EB02A mov eax, dword ptr fs:[00000030h]19_2_042EB02A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430BC2C mov eax, dword ptr fs:[00000030h]19_2_0430BC2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430002D mov eax, dword ptr fs:[00000030h]19_2_0430002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430002D mov eax, dword ptr fs:[00000030h]19_2_0430002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430002D mov eax, dword ptr fs:[00000030h]19_2_0430002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430002D mov eax, dword ptr fs:[00000030h]19_2_0430002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430002D mov eax, dword ptr fs:[00000030h]19_2_0430002D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04357016 mov eax, dword ptr fs:[00000030h]19_2_04357016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04357016 mov eax, dword ptr fs:[00000030h]19_2_04357016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04357016 mov eax, dword ptr fs:[00000030h]19_2_04357016
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A4015 mov eax, dword ptr fs:[00000030h]19_2_043A4015
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A4015 mov eax, dword ptr fs:[00000030h]19_2_043A4015
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A740D mov eax, dword ptr fs:[00000030h]19_2_043A740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A740D mov eax, dword ptr fs:[00000030h]19_2_043A740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A740D mov eax, dword ptr fs:[00000030h]19_2_043A740D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391C06 mov eax, dword ptr fs:[00000030h]19_2_04391C06
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h]19_2_04356C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h]19_2_04356C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h]19_2_04356C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356C0A mov eax, dword ptr fs:[00000030h]19_2_04356C0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F746D mov eax, dword ptr fs:[00000030h]19_2_042F746D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04392073 mov eax, dword ptr fs:[00000030h]19_2_04392073
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A1074 mov eax, dword ptr fs:[00000030h]19_2_043A1074
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436C450 mov eax, dword ptr fs:[00000030h]19_2_0436C450
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436C450 mov eax, dword ptr fs:[00000030h]19_2_0436C450
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A44B mov eax, dword ptr fs:[00000030h]19_2_0430A44B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F0050 mov eax, dword ptr fs:[00000030h]19_2_042F0050
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F0050 mov eax, dword ptr fs:[00000030h]19_2_042F0050
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430F0BF mov ecx, dword ptr fs:[00000030h]19_2_0430F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430F0BF mov eax, dword ptr fs:[00000030h]19_2_0430F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430F0BF mov eax, dword ptr fs:[00000030h]19_2_0430F0BF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043020A0 mov eax, dword ptr fs:[00000030h]19_2_043020A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043190AF mov eax, dword ptr fs:[00000030h]19_2_043190AF
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9080 mov eax, dword ptr fs:[00000030h]19_2_042D9080
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04353884 mov eax, dword ptr fs:[00000030h]19_2_04353884
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04353884 mov eax, dword ptr fs:[00000030h]19_2_04353884
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E849B mov eax, dword ptr fs:[00000030h]19_2_042E849B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D58EC mov eax, dword ptr fs:[00000030h]19_2_042D58EC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043914FB mov eax, dword ptr fs:[00000030h]19_2_043914FB
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h]19_2_04356CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h]19_2_04356CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356CF0 mov eax, dword ptr fs:[00000030h]19_2_04356CF0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov ecx, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436B8D0 mov eax, dword ptr fs:[00000030h]19_2_0436B8D0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A8CD6 mov eax, dword ptr fs:[00000030h]19_2_043A8CD6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0435A537 mov eax, dword ptr fs:[00000030h]19_2_0435A537
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430513A mov eax, dword ptr fs:[00000030h]19_2_0430513A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430513A mov eax, dword ptr fs:[00000030h]19_2_0430513A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h]19_2_04304D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h]19_2_04304D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04304D3B mov eax, dword ptr fs:[00000030h]19_2_04304D3B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A8D34 mov eax, dword ptr fs:[00000030h]19_2_043A8D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h]19_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h]19_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h]19_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F4120 mov eax, dword ptr fs:[00000030h]19_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F4120 mov ecx, dword ptr fs:[00000030h]19_2_042F4120
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E3D34 mov eax, dword ptr fs:[00000030h]19_2_042E3D34
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DAD30 mov eax, dword ptr fs:[00000030h]19_2_042DAD30
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h]19_2_042D9100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h]19_2_042D9100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9100 mov eax, dword ptr fs:[00000030h]19_2_042D9100
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DC962 mov eax, dword ptr fs:[00000030h]19_2_042DC962
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FC577 mov eax, dword ptr fs:[00000030h]19_2_042FC577
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FC577 mov eax, dword ptr fs:[00000030h]19_2_042FC577
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DB171 mov eax, dword ptr fs:[00000030h]19_2_042DB171
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DB171 mov eax, dword ptr fs:[00000030h]19_2_042DB171
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FB944 mov eax, dword ptr fs:[00000030h]19_2_042FB944
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FB944 mov eax, dword ptr fs:[00000030h]19_2_042FB944
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04313D43 mov eax, dword ptr fs:[00000030h]19_2_04313D43
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04353540 mov eax, dword ptr fs:[00000030h]19_2_04353540
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F7D50 mov eax, dword ptr fs:[00000030h]19_2_042F7D50
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h]19_2_04301DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h]19_2_04301DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04301DB5 mov eax, dword ptr fs:[00000030h]19_2_04301DB5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043551BE mov eax, dword ptr fs:[00000030h]19_2_043551BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043551BE mov eax, dword ptr fs:[00000030h]19_2_043551BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043551BE mov eax, dword ptr fs:[00000030h]19_2_043551BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043551BE mov eax, dword ptr fs:[00000030h]19_2_043551BE
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043061A0 mov eax, dword ptr fs:[00000030h]19_2_043061A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043061A0 mov eax, dword ptr fs:[00000030h]19_2_043061A0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043035A1 mov eax, dword ptr fs:[00000030h]19_2_043035A1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043569A6 mov eax, dword ptr fs:[00000030h]19_2_043569A6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A05AC mov eax, dword ptr fs:[00000030h]19_2_043A05AC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A05AC mov eax, dword ptr fs:[00000030h]19_2_043A05AC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302990 mov eax, dword ptr fs:[00000030h]19_2_04302990
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h]19_2_042D2D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h]19_2_042D2D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h]19_2_042D2D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h]19_2_042D2D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D2D8A mov eax, dword ptr fs:[00000030h]19_2_042D2D8A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430FD9B mov eax, dword ptr fs:[00000030h]19_2_0430FD9B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430FD9B mov eax, dword ptr fs:[00000030h]19_2_0430FD9B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FC182 mov eax, dword ptr fs:[00000030h]19_2_042FC182
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302581 mov eax, dword ptr fs:[00000030h]19_2_04302581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302581 mov eax, dword ptr fs:[00000030h]19_2_04302581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302581 mov eax, dword ptr fs:[00000030h]19_2_04302581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302581 mov eax, dword ptr fs:[00000030h]19_2_04302581
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A185 mov eax, dword ptr fs:[00000030h]19_2_0430A185
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04388DF1 mov eax, dword ptr fs:[00000030h]19_2_04388DF1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h]19_2_042DB1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h]19_2_042DB1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DB1E1 mov eax, dword ptr fs:[00000030h]19_2_042DB1E1
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042ED5E0 mov eax, dword ptr fs:[00000030h]19_2_042ED5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042ED5E0 mov eax, dword ptr fs:[00000030h]19_2_042ED5E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043641E8 mov eax, dword ptr fs:[00000030h]19_2_043641E8
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov ecx, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04356DC9 mov eax, dword ptr fs:[00000030h]19_2_04356DC9
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0438FE3F mov eax, dword ptr fs:[00000030h]19_2_0438FE3F
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DE620 mov eax, dword ptr fs:[00000030h]19_2_042DE620
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04314A2C mov eax, dword ptr fs:[00000030h]19_2_04314A2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04314A2C mov eax, dword ptr fs:[00000030h]19_2_04314A2C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E8A0A mov eax, dword ptr fs:[00000030h]19_2_042E8A0A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A61C mov eax, dword ptr fs:[00000030h]19_2_0430A61C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A61C mov eax, dword ptr fs:[00000030h]19_2_0430A61C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h]19_2_042DC600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h]19_2_042DC600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DC600 mov eax, dword ptr fs:[00000030h]19_2_042DC600
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04308E00 mov eax, dword ptr fs:[00000030h]19_2_04308E00
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04391608 mov eax, dword ptr fs:[00000030h]19_2_04391608
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042F3A1C mov eax, dword ptr fs:[00000030h]19_2_042F3A1C
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DAA16 mov eax, dword ptr fs:[00000030h]19_2_042DAA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DAA16 mov eax, dword ptr fs:[00000030h]19_2_042DAA16
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h]19_2_042D5210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D5210 mov ecx, dword ptr fs:[00000030h]19_2_042D5210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h]19_2_042D5210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D5210 mov eax, dword ptr fs:[00000030h]19_2_042D5210
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E766D mov eax, dword ptr fs:[00000030h]19_2_042E766D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0431927A mov eax, dword ptr fs:[00000030h]19_2_0431927A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0438B260 mov eax, dword ptr fs:[00000030h]19_2_0438B260
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0438B260 mov eax, dword ptr fs:[00000030h]19_2_0438B260
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A8A62 mov eax, dword ptr fs:[00000030h]19_2_043A8A62
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h]19_2_042FAE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h]19_2_042FAE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h]19_2_042FAE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h]19_2_042FAE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FAE73 mov eax, dword ptr fs:[00000030h]19_2_042FAE73
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04364257 mov eax, dword ptr fs:[00000030h]19_2_04364257
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h]19_2_042D9240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h]19_2_042D9240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h]19_2_042D9240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D9240 mov eax, dword ptr fs:[00000030h]19_2_042D9240
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E7E41 mov eax, dword ptr fs:[00000030h]19_2_042E7E41
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430FAB0 mov eax, dword ptr fs:[00000030h]19_2_0430FAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h]19_2_042D52A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h]19_2_042D52A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h]19_2_042D52A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h]19_2_042D52A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D52A5 mov eax, dword ptr fs:[00000030h]19_2_042D52A5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043546A7 mov eax, dword ptr fs:[00000030h]19_2_043546A7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EAAB0 mov eax, dword ptr fs:[00000030h]19_2_042EAAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042EAAB0 mov eax, dword ptr fs:[00000030h]19_2_042EAAB0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h]19_2_043A0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h]19_2_043A0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A0EA5 mov eax, dword ptr fs:[00000030h]19_2_043A0EA5
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430D294 mov eax, dword ptr fs:[00000030h]19_2_0430D294
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430D294 mov eax, dword ptr fs:[00000030h]19_2_0430D294
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436FE87 mov eax, dword ptr fs:[00000030h]19_2_0436FE87
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042E76E2 mov eax, dword ptr fs:[00000030h]19_2_042E76E2
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043016E0 mov ecx, dword ptr fs:[00000030h]19_2_043016E0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302AE4 mov eax, dword ptr fs:[00000030h]19_2_04302AE4
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A8ED6 mov eax, dword ptr fs:[00000030h]19_2_043A8ED6
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04318EC7 mov eax, dword ptr fs:[00000030h]19_2_04318EC7
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0438FEC0 mov eax, dword ptr fs:[00000030h]19_2_0438FEC0
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04302ACB mov eax, dword ptr fs:[00000030h]19_2_04302ACB
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043036CC mov eax, dword ptr fs:[00000030h]19_2_043036CC
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430E730 mov eax, dword ptr fs:[00000030h]19_2_0430E730
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D4F2E mov eax, dword ptr fs:[00000030h]19_2_042D4F2E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042D4F2E mov eax, dword ptr fs:[00000030h]19_2_042D4F2E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0439131B mov eax, dword ptr fs:[00000030h]19_2_0439131B
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436FF10 mov eax, dword ptr fs:[00000030h]19_2_0436FF10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0436FF10 mov eax, dword ptr fs:[00000030h]19_2_0436FF10
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A070D mov eax, dword ptr fs:[00000030h]19_2_043A070D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_043A070D mov eax, dword ptr fs:[00000030h]19_2_043A070D
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042FF716 mov eax, dword ptr fs:[00000030h]19_2_042FF716
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A70E mov eax, dword ptr fs:[00000030h]19_2_0430A70E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_0430A70E mov eax, dword ptr fs:[00000030h]19_2_0430A70E
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04303B7A mov eax, dword ptr fs:[00000030h]19_2_04303B7A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_04303B7A mov eax, dword ptr fs:[00000030h]19_2_04303B7A
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 19_2_042DDB60 mov ecx, dword ptr fs:[00000030h]19_2_042DDB60
          Source: C:\Windows\SysWOW64\DpiScaling.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\logagent.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\cscript.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeCode function: 7_2_04759540 NtReadFile,LdrInitializeThunk,7_2_04759540

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection unmapped: C:\Windows\SysWOW64\cscript.exe base address: 9F0000Jump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection unmapped: C:\Windows\SysWOW64\msiexec.exe base address: DF0000Jump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeSection loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\logagent.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\logagent.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000Jump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 690000Jump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 6A0000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 140000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 150000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\logagent.exe base: 72480000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\logagent.exe base: D80000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\logagent.exe base: D90000Jump to behavior
          Allocates memory in foreign processes
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 690000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 6A0000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 140000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\DpiScaling.exe base: 150000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\logagent.exe base: 72480000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\logagent.exe base: D80000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory allocated: C:\Windows\SysWOW64\logagent.exe base: D90000 protect: page execute and read and writeJump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5AJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\DpiScaling.exe base: 72480000 value starts with: 4D5AJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeMemory written: C:\Windows\SysWOW64\logagent.exe base: 72480000 value starts with: 4D5AJump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Windows\SysWOW64\DpiScaling.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\SysWOW64\DpiScaling.exeThread register set: target process: 3352Jump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeThread register set: target process: 3352Jump to behavior
          Source: C:\Windows\SysWOW64\DpiScaling.exeThread register set: target process: 3352Jump to behavior
          Source: C:\Windows\SysWOW64\logagent.exeThread register set: target process: 3352Jump to behavior
          Source: C:\Windows\SysWOW64\logagent.exeThread register set: target process: 3352Jump to behavior
          Source: C:\Windows\SysWOW64\msiexec.exeThread register set: target process: 3352Jump to behavior
          Creates a thread in another existing process (thread injection)
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeThread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 6A0000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeThread created: C:\Windows\SysWOW64\DpiScaling.exe EIP: 150000Jump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeThread created: C:\Windows\SysWOW64\logagent.exe EIP: D90000Jump to behavior
          Source: C:\Users\user\Desktop\7AYsP32Q7Y.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\DpiScaling.exe C:\Windows\System32\DpiScaling.exeJump to behavior
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeProcess created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exeJump to behavior
          Source: explorer.exe, 00000008.00000000.388552936.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.407078346.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.436325364.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.510076819.0000000000B68000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman\Pr
          Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000008.00000000.409960799.0000000005E10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.444658827.0000000005E10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.392134127.0000000005E10000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000008.00000000.388839849.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.437001992.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.407437943.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.511597253.00000000011E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000008.00000000.462908991.000000000875B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.396887667.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.421067968.000000000875B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndh
          Source: C:\Users\user\Contacts\Iodqgrdelf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.2.DpiScaling.exe.72480000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.logagent.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.0.logagent.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.0.DpiScaling.exe.72480000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 19.0.DpiScaling.exe.72480000.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Shared Modules          		1
          Registry Run Keys / Startup Folder          		812
          Process Injection          		1
          Masquerading          		OS Credential Dumping221
          Security Software Discovery          		Remote Services1
          Archive Collected Data          		Exfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/Job1
          DLL Side-Loading          		1
          Registry Run Keys / Startup Folder          		1
          Virtualization/Sandbox Evasion          		LSASS Memory1
          Virtualization/Sandbox Evasion          		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
          Non-Application Layer Protocol          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)1
          DLL Side-Loading          		812
          Process Injection          		Security Account Manager2
          Process Discovery          		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration11
          Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
          Deobfuscate/Decode Files or Information          		NTDS1
          Remote System Discovery          		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script2
          Obfuscated Files or Information          		LSA Secrets12
          System Information Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common1
          Software Packing          		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items1
          DLL Side-Loading          		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562059 Sample: 7AYsP32Q7Y Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 39 www.graffity-aws.com 2->39 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 2 other signatures 2->65 10 7AYsP32Q7Y.exe 1 17 2->10         started        signatures3 process4 dnsIp5 53 vru2ia.am.files.1drv.com 10->53 55 onedrive.live.com 10->55 57 am-files.fe.1drv.com 10->57 35 C:\Users\user\Contacts\Iodqgrdelf.exe, PE32 10->35 dropped 37 C:\Users\...\Iodqgrdelf.exe:Zone.Identifier, ASCII 10->37 dropped 83 Writes to foreign memory regions 10->83 85 Allocates memory in foreign processes 10->85 87 Creates a thread in another existing process (thread injection) 10->87 89 Injects a PE file into a foreign processes 10->89 15 DpiScaling.exe 10->15         started        file6 signatures7 process8 signatures9 99 Modifies the context of a thread in another process (thread injection) 15->99 101 Maps a DLL or memory area into another process 15->101 103 Sample uses process hollowing technique 15->103 105 2 other signatures 15->105 18 explorer.exe 2 15->18 injected process10 process11 20 Iodqgrdelf.exe 15 18->20         started        24 Iodqgrdelf.exe 15 18->24         started        26 msiexec.exe 18->26         started        28 2 other processes 18->28 dnsIp12 41 vru2ia.am.files.1drv.com 20->41 43 onedrive.live.com 20->43 45 am-files.fe.1drv.com 20->45 67 Multi AV Scanner detection for dropped file 20->67 69 Writes to foreign memory regions 20->69 71 Allocates memory in foreign processes 20->71 30 DpiScaling.exe 20->30         started        47 vru2ia.am.files.1drv.com 24->47 49 onedrive.live.com 24->49 51 am-files.fe.1drv.com 24->51 73 Creates a thread in another existing process (thread injection) 24->73 75 Injects a PE file into a foreign processes 24->75 33 logagent.exe 24->33         started        77 Modifies the context of a thread in another process (thread injection) 26->77 79 Maps a DLL or memory area into another process 26->79 81 Tries to detect virtualization through RDTSC time measurements 28->81 signatures13 process14 signatures15 91 Modifies the context of a thread in another process (thread injection) 30->91 93 Maps a DLL or memory area into another process 30->93 95 Sample uses process hollowing technique 30->95 97 Tries to detect virtualization through RDTSC time measurements 33->97

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          7AYsP32Q7Y.exe21%VirustotalBrowse

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\Contacts\Iodqgrdelf.exe21%VirustotalBrowse

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          7.0.DpiScaling.exe.72480000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          19.0.DpiScaling.exe.72480000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          22.2.msiexec.exe.2eac4e8.1.unpack100%AviraTR/Patched.Ren.Gen8Download File
          20.0.logagent.exe.72480000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          7.2.DpiScaling.exe.72480000.4.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          19.2.DpiScaling.exe.72480000.4.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          7.0.DpiScaling.exe.72480000.2.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          20.0.logagent.exe.72480000.2.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          19.0.DpiScaling.exe.72480000.2.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          20.0.logagent.exe.72480000.1.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          20.0.logagent.exe.72480000.3.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          20.2.logagent.exe.72480000.3.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          19.0.DpiScaling.exe.72480000.1.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          19.0.DpiScaling.exe.72480000.3.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          7.0.DpiScaling.exe.72480000.1.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          7.0.DpiScaling.exe.72480000.3.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          www.fyonkaly.com/ahc8/0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          onedrive.live.com
          		unknown
          		unknownfalse
            		high
            vru2ia.am.files.1drv.com
            		unknown
            		unknownfalse
              		high
              www.graffity-aws.com
              		unknown
              		unknowntrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                www.fyonkaly.com/ahc8/true
                • Avira URL Cloud: safe
                		low

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://vru2ia.am.files.1drv.com/y4m423aJ2r6bprjijqR9Zhv79BsqXWchgBZ_yRRKAukc5TAIPNB4BdYAYidrCTJ4BkE7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410519278.000000000075D000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.410740246.000000000075D000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://vru2ia.am.files.1drv.com/y4mqmZSB7T13rwuDyCkOltxUalsuuekof9Mak2JfMqUquSjRzSFu0dx_u0qHh2VQFIgIodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432635294.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432387332.00000000007CF000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://onedrive.live.com/download?cid=C38D15779Iodqgrdelf.exe, 00000009.00000003.408286510.000000000074F000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://vru2ia.am.files.1drv.com/y4m8TXF6mlgGvccZFUvhwUh-l9zz_V1hgmOQiTI_douTr2wu7UlvtGbODDxtwhN0e5HIodqgrdelf.exe, 00000009.00000003.412998037.000000000075A000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://vru2ia.am.files.1drv.com/y7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://vru2ia.am.files.1drv.com/y4mC-JI5vs5pbHFPeZ5KI8vSY-Zm0BYG_DfYRphHWKBbqd0ouSRcXTjDbP2g5pIoI5uIodqgrdelf.exe, 00000009.00000003.408295630.0000000000753000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://onedrive.live.com/ve.live.com/Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://onedrive.live.com/D7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://vru2ia.am.files.1drv.com/y4m4qzuMb9gIarzlKBTf0D1umDohf9Y3sIpL-K8zvk8UHM6XBD2Ajct4M-j4Gm20nJTIodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://vru2ia.am.files.1drv.com/y4mXdCXgV78z93QBfcFjKJ0ucHs8CARh8saaIpZ0Zw4IJExL4V9d7aCID-8TYoLJ0Qx7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://onedrive.live.com/download?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSsIodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://vru2ia.am.files.1drv.com/7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.432603036.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.438634245.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://onedrive.live.com/Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 0000000D.00000003.442577155.00000000007C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://onedrive.live.com/ownload?cid=C38D15779AFD1231&resid=C38D15779AFD1231%21112&authkey=AJglnSs07AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Iodqgrdelf.exe, 00000009.00000003.412972906.000000000074F000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://vru2ia.am.files.1drv.com/J7AYsP32Q7Y.exe, 00000001.00000003.314806769.0000000000758000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.312295068.000000000075F000.00000004.00000020.00020000.00000000.sdmp, 7AYsP32Q7Y.exe, 00000001.00000003.363106403.0000000000758000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high

                                              World Map of Contacted IPs

                                              ⊘No contacted IP infos

                                              General Information

                                              Joe Sandbox Version:34.0.0 Boulder Opal
                                              Analysis ID:562059
                                              Start date:28.01.2022
                                              Start time:11:09:41
                                              Joe Sandbox Product:CloudBasic
                                              Overall analysis duration:0h 12m 55s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Sample file name:7AYsP32Q7Y (renamed file extension from none to exe)
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                              Number of analysed new started processes analysed:26
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:1
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • HDC enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Detection:MAL
                                              Classification:mal100.troj.evad.winEXE@13/6@7/0
                                              EGA Information:
                                              • Successful, ratio: 40%
                                              HDC Information:
                                              • Successful, ratio: 100% (good quality ratio 86.4%)
                                              • Quality average: 71.2%
                                              • Quality standard deviation: 33.8%
                                              HCA Information:
                                              • Successful, ratio: 68%
                                              • Number of executed functions: 34
                                              • Number of non-executed functions: 174
                                              Cookbook Comments:
                                              • Adjust boot time
                                              • Enable AMSI

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                              • Excluded IPs from analysis (whitelisted): 13.107.43.13, 13.107.42.12, 13.107.42.13
                                              • Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, odc-web-geo.onedrive.akadns.net, arc.msn.com, l-0004.dc-msedge.net, ris.api.iris.microsoft.com, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, l-0003.l-msedge.net, odc-am-files-geo.onedrive.akadns.net, displaycatalog.mp.microsoft.com, am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, odc-am-files-brs.onedrive.akadns.net
                                              • Execution Graph export aborted for target 7AYsP32Q7Y.exe, PID 2940 because there are no executed function
                                              • Execution Graph export aborted for target Iodqgrdelf.exe, PID 1244 because there are no executed function
                                              • Execution Graph export aborted for target Iodqgrdelf.exe, PID 4140 because there are no executed function
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              11:10:43API Interceptor1x Sleep call for process: 7AYsP32Q7Y.exe modified
                                              11:11:22AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Iodqgrdelf C:\Users\user\Contacts\fledrgqdoI.url
                                              11:11:30AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Iodqgrdelf C:\Users\user\Contacts\fledrgqdoI.url
                                              11:11:31API Interceptor2x Sleep call for process: Iodqgrdelf.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              ⊘No context

                                              Domains

                                              ⊘No context

                                              ASNs

                                              ⊘No context

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Iodqgrdelfemgrjgzrzpbewqyzpzqin[1]

                                              Download File
                                              Process:C:\Users\user\Desktop\7AYsP32Q7Y.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):514560
                                              Entropy (8bit):7.996921857364207
                                              Encrypted:true
                                              SSDEEP:12288:4oPY/z8ZupMNRLMkbKYR+TegyIieXpcA/baXOo6T6:JRgmVbrR+nyIhZcV16T6
                                              MD5:F704A769D6C264FFB852E355C7B4AA2A
                                              SHA1:812C3E16D504F9EBB89595ADEC614CB92AE381E7
                                              SHA-256:DE66BB19CDBE25449A76FFBB95D750FB1E16A54BFBC88A4258ECEBDF1D9322E1
                                              SHA-512:E8F56CB2EE8CF49764CCC879C17B430378181805180455BDC7D795F5F1710AF77FBFCF2D07B25AAB32CA46CEBAFA239F074FFFD4EABAE1BE7C0E70CB2A0398A1
                                              Malicious:false
                                              Reputation:low
                                              Preview:..J.R.. i'.......{.Uw..=...s..N....<7.o!..+...l.......s......{.)..)..........$vB......`.%.,.-.w.........`..s........X....Qk g j.H....q:1...T...Z...n...B.8%.}.AZ..V..q.........+.f....V..q..._.a...Uq0.l.l.....w.$y.......u.!......_.K].F....d.#....f....4/..WzEJ.i-..AZ.a.g o).d..5.Si1.?..{....vOg49..~V.'....8/...EJ.i-..^...~^..j.].'.n...!..9..4&s.M`.m:9...........+.f.......{.Uw...~[........).....a._....+..#..$|^.....KX..{.H..o!.w..].......H./...e.P..3..Z..../....zT..~..:"`....:@.....Ub.}.l.{.m.......R..E].J..?....m,....+..]oI'.......>/..V.h.`../.g.*w...<#.3..7..7.....B.....*.....2l.....Z..u..C~MN.j...A[%./.g....+.R.)...X.f..J.........l.[.S^...l..j..X..R......f.k^.n....h.m,......#..@.m..`!..m.u.{.#.......c&H.K?.p....V..F.u..%.W.`..Gat@.(qQ(..o...1C.....>.B....y...1@.m.....sE..(...X.*...@..`...~.y.DE.Q....K...s).#n@~@DWz$......u...*..KXrxk.,5..... .@..q....|<QX...7.H....z..X..`.....B.F...b!..+........l........u.....-....b......H.W..5.

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Iodqgrdelfemgrjgzrzpbewqyzpzqin[1]

                                              Download File
                                              Process:C:\Users\user\Contacts\Iodqgrdelf.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):514560
                                              Entropy (8bit):7.996921857364207
                                              Encrypted:true
                                              SSDEEP:12288:4oPY/z8ZupMNRLMkbKYR+TegyIieXpcA/baXOo6T6:JRgmVbrR+nyIhZcV16T6
                                              MD5:F704A769D6C264FFB852E355C7B4AA2A
                                              SHA1:812C3E16D504F9EBB89595ADEC614CB92AE381E7
                                              SHA-256:DE66BB19CDBE25449A76FFBB95D750FB1E16A54BFBC88A4258ECEBDF1D9322E1
                                              SHA-512:E8F56CB2EE8CF49764CCC879C17B430378181805180455BDC7D795F5F1710AF77FBFCF2D07B25AAB32CA46CEBAFA239F074FFFD4EABAE1BE7C0E70CB2A0398A1
                                              Malicious:false
                                              Preview:..J.R.. i'.......{.Uw..=...s..N....<7.o!..+...l.......s......{.)..)..........$vB......`.%.,.-.w.........`..s........X....Qk g j.H....q:1...T...Z...n...B.8%.}.AZ..V..q.........+.f....V..q..._.a...Uq0.l.l.....w.$y.......u.!......_.K].F....d.#....f....4/..WzEJ.i-..AZ.a.g o).d..5.Si1.?..{....vOg49..~V.'....8/...EJ.i-..^...~^..j.].'.n...!..9..4&s.M`.m:9...........+.f.......{.Uw...~[........).....a._....+..#..$|^.....KX..{.H..o!.w..].......H./...e.P..3..Z..../....zT..~..:"`....:@.....Ub.}.l.{.m.......R..E].J..?....m,....+..]oI'.......>/..V.h.`../.g.*w...<#.3..7..7.....B.....*.....2l.....Z..u..C~MN.j...A[%./.g....+.R.)...X.f..J.........l.[.S^...l..j..X..R......f.k^.n....h.m,......#..@.m..`!..m.u.{.#.......c&H.K?.p....V..F.u..%.W.`..Gat@.(qQ(..o...1C.....>.B....y...1@.m.....sE..(...X.*...@..`...~.y.DE.Q....K...s).#n@~@DWz$......u...*..KXrxk.,5..... .@..q....|<QX...7.H....z..X..`.....B.F...b!..+........l........u.....-....b......H.W..5.

                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Iodqgrdelfemgrjgzrzpbewqyzpzqin[1]

                                              Download File
                                              Process:C:\Users\user\Contacts\Iodqgrdelf.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):514560
                                              Entropy (8bit):7.996921857364207
                                              Encrypted:true
                                              SSDEEP:12288:4oPY/z8ZupMNRLMkbKYR+TegyIieXpcA/baXOo6T6:JRgmVbrR+nyIhZcV16T6
                                              MD5:F704A769D6C264FFB852E355C7B4AA2A
                                              SHA1:812C3E16D504F9EBB89595ADEC614CB92AE381E7
                                              SHA-256:DE66BB19CDBE25449A76FFBB95D750FB1E16A54BFBC88A4258ECEBDF1D9322E1
                                              SHA-512:E8F56CB2EE8CF49764CCC879C17B430378181805180455BDC7D795F5F1710AF77FBFCF2D07B25AAB32CA46CEBAFA239F074FFFD4EABAE1BE7C0E70CB2A0398A1
                                              Malicious:false
                                              Preview:..J.R.. i'.......{.Uw..=...s..N....<7.o!..+...l.......s......{.)..)..........$vB......`.%.,.-.w.........`..s........X....Qk g j.H....q:1...T...Z...n...B.8%.}.AZ..V..q.........+.f....V..q..._.a...Uq0.l.l.....w.$y.......u.!......_.K].F....d.#....f....4/..WzEJ.i-..AZ.a.g o).d..5.Si1.?..{....vOg49..~V.'....8/...EJ.i-..^...~^..j.].'.n...!..9..4&s.M`.m:9...........+.f.......{.Uw...~[........).....a._....+..#..$|^.....KX..{.H..o!.w..].......H./...e.P..3..Z..../....zT..~..:"`....:@.....Ub.}.l.{.m.......R..E].J..?....m,....+..]oI'.......>/..V.h.`../.g.*w...<#.3..7..7.....B.....*.....2l.....Z..u..C~MN.j...A[%./.g....+.R.)...X.f..J.........l.[.S^...l..j..X..R......f.k^.n....h.m,......#..@.m..`!..m.u.{.#.......c&H.K?.p....V..F.u..%.W.`..Gat@.(qQ(..o...1C.....>.B....y...1@.m.....sE..(...X.*...@..`...~.y.DE.Q....K...s).#n@~@DWz$......u...*..KXrxk.,5..... .@..q....|<QX...7.H....z..X..`.....B.F...b!..+........l........u.....-....b......H.W..5.

                                              C:\Users\user\Contacts\Iodqgrdelf.exe

                                              Download File
                                              Process:C:\Users\user\Desktop\7AYsP32Q7Y.exe
                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):755200
                                              Entropy (8bit):7.005601638187975
                                              Encrypted:false
                                              SSDEEP:12288:0HZspw3ZruZb100eubQXXEcIi0FyoADygqwqmLjnEiCHcFaLcpXAAAAAAAAAAAA3:MZAws11Q7XU0G/Tgq/KjRd
                                              MD5:6AE185CE909F0B66306100824C28BAD1
                                              SHA1:5F23A2D4B2C564C95606E537E557AA8251087746
                                              SHA-256:074991CEFC03A7683CB3C81E83C383010F45C130FDC6DAFA13469BFFFAF87867
                                              SHA-512:01931C4D70F045957AA012A8912F483E11E0F069CEE8FD304ACC4CB7E44C838ABBE1EA870D0E13EF8573967845AB2E1102D47EB76CE6B688904CEACAA8258EF7
                                              Malicious:true
                                              Antivirus:
                                              • Antivirus: Virustotal, Detection: 21%, Browse
                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@..............................Z$.......&...................@...|...........................0......................................................CODE................................ ..`DATA................................@...BSS.....y................................idata..Z$.......&..................@....tls......... ...........................rdata.......0......................@..P.reloc...|...@...~..................@..P.rsrc....&.......&...`..............@..P....................................@..P........................................................................................................................................

                                              C:\Users\user\Contacts\Iodqgrdelf.exe:Zone.Identifier

                                              Download File
                                              Process:C:\Users\user\Desktop\7AYsP32Q7Y.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):26
                                              Entropy (8bit):3.95006375643621
                                              Encrypted:false
                                              SSDEEP:3:ggPYV:rPYV
                                              MD5:187F488E27DB4AF347237FE461A079AD
                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                              Malicious:true
                                              Preview:[ZoneTransfer]....ZoneId=0

                                              C:\Users\user\Contacts\fledrgqdoI.url

                                              Download File
                                              Process:C:\Users\user\Desktop\7AYsP32Q7Y.exe
                                              File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\user\\Contacts\\Iodqgrdelf.exe">), ASCII text, with CRLF line terminators
                                              Category:modified
                                              Size (bytes):100
                                              Entropy (8bit):4.911112255802877
                                              Encrypted:false
                                              SSDEEP:3:HRAbABGQYmTWAX+T+Bf5riBh+DJSsGKdxz99:HRYFVmTWD0pS8JSsbxz99
                                              MD5:8AEF44E0A98FD56ED77423FDDCD711B9
                                              SHA1:D82A06AE8CF35F01F2D78BD604275278F6A85EFE
                                              SHA-256:AE2FB8809149F38B1D0B5861B098D59B8D816C314376192578DDB6C185DAAC3E
                                              SHA-512:6329F16E671C13700A18D86B9114CDD6E878FA46216B81B7DEACD491AACB39EFEA8F7CB23E4E9CA80659727BBBB8DBAE6E1FF2A8ED7A936F51D4628C5A5CADAB
                                              Malicious:false
                                              Yara Hits:
                                              • Rule: Methodology_Shortcut_HotKey, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\Contacts\fledrgqdoI.url, Author: @itsreallynick (Nick Carr)
                                              • Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\user\Contacts\fledrgqdoI.url, Author: @itsreallynick (Nick Carr)
                                              Preview:[InternetShortcut]..URL=file:"C:\\Users\\user\\Contacts\\Iodqgrdelf.exe"..IconIndex=98..HotKey=96..

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.005601638187975
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 90.87%
                                              • Win32 Executable Borland Delphi 7 (665061/41) 6.04%
                                              • Win32 Executable Borland Delphi 6 (262906/60) 2.39%
                                              • InstallShield setup (43055/19) 0.39%
                                              • Win32 Executable Delphi generic (14689/80) 0.13%
                                              File name:7AYsP32Q7Y.exe
                                              File size:755200
                                              MD5:6ae185ce909f0b66306100824c28bad1
                                              SHA1:5f23a2d4b2c564c95606e537e557aa8251087746
                                              SHA256:074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867
                                              SHA512:01931c4d70f045957aa012a8912f483e11e0f069cee8fd304acc4cb7e44c838abbe1ea870d0e13ef8573967845ab2e1102d47eb76ce6b688904ceacaa8258ef7
                                              SSDEEP:12288:0HZspw3ZruZb100eubQXXEcIi0FyoADygqwqmLjnEiCHcFaLcpXAAAAAAAAAAAA3:MZAws11Q7XU0G/Tgq/KjRd
                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                              File Icon

                                              Icon Hash:489998145269a410

                                              Static PE Info

                                              General

                                              Entrypoint:0x46b100
                                              Entrypoint Section:CODE
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
                                              DLL Characteristics:
                                              Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:4
                                              OS Version Minor:0
                                              File Version Major:4
                                              File Version Minor:0
                                              Subsystem Version Major:4
                                              Subsystem Version Minor:0
                                              Import Hash:c619ea405247cf4221d817e5b12ed8a6

                                              Entrypoint Preview

                                              Instruction
                                              push ebp
                                              mov ebp, esp
                                              add esp, FFFFFFF0h
                                              mov eax, 0046AE78h
                                              call 00007F8D4CBFED25h
                                              mov eax, dword ptr [0046D228h]
                                              mov eax, dword ptr [eax]
                                              call 00007F8D4CC52CCDh
                                              mov eax, dword ptr [0046D228h]
                                              mov eax, dword ptr [eax]
                                              mov edx, 0046B178h
                                              call 00007F8D4CC528A4h
                                              mov ecx, dword ptr [0046D00Ch]
                                              mov eax, dword ptr [0046D228h]
                                              mov eax, dword ptr [eax]
                                              mov edx, dword ptr [00469E74h]
                                              call 00007F8D4CC52CBCh
                                              mov ecx, dword ptr [0046D244h]
                                              mov eax, dword ptr [0046D228h]
                                              mov eax, dword ptr [eax]
                                              mov edx, dword ptr [0045F4F4h]
                                              call 00007F8D4CC52CA4h
                                              mov eax, dword ptr [0046D228h]
                                              mov eax, dword ptr [eax]
                                              call 00007F8D4CC52D18h
                                              call 00007F8D4CBFC957h
                                              add byte ptr [eax], al

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x6f0000x245a.idata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x7c0000x42600.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x740000x7c9c.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x730000x18.rdata
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              CODE0x10000x6a1840x6a200False0.517368779446data6.52141598847IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                              DATA0x6c0000x13c80x1400False0.4458984375data4.17742129745IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                              BSS0x6e0000xd790x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                              .idata0x6f0000x245a0x2600False0.353412828947data4.92014889215IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                              .tls0x720000x100x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                              .rdata0x730000x180x200False0.05078125data0.203013767787IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                              .reloc0x740000x7c9c0x7e00False0.602833581349data6.67533219029IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                              .rsrc0x7c0000x426000x42600False0.431210275424data6.9822034515IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountry
                                              DE_KMSIZ0x7d38c0x2c683RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 HzEnglishUnited States
                                              RT_CURSOR0xa9a100x134data
                                              RT_CURSOR0xa9b440x134data
                                              RT_CURSOR0xa9c780x134data
                                              RT_CURSOR0xa9dac0x134data
                                              RT_CURSOR0xa9ee00x134data
                                              RT_CURSOR0xaa0140x134data
                                              RT_CURSOR0xaa1480x134data
                                              RT_BITMAP0xaa27c0x1d0data
                                              RT_BITMAP0xaa44c0x1e4data
                                              RT_BITMAP0xaa6300x1d0data
                                              RT_BITMAP0xaa8000x1d0data
                                              RT_BITMAP0xaa9d00x1d0data
                                              RT_BITMAP0xaaba00x1d0data
                                              RT_BITMAP0xaad700x1d0data
                                              RT_BITMAP0xaaf400x1d0data
                                              RT_BITMAP0xab1100x1d0data
                                              RT_BITMAP0xab2e00x1d0data
                                              RT_BITMAP0xab4b00x128data
                                              RT_BITMAP0xab5d80x128data
                                              RT_BITMAP0xab7000x128data
                                              RT_BITMAP0xab8280xe8data
                                              RT_BITMAP0xab9100x128data
                                              RT_BITMAP0xaba380x128data
                                              RT_BITMAP0xabb600xd0data
                                              RT_BITMAP0xabc300x128data
                                              RT_BITMAP0xabd580x128data
                                              RT_BITMAP0xabe800x128data
                                              RT_BITMAP0xabfa80x128data
                                              RT_BITMAP0xac0d00x128data
                                              RT_BITMAP0xac1f80xe8data
                                              RT_BITMAP0xac2e00x128data
                                              RT_BITMAP0xac4080x128data
                                              RT_BITMAP0xac5300xd0data
                                              RT_BITMAP0xac6000x128data
                                              RT_BITMAP0xac7280x128data
                                              RT_BITMAP0xac8500x128data
                                              RT_BITMAP0xac9780x128data
                                              RT_BITMAP0xacaa00x128data
                                              RT_BITMAP0xacbc80xe8data
                                              RT_BITMAP0xaccb00x128data
                                              RT_BITMAP0xacdd80x128data
                                              RT_BITMAP0xacf000xd0data
                                              RT_BITMAP0xacfd00x128data
                                              RT_BITMAP0xad0f80x128data
                                              RT_BITMAP0xad2200xe8GLS_BINARY_LSB_FIRSTEnglishUnited States
                                              RT_ICON0xad3080x468GLS_BINARY_LSB_FIRSTEnglishUnited States
                                              RT_ICON0xad7700x988dataEnglishUnited States
                                              RT_ICON0xae0f80x10a8dataEnglishUnited States
                                              RT_ICON0xaf1a00x25a8dataEnglishUnited States
                                              RT_ICON0xb17480x94a8dataEnglishUnited States
                                              RT_DIALOG0xbabf00x52data
                                              RT_STRING0xbac440x378data
                                              RT_STRING0xbafbc0x1ccdata
                                              RT_STRING0xbb1880x188data
                                              RT_STRING0xbb3100x1b0data
                                              RT_STRING0xbb4c00x304data
                                              RT_STRING0xbb7c40xdcdata
                                              RT_STRING0xbb8a00x130data
                                              RT_STRING0xbb9d00x268data
                                              RT_STRING0xbbc380x41cdata
                                              RT_STRING0xbc0540x370data
                                              RT_STRING0xbc3c40x3e4data
                                              RT_STRING0xbc7a80x234data
                                              RT_STRING0xbc9dc0xecdata
                                              RT_STRING0xbcac80x1b4data
                                              RT_STRING0xbcc7c0x3e4data
                                              RT_STRING0xbd0600x358data
                                              RT_STRING0xbd3b80x2b4data
                                              RT_RCDATA0xbd66c0x10data
                                              RT_RCDATA0xbd67c0x368data
                                              RT_RCDATA0xbd9e40x689Delphi compiled form 'T__1731424838'
                                              RT_GROUP_CURSOR0xbe0700x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0840x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0980x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0ac0x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0c00x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0d40x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_CURSOR0xbe0e80x14Lotus unknown worksheet or configuration, revision 0x1
                                              RT_GROUP_ICON0xbe0fc0x4cdataEnglishUnited States
                                              RT_VERSION0xbe1480x360dataFrenchFrance

                                              Imports

                                              DLLImport
                                              kernel32.dllDeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
                                              user32.dllGetKeyboardType, LoadStringA, MessageBoxA, CharNextA
                                              advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
                                              oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
                                              kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
                                              advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
                                              kernel32.dlllstrcpyA, lstrcmpiA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CreateDirectoryA, CompareStringA, CloseHandle, AddAtomW
                                              version.dllVerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
                                              gdi32.dllUnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetMapMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBkMode, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
                                              user32.dllCreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
                                              kernel32.dllSleep
                                              oleaut32.dllSafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
                                              ole32.dllCreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
                                              oleaut32.dllGetErrorInfo, SysFreeString
                                              comctl32.dllImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
                                              wininet.dllInternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle

                                              Version Infos

                                              DescriptionData
                                              LegalCopyrightLEVEUGLE Damien (c) 2005
                                              InternalNameWebPicker
                                              FileVersion1.0.0.0
                                              CompanyNameLEVEUGLE Damien
                                              LegalTrademarksLEVEUGLE Damien
                                              CommentsEn Beta Test
                                              ProductNameWebPicker
                                              ProductVersion1.0.0.0
                                              FileDescriptionTelechargeur de ressources Web
                                              OriginalFilenameWebPicker
                                              Translation0x040c 0x04e4

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishUnited States
                                              FrenchFrance

                                              Network Behavior

                                              Network Port Distribution

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 28, 2022 11:10:44.464739084 CET5787553192.168.2.38.8.8.8
                                              Jan 28, 2022 11:10:48.005846024 CET5415453192.168.2.38.8.8.8
                                              Jan 28, 2022 11:11:33.007854939 CET5391053192.168.2.38.8.8.8
                                              Jan 28, 2022 11:11:33.981616020 CET6402153192.168.2.38.8.8.8
                                              Jan 28, 2022 11:11:43.113132954 CET6078453192.168.2.38.8.8.8
                                              Jan 28, 2022 11:11:45.412658930 CET5114353192.168.2.38.8.8.8
                                              Jan 28, 2022 11:12:58.804780006 CET5265053192.168.2.38.8.8.8
                                              Jan 28, 2022 11:12:58.857992887 CET53526508.8.8.8192.168.2.3

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                              Jan 28, 2022 11:10:44.464739084 CET192.168.2.38.8.8.80x78f7Standard query (0)onedrive.live.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:10:48.005846024 CET192.168.2.38.8.8.80xbb70Standard query (0)vru2ia.am.files.1drv.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:11:33.007854939 CET192.168.2.38.8.8.80x94abStandard query (0)onedrive.live.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:11:33.981616020 CET192.168.2.38.8.8.80xafd3Standard query (0)vru2ia.am.files.1drv.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:11:43.113132954 CET192.168.2.38.8.8.80xdd6dStandard query (0)onedrive.live.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:11:45.412658930 CET192.168.2.38.8.8.80x4525Standard query (0)vru2ia.am.files.1drv.comA (IP address)IN (0x0001)
                                              Jan 28, 2022 11:12:58.804780006 CET192.168.2.38.8.8.80x47dcStandard query (0)www.graffity-aws.comA (IP address)IN (0x0001)

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                              Jan 28, 2022 11:10:44.484038115 CET8.8.8.8192.168.2.30x78f7No error (0)onedrive.live.comodc-web-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:10:48.083122015 CET8.8.8.8192.168.2.30xbb70No error (0)vru2ia.am.files.1drv.comam-files.fe.1drv.comCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:10:48.083122015 CET8.8.8.8192.168.2.30xbb70No error (0)am-files.fe.1drv.comodc-am-files-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:33.027973890 CET8.8.8.8192.168.2.30x94abNo error (0)onedrive.live.comodc-web-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:34.151417017 CET8.8.8.8192.168.2.30xafd3No error (0)vru2ia.am.files.1drv.comam-files.fe.1drv.comCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:34.151417017 CET8.8.8.8192.168.2.30xafd3No error (0)am-files.fe.1drv.comodc-am-files-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:43.141356945 CET8.8.8.8192.168.2.30xdd6dNo error (0)onedrive.live.comodc-web-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:45.958548069 CET8.8.8.8192.168.2.30x4525No error (0)vru2ia.am.files.1drv.comam-files.fe.1drv.comCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:11:45.958548069 CET8.8.8.8192.168.2.30x4525No error (0)am-files.fe.1drv.comodc-am-files-geo.onedrive.akadns.netCNAME (Canonical name)IN (0x0001)
                                              Jan 28, 2022 11:12:58.857992887 CET8.8.8.8192.168.2.30x47dcName error (3)www.graffity-aws.comnonenoneA (IP address)IN (0x0001)

                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:1
                                              Start time:11:10:42
                                              Start date:28/01/2022
                                              Path:C:\Users\user\Desktop\7AYsP32Q7Y.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\7AYsP32Q7Y.exe"
                                              Imagebase:0x400000
                                              File size:755200 bytes
                                              MD5 hash:6AE185CE909F0B66306100824C28BAD1
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Reputation:low

                                              General

                                              Target ID:7
                                              Start time:11:11:20
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\DpiScaling.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\System32\DpiScaling.exe
                                              Imagebase:0x970000
                                              File size:77312 bytes
                                              MD5 hash:302B1BBDBF4D96BEE99C6B45680CEB5E
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.382181653.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.382731911.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.551622054.0000000004360000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.549878995.0000000000760000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.382462227.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.381928025.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.554263444.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:moderate

                                              General

                                              Target ID:8
                                              Start time:11:11:23
                                              Start date:28/01/2022
                                              Path:C:\Windows\explorer.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\Explorer.EXE
                                              Imagebase:0x7ff720ea0000
                                              File size:3933184 bytes
                                              MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.429270100.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.496447356.000000000FA29000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:high

                                              General

                                              Target ID:9
                                              Start time:11:11:30
                                              Start date:28/01/2022
                                              Path:C:\Users\user\Contacts\Iodqgrdelf.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Contacts\Iodqgrdelf.exe"
                                              Imagebase:0x400000
                                              File size:755200 bytes
                                              MD5 hash:6AE185CE909F0B66306100824C28BAD1
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:Borland Delphi
                                              Antivirus matches:
                                              • Detection: 21%, Virustotal, Browse
                                              Reputation:low

                                              General

                                              Target ID:13
                                              Start time:11:11:39
                                              Start date:28/01/2022
                                              Path:C:\Users\user\Contacts\Iodqgrdelf.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Contacts\Iodqgrdelf.exe"
                                              Imagebase:0x400000
                                              File size:755200 bytes
                                              MD5 hash:6AE185CE909F0B66306100824C28BAD1
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:Borland Delphi
                                              Reputation:low

                                              General

                                              Target ID:19
                                              Start time:11:12:14
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\DpiScaling.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\System32\DpiScaling.exe
                                              Imagebase:0x970000
                                              File size:77312 bytes
                                              MD5 hash:302B1BBDBF4D96BEE99C6B45680CEB5E
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.539784754.0000000000930000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000000.497404130.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.539833484.0000000004030000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000000.498207002.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000000.497789528.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000000.498613511.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.546473865.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:moderate

                                              General

                                              Target ID:20
                                              Start time:11:12:25
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\logagent.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\System32\logagent.exe
                                              Imagebase:0xe70000
                                              File size:86016 bytes
                                              MD5 hash:E2036AC444AB4AD91EECC1A80FF7212F
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.581563268.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.576773570.0000000003200000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.577204129.00000000033B0000.00000040.00000800.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000000.521833051.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000000.522233517.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000000.521162250.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000000.521484053.0000000072480000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:moderate

                                              General

                                              Target ID:21
                                              Start time:11:12:25
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\autochk.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\SysWOW64\autochk.exe
                                              Imagebase:0x1320000
                                              File size:871424 bytes
                                              MD5 hash:34236DB574405291498BCD13D20C42EB
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate

                                              General

                                              Target ID:22
                                              Start time:11:12:27
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\SysWOW64\msiexec.exe
                                              Imagebase:0xdf0000
                                              File size:59904 bytes
                                              MD5 hash:12C17B5A5C2A7B97342C362CA467E9A2
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.577407800.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.576603089.0000000000BB0000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.576996398.0000000000CA0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:high

                                              General

                                              Target ID:23
                                              Start time:11:12:33
                                              Start date:28/01/2022
                                              Path:C:\Windows\SysWOW64\cscript.exe
                                              Wow64 process (32bit):true
                                              Commandline:C:\Windows\SysWOW64\cscript.exe
                                              Imagebase:0x9f0000
                                              File size:143360 bytes
                                              MD5 hash:00D3041E47F99E48DD5FFFEDF60F6304
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000002.551797421.00000000008B0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:high

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:0.6%
                                                Dynamic/Decrypted Code Coverage:100%
                                                Signature Coverage:54.5%
                                                Total number of Nodes:1530
                                                Total number of Limit Nodes:66
                                                execution_graph 16191 474fab0 16192 474fb14 16191->16192 16193 474fac2 16191->16193 16227 472eef0 16193->16227 16195 474facd 16196 474fadf 16195->16196 16199 474fb18 16195->16199 16242 472eb70 16196->16242 16205 478bdcb 16199->16205 16232 4726d90 16199->16232 16200 474fafa GetPEB 16200->16192 16201 474fb09 16200->16201 16248 472ff60 16201->16248 16210 478be19 16205->16210 16226 478bea7 16205->16226 16268 471b150 16205->16268 16206 47276e2 GetPEB 16224 474fc4b 16206->16224 16207 474fba7 16212 474fbe4 16207->16212 16207->16224 16256 474fd22 16207->16256 16210->16226 16271 47275ce 16210->16271 16213 474fc47 16212->16213 16214 478bf17 16212->16214 16212->16224 16216 474fd22 GetPEB 16213->16216 16213->16224 16215 474fd22 GetPEB 16214->16215 16214->16224 16218 478bf22 16215->16218 16219 474fcb2 16216->16219 16217 478be54 16220 478be92 16217->16220 16217->16224 16275 47276e2 16217->16275 16221 474fd9b 3 API calls 16218->16221 16218->16224 16219->16224 16260 474fd9b 16219->16260 16225 47276e2 GetPEB 16220->16225 16220->16226 16221->16224 16225->16226 16226->16206 16226->16224 16228 472ef21 16227->16228 16229 472ef0c 16227->16229 16230 472ef29 16228->16230 16279 472ef40 16228->16279 16229->16195 16230->16195 16233 4726dba 16232->16233 16234 4726da4 16232->16234 16607 4752e1c 16233->16607 16234->16205 16234->16207 16234->16224 16236 4726dbf 16237 472eef0 27 API calls 16236->16237 16238 4726dca 16237->16238 16239 4726dde 16238->16239 16612 471db60 16238->16612 16241 472eb70 33 API calls 16239->16241 16241->16234 16243 472eb81 16242->16243 16247 472eb9e 16242->16247 16245 472ebac 16243->16245 16243->16247 16730 47aff10 16243->16730 16245->16247 16724 4714dc0 16245->16724 16247->16192 16247->16200 16249 472ff99 16248->16249 16250 472ff6d 16248->16250 16251 47e88f5 33 API calls 16249->16251 16250->16249 16252 472ff80 GetPEB 16250->16252 16253 472ff94 16251->16253 16252->16249 16254 472ff8f 16252->16254 16253->16192 16829 4730050 16254->16829 16257 474fd31 _vswprintf_s 16256->16257 16258 474fd3a 16256->16258 16257->16212 16258->16257 16863 4727608 16258->16863 16261 474fdba GetPEB 16260->16261 16262 474fdcc 16260->16262 16261->16262 16263 478c0bd 16262->16263 16264 474fdf2 16262->16264 16267 474fdfc 16262->16267 16265 478c0d3 GetPEB 16263->16265 16263->16267 16266 47276e2 GetPEB 16264->16266 16264->16267 16265->16267 16266->16267 16267->16224 16269 471b171 _vswprintf_s 12 API calls 16268->16269 16270 471b16e 16269->16270 16270->16210 16272 47275eb 16271->16272 16273 47275db 16271->16273 16272->16217 16273->16272 16274 4727608 GetPEB 16273->16274 16274->16272 16276 47276e6 16275->16276 16277 47276fd 16275->16277 16276->16277 16278 47276ec GetPEB 16276->16278 16277->16220 16278->16277 16280 472f0bd 16279->16280 16281 472ef5d 16279->16281 16280->16281 16317 4719080 16280->16317 16284 472f071 16281->16284 16286 472f042 16281->16286 16287 4712d8a 16281->16287 16284->16229 16285 472f053 GetPEB 16285->16284 16286->16284 16286->16285 16288 4712df1 _vswprintf_s 16287->16288 16289 4712db8 16287->16289 16292 476f9d0 GetPEB 16288->16292 16294 476f9e3 GetPEB 16288->16294 16298 4712e5a 16288->16298 16321 4737d50 GetPEB 16288->16321 16334 47afe87 16288->16334 16341 47afdda 16288->16341 16347 47affb9 16288->16347 16355 47a5720 16288->16355 16289->16288 16290 4712de7 16289->16290 16323 4712e9f 16289->16323 16290->16288 16327 4741624 16290->16327 16292->16294 16294->16288 16299 4712e61 16298->16299 16307 4712e99 _vswprintf_s 16298->16307 16300 4712e69 16299->16300 16301 4737d50 GetPEB 16299->16301 16300->16281 16303 476fa76 16301->16303 16305 476fa8a 16303->16305 16306 476fa7a GetPEB 16303->16306 16304 4712ece 16304->16281 16305->16300 16310 476fa97 GetPEB 16305->16310 16306->16305 16307->16304 16370 47595d0 LdrInitializeThunk 16307->16370 16310->16300 16311 476faaa 16310->16311 16312 4737d50 GetPEB 16311->16312 16313 476faaf 16312->16313 16314 476fac3 16313->16314 16315 476fab3 GetPEB 16313->16315 16314->16300 16358 4797016 16314->16358 16315->16314 16318 4719098 16317->16318 16319 471909e GetPEB 16317->16319 16318->16319 16320 47190aa 16319->16320 16320->16281 16322 4737d5d 16321->16322 16322->16288 16324 4712ebb _vswprintf_s 16323->16324 16326 4712ece 16324->16326 16371 47595d0 LdrInitializeThunk 16324->16371 16326->16290 16372 47416e0 16327->16372 16329 4741630 16332 4741691 16329->16332 16376 47416c7 16329->16376 16332->16288 16333 474165a 16333->16332 16383 474a185 16333->16383 16335 4737d50 GetPEB 16334->16335 16336 47afec1 16335->16336 16337 47afec5 GetPEB 16336->16337 16338 47afed5 _vswprintf_s 16336->16338 16337->16338 16414 475b640 16338->16414 16340 47afef8 16340->16288 16342 47afdff __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 16341->16342 16343 47a5720 _vswprintf_s 12 API calls 16342->16343 16344 47afe0f 16343->16344 16345 47a5720 _vswprintf_s 12 API calls 16344->16345 16346 47afe39 16345->16346 16346->16288 16348 47affc8 _vswprintf_s 16347->16348 16561 474e730 16348->16561 16350 47b0067 16352 476d130 _vswprintf_s 12 API calls 16350->16352 16351 47affd5 16351->16350 16353 47a0c30 _vswprintf_s 12 API calls 16351->16353 16354 47b009a 16352->16354 16353->16350 16354->16288 16567 471b171 16355->16567 16359 4797052 16358->16359 16360 4797073 GetPEB 16359->16360 16365 4797084 16359->16365 16360->16365 16361 4797125 GetPEB 16362 4797136 16361->16362 16363 475b640 _vswprintf_s 12 API calls 16362->16363 16364 4797147 16363->16364 16364->16300 16365->16362 16366 4737d50 GetPEB 16365->16366 16368 4797101 _vswprintf_s 16365->16368 16367 47970ec 16366->16367 16367->16368 16369 47970f0 GetPEB 16367->16369 16368->16361 16368->16362 16369->16368 16370->16304 16371->16326 16373 47416ed 16372->16373 16374 47416f3 GetPEB 16373->16374 16375 47416f1 16373->16375 16374->16375 16375->16329 16377 47855f4 16376->16377 16378 47416da 16376->16378 16388 47cbbf0 16377->16388 16378->16333 16382 478560a 16384 474a1a0 16383->16384 16385 474a192 16383->16385 16384->16385 16386 474a1b0 GetPEB 16384->16386 16385->16332 16387 474a1c1 16386->16387 16387->16332 16389 47cbc12 16388->16389 16390 47855fb 16389->16390 16396 47cc08a 16389->16396 16390->16382 16392 47cbf33 16390->16392 16393 47cbf4c 16392->16393 16395 47cbf97 16393->16395 16409 47cbe9b 16393->16409 16395->16382 16397 47cc0c6 16396->16397 16399 47cc104 _vswprintf_s 16397->16399 16400 47cbfdb 16397->16400 16399->16390 16402 47cbfef 16400->16402 16403 47cbfeb 16400->16403 16402->16403 16404 47cbdfa 16402->16404 16403->16399 16405 47cbe17 16404->16405 16407 47cbe6d 16405->16407 16408 4759660 LdrInitializeThunk 16405->16408 16407->16403 16408->16407 16410 47cbeb3 16409->16410 16412 47cbf08 16410->16412 16413 4759660 LdrInitializeThunk 16410->16413 16412->16395 16413->16412 16415 475b648 16414->16415 16416 475b64b 16414->16416 16415->16340 16419 47cb590 16416->16419 16418 475b74a _vswprintf_s 16418->16340 16422 47cb260 16419->16422 16421 47cb5a3 16421->16418 16480 476d08c 16422->16480 16424 47cb26c GetPEB 16425 47cb279 GetPEB 16424->16425 16427 47cb293 16425->16427 16428 47cb54b 16427->16428 16429 47cb2ba 16427->16429 16430 47cb48b 16427->16430 16436 47cb56b _vswprintf_s 16428->16436 16481 47a0c30 16428->16481 16432 47cb414 16429->16432 16433 47cb2c6 16429->16433 16431 47a5720 _vswprintf_s 10 API calls 16430->16431 16434 47cb49e 16431->16434 16435 47a5720 _vswprintf_s 10 API calls 16432->16435 16437 47cb32d 16433->16437 16438 47cb2ce 16433->16438 16445 47a5720 _vswprintf_s 10 API calls 16434->16445 16441 47cb427 16435->16441 16436->16421 16447 47cb396 16437->16447 16453 47cb34d 16437->16453 16476 47cb2eb 16437->16476 16439 47cb2da 16438->16439 16440 47cb2f3 16438->16440 16443 47a5720 _vswprintf_s 10 API calls 16439->16443 16444 47a5720 _vswprintf_s 10 API calls 16440->16444 16446 47a5720 _vswprintf_s 10 API calls 16441->16446 16443->16476 16449 47cb302 16444->16449 16450 47cb4c2 16445->16450 16452 47cb43e 16446->16452 16451 47a5720 _vswprintf_s 10 API calls 16447->16451 16448 47a5720 _vswprintf_s 10 API calls 16454 47cb4fd 16448->16454 16455 47a5720 _vswprintf_s 10 API calls 16449->16455 16456 47cb4cc 16450->16456 16465 47cb320 16450->16465 16457 47cb3aa 16451->16457 16458 47a5720 _vswprintf_s 10 API calls 16452->16458 16459 47a5720 _vswprintf_s 10 API calls 16453->16459 16460 47cb519 16454->16460 16468 47a5720 _vswprintf_s 10 API calls 16454->16468 16461 47cb311 16455->16461 16462 47a5720 _vswprintf_s 10 API calls 16456->16462 16463 47cb38f 16457->16463 16464 47cb3b6 16457->16464 16458->16465 16466 47cb361 16459->16466 16469 47a5720 _vswprintf_s 10 API calls 16460->16469 16470 47a5720 _vswprintf_s 10 API calls 16461->16470 16462->16476 16473 47a5720 _vswprintf_s 10 API calls 16463->16473 16471 47a5720 _vswprintf_s 10 API calls 16464->16471 16472 47a5720 _vswprintf_s 10 API calls 16465->16472 16465->16476 16466->16463 16467 47cb371 16466->16467 16477 47a5720 _vswprintf_s 10 API calls 16467->16477 16468->16460 16474 47cb528 16469->16474 16470->16465 16475 47cb3c5 16471->16475 16472->16476 16473->16476 16474->16428 16479 47a5720 _vswprintf_s 10 API calls 16474->16479 16478 47a5720 _vswprintf_s 10 API calls 16475->16478 16476->16448 16477->16476 16478->16476 16479->16428 16480->16424 16482 47a0c50 16481->16482 16485 47a0c49 16481->16485 16491 47a193b 16482->16491 16484 47a0c5e 16484->16485 16497 47a1c76 16484->16497 16485->16436 16492 47a194c 16491->16492 16496 47a1967 _vswprintf_s 16491->16496 16514 47a1c49 16492->16514 16494 47a1c49 _vswprintf_s LdrInitializeThunk 16495 47a1951 _vswprintf_s 16494->16495 16495->16494 16495->16496 16496->16484 16517 4759670 16497->16517 16515 4759670 _vswprintf_s LdrInitializeThunk 16514->16515 16516 47a1c65 16515->16516 16516->16495 16518 475967a _vswprintf_s LdrInitializeThunk 16517->16518 16562 4759670 _vswprintf_s LdrInitializeThunk 16561->16562 16563 474e747 16562->16563 16564 474e784 GetPEB 16563->16564 16565 474e74b 16563->16565 16566 474e7a8 16564->16566 16565->16351 16566->16351 16568 471b180 _vswprintf_s 16567->16568 16569 471b1b0 GetPEB 16568->16569 16576 471b1c0 _vswprintf_s 16568->16576 16569->16576 16570 476d130 _vswprintf_s 10 API calls 16571 471b1de 16570->16571 16571->16288 16573 4774904 GetPEB 16574 471b1d1 _vswprintf_s 16573->16574 16574->16570 16576->16573 16576->16574 16577 475e2d0 16576->16577 16580 475e2ed 16577->16580 16579 475e2e8 16579->16576 16581 475e30f 16580->16581 16582 475e2fb 16580->16582 16584 475e332 16581->16584 16585 475e31e 16581->16585 16589 475b58e 16582->16589 16594 4762440 16584->16594 16587 475b58e _vswprintf_s 12 API calls 16585->16587 16588 475e307 _vswprintf_s 16587->16588 16588->16579 16590 471b150 _vswprintf_s 12 API calls 16589->16590 16591 475b627 16590->16591 16592 475b640 _vswprintf_s 12 API calls 16591->16592 16593 475b632 16592->16593 16593->16588 16595 47624af 16594->16595 16596 476249a 16594->16596 16598 47624b7 16595->16598 16606 47624cc __aulldvrm _vswprintf_s 16595->16606 16597 475b58e _vswprintf_s 12 API calls 16596->16597 16600 47624a4 16597->16600 16599 475b58e _vswprintf_s 12 API calls 16598->16599 16599->16600 16601 475b640 _vswprintf_s 12 API calls 16600->16601 16602 4762d6e 16601->16602 16602->16588 16603 4762d4f 16605 475b58e _vswprintf_s 12 API calls 16603->16605 16604 47658ee 12 API calls __cftof 16604->16606 16605->16600 16606->16600 16606->16603 16606->16604 16608 4752e32 16607->16608 16609 4752e57 16608->16609 16620 4759840 LdrInitializeThunk 16608->16620 16609->16236 16611 478df2e 16613 471db6d 16612->16613 16619 471db91 16612->16619 16613->16619 16621 471db40 GetPEB 16613->16621 16615 471db76 16615->16619 16623 471e7b0 16615->16623 16617 471db87 16618 4774fa6 GetPEB 16617->16618 16617->16619 16618->16619 16619->16239 16620->16611 16622 471db52 16621->16622 16622->16615 16624 471e7e0 16623->16624 16625 471e7ce 16623->16625 16628 471b150 _vswprintf_s 12 API calls 16624->16628 16629 471e7e8 16624->16629 16625->16629 16631 4723d34 16625->16631 16628->16629 16630 471e7f6 16629->16630 16670 471dca4 16629->16670 16630->16617 16632 4778213 16631->16632 16633 4723d6c 16631->16633 16637 477822b GetPEB 16632->16637 16668 4724068 16632->16668 16686 4721b8f 16633->16686 16635 4723d81 16635->16632 16636 4723d89 16635->16636 16638 4721b8f 2 API calls 16636->16638 16637->16668 16639 4723d9e 16638->16639 16640 4723da2 GetPEB 16639->16640 16641 4723dba 16639->16641 16640->16641 16642 4721b8f 2 API calls 16641->16642 16643 4723dd2 16642->16643 16645 4723deb GetPEB 16643->16645 16657 4723e91 16643->16657 16643->16668 16644 4778344 GetPEB 16647 472407a 16644->16647 16659 4723dfc _vswprintf_s 16645->16659 16646 4721b8f 2 API calls 16649 4723ea9 16646->16649 16648 4724085 16647->16648 16650 4778363 GetPEB 16647->16650 16648->16624 16652 4723ec2 GetPEB 16649->16652 16662 4723f6a 16649->16662 16649->16668 16650->16648 16651 4721b8f 2 API calls 16653 4723f82 16651->16653 16666 4723ed3 _vswprintf_s 16652->16666 16654 4723f9b GetPEB 16653->16654 16653->16668 16669 4723fac _vswprintf_s 16654->16669 16655 4723e62 GetPEB 16656 4723e74 16655->16656 16656->16657 16658 4723e81 GetPEB 16656->16658 16657->16646 16658->16657 16659->16655 16659->16656 16659->16668 16660 4723f4d 16660->16662 16663 4723f5a GetPEB 16660->16663 16661 4723f3b GetPEB 16661->16660 16662->16651 16663->16662 16664 4778324 GetPEB 16664->16668 16665 472404f 16667 4724058 GetPEB 16665->16667 16665->16668 16666->16660 16666->16661 16666->16668 16667->16668 16668->16644 16668->16647 16669->16664 16669->16665 16669->16668 16672 471dcfd 16670->16672 16684 471dd6f _vswprintf_s 16670->16684 16671 471dd47 16701 471dbb1 16671->16701 16672->16671 16680 471dfc2 16672->16680 16692 471e620 16672->16692 16674 4774ff2 16674->16674 16676 471dfae 16676->16680 16714 47595d0 LdrInitializeThunk 16676->16714 16681 475b640 _vswprintf_s 12 API calls 16680->16681 16683 471dfe4 16681->16683 16683->16630 16684->16674 16684->16676 16684->16680 16708 471e375 16684->16708 16713 47595d0 LdrInitializeThunk 16684->16713 16690 4721ba9 _vswprintf_s 16686->16690 16691 4721c05 16686->16691 16687 477701a GetPEB 16688 4721c21 16687->16688 16688->16635 16689 4721bf4 GetPEB 16689->16691 16690->16688 16690->16689 16690->16691 16691->16687 16691->16688 16693 4775503 16692->16693 16694 471e644 16692->16694 16694->16693 16715 471f358 16694->16715 16696 471e661 _vswprintf_s 16697 471e725 16696->16697 16719 47595d0 LdrInitializeThunk 16696->16719 16699 471e729 GetPEB 16697->16699 16700 471e73b 16697->16700 16699->16700 16700->16671 16720 472766d 16701->16720 16703 471dbcf 16703->16684 16704 471dbf1 16703->16704 16705 471dc05 16704->16705 16706 472766d GetPEB 16705->16706 16707 471dc22 16706->16707 16707->16684 16709 471e3a3 16708->16709 16710 475b640 _vswprintf_s 12 API calls 16709->16710 16712 4775306 16709->16712 16711 471e400 16710->16711 16711->16684 16713->16684 16714->16680 16716 471f370 16715->16716 16717 471f38c 16716->16717 16718 471f379 GetPEB 16716->16718 16717->16696 16718->16717 16719->16697 16722 4727687 16720->16722 16721 47276d3 16721->16703 16722->16721 16723 47276c2 GetPEB 16722->16723 16723->16721 16725 4714dfa 16724->16725 16727 4714dd1 16724->16727 16726 4712e9f LdrInitializeThunk 16725->16726 16726->16727 16729 4714df3 16727->16729 16743 4714f2e 16727->16743 16729->16247 16828 476d0e8 16730->16828 16732 47aff1c GetPEB 16733 47aff2b 16732->16733 16734 47aff43 GetPEB 16732->16734 16733->16734 16735 47affb1 16733->16735 16736 47aff4f 16734->16736 16737 47aff6e 16734->16737 16738 476d130 _vswprintf_s 12 API calls 16735->16738 16739 47a5720 _vswprintf_s 12 API calls 16736->16739 16740 474e730 2 API calls 16737->16740 16741 47affb6 16738->16741 16739->16737 16742 47aff7d 16740->16742 16741->16245 16742->16245 16744 4770b85 16743->16744 16747 4714f3e 16743->16747 16745 4770b8b GetPEB 16744->16745 16746 4770b9a 16744->16746 16745->16746 16748 4770b9f 16745->16748 16752 47e88f5 16746->16752 16747->16744 16750 4714f5b GetPEB 16747->16750 16750->16744 16751 4714f6e 16750->16751 16751->16729 16753 47e8901 _vswprintf_s 16752->16753 16758 471cc50 16753->16758 16755 47e891f 16756 476d130 _vswprintf_s 12 API calls 16755->16756 16757 47e8946 16756->16757 16757->16748 16760 471cc79 16758->16760 16759 475b640 _vswprintf_s 12 API calls 16761 471cc89 16759->16761 16763 471cc7e 16760->16763 16764 474b230 16760->16764 16761->16755 16763->16759 16765 474b26a 16764->16765 16766 478a2f6 16764->16766 16765->16766 16770 478a2fd 16765->16770 16772 474b2ab _vswprintf_s 16765->16772 16767 475b640 _vswprintf_s 12 API calls 16769 474b2d0 16767->16769 16769->16763 16771 474b2b5 16770->16771 16782 47e5ba5 16770->16782 16771->16766 16771->16767 16772->16771 16774 471ccc0 16772->16774 16775 471cd04 16774->16775 16776 471b150 _vswprintf_s 12 API calls 16775->16776 16781 471cd95 16775->16781 16777 4774e0a 16776->16777 16778 471b150 _vswprintf_s 12 API calls 16777->16778 16779 4774e14 16778->16779 16780 471b150 _vswprintf_s 12 API calls 16779->16780 16780->16781 16781->16771 16783 47e5bb4 _vswprintf_s 16782->16783 16789 47e5c10 16783->16789 16791 47e5c2a _vswprintf_s 16783->16791 16793 47e4c56 16783->16793 16784 476d130 _vswprintf_s 12 API calls 16786 47e63e5 16784->16786 16786->16771 16789->16784 16790 47e60cf GetPEB 16790->16791 16791->16789 16791->16790 16792 4759710 LdrInitializeThunk 16791->16792 16797 4756de6 16791->16797 16792->16791 16794 47e4c62 _vswprintf_s 16793->16794 16795 476d130 _vswprintf_s 12 API calls 16794->16795 16796 47e4caa 16795->16796 16796->16791 16798 4756e03 16797->16798 16801 4756e73 16797->16801 16800 4756e53 16798->16800 16798->16801 16803 4756ebe 16798->16803 16800->16801 16811 4746a60 16800->16811 16801->16791 16804 472eef0 27 API calls 16803->16804 16805 4756eeb 16804->16805 16807 4756f0d 16805->16807 16816 4757742 16805->16816 16822 47c84e0 16805->16822 16806 472eb70 33 API calls 16809 4756f48 16806->16809 16807->16806 16809->16798 16812 4788025 16811->16812 16813 4746a8d _vswprintf_s 16811->16813 16813->16812 16814 475b640 _vswprintf_s 12 API calls 16813->16814 16815 4746b66 16814->16815 16815->16801 16817 4757827 16816->16817 16820 4757768 _vswprintf_s 16816->16820 16817->16805 16818 4759660 _vswprintf_s LdrInitializeThunk 16818->16820 16819 472eef0 27 API calls 16819->16820 16820->16817 16820->16818 16820->16819 16821 472eb70 33 API calls 16820->16821 16821->16820 16823 47c8511 16822->16823 16824 472eb70 33 API calls 16823->16824 16827 47c8556 16824->16827 16825 472eef0 27 API calls 16826 47c85f1 16825->16826 16826->16805 16827->16825 16828->16732 16830 4730074 16829->16830 16831 47300ef 16830->16831 16832 473009d GetPEB 16830->16832 16835 475b640 _vswprintf_s 12 API calls 16831->16835 16833 47300d0 16832->16833 16834 477c01b 16832->16834 16838 477c037 16833->16838 16839 47300df 16833->16839 16834->16833 16837 477c024 GetPEB 16834->16837 16836 4730105 16835->16836 16836->16253 16837->16833 16847 47e8a62 16838->16847 16843 4749702 16839->16843 16842 477c04b 16842->16842 16844 4749720 16843->16844 16846 4749784 16844->16846 16854 47e8214 16844->16854 16846->16831 16848 4737d50 GetPEB 16847->16848 16849 47e8a9d 16848->16849 16850 47e8aa1 GetPEB 16849->16850 16851 47e8ab1 _vswprintf_s 16849->16851 16850->16851 16852 475b640 _vswprintf_s 12 API calls 16851->16852 16853 47e8ad7 16852->16853 16853->16842 16856 47e823b 16854->16856 16855 47e82c0 16855->16846 16856->16855 16858 4743b7a GetPEB 16856->16858 16860 4743bb5 _vswprintf_s 16858->16860 16859 4786298 16860->16859 16861 4743c1b GetPEB 16860->16861 16862 4743c35 16861->16862 16862->16855 16864 4727620 16863->16864 16865 472766d GetPEB 16864->16865 16866 4727632 16865->16866 16866->16257 16897 47535b1 16898 47535ca 16897->16898 16899 47535f2 16897->16899 16898->16899 16900 4727608 GetPEB 16898->16900 16900->16899 16868 4759670 16870 475967a 16868->16870 16871 4759681 16870->16871 16872 475968f LdrInitializeThunk 16870->16872 16901 47d02f7 16903 47d0323 16901->16903 16902 47d03b0 16906 47d03d1 16902->16906 16949 47dbcd2 16902->16949 16903->16902 16915 47d0a28 16903->16915 16905 47d0342 16905->16902 16919 47dbbbb 16905->16919 16909 47d035f 16909->16902 16928 47edfce 16909->16928 16916 47d0a57 16915->16916 16918 47d0a4d 16915->16918 16953 4744e70 16916->16953 16918->16905 16920 47dbbde 16919->16920 16968 47dbd54 16920->16968 16923 47dbc3c 16923->16909 16924 47dbc3e 16982 47daa16 16924->16982 16925 47dbc17 16972 47df9a1 16925->16972 16931 47edff0 16928->16931 16932 47ee19d 16928->16932 16929 475b640 _vswprintf_s 12 API calls 16930 47d0388 16929->16930 16930->16902 16936 47d03da 16930->16936 16931->16932 17779 47ee62a 16931->17779 16932->16929 16934 47ee1cd 16934->16932 17787 47ee5b6 16934->17787 16937 47dbbbb 267 API calls 16936->16937 16940 47d0404 16937->16940 16938 47d039a 16938->16902 16945 47ee4b3 16938->16945 16939 47d058b 16939->16938 16941 47dbcd2 256 API calls 16939->16941 16940->16938 16940->16939 17801 47d0150 16940->17801 16941->16938 16947 47ee4c9 16945->16947 16946 47ee5a7 16946->16902 16947->16946 16948 47ee5b6 12 API calls 16947->16948 16948->16946 16950 47dbceb 16949->16950 17807 47dae44 16950->17807 16954 4744e94 16953->16954 16955 4744ec0 16953->16955 16956 475b640 _vswprintf_s 12 API calls 16954->16956 16955->16954 16959 47c8df1 16955->16959 16957 4744eac 16956->16957 16957->16918 16967 476d0e8 16959->16967 16961 47c8dfd GetPEB 16962 47c8e10 16961->16962 16963 47a5720 _vswprintf_s 12 API calls 16962->16963 16964 47c8e2f 16962->16964 16963->16964 16965 476d130 _vswprintf_s 12 API calls 16964->16965 16966 47c8ebd 16965->16966 16966->16954 16967->16961 16969 47dbc04 16968->16969 16970 47dbd63 16968->16970 16969->16923 16969->16924 16969->16925 16971 4744e70 13 API calls 16970->16971 16971->16969 16973 47df9d6 16972->16973 16994 47e022c 16973->16994 16975 47df9e1 16976 47df9e7 16975->16976 16977 47dfa16 16975->16977 17000 47e05ac 16975->17000 16976->16923 16979 47dfa1a _vswprintf_s 16977->16979 17016 47e070d 16977->17016 16979->16976 17030 47e0a13 16979->17030 16983 47daa44 16982->16983 16984 47daa66 16983->16984 17599 47dab54 16983->17599 16985 4737d50 GetPEB 16984->16985 16987 47dab0f 16985->16987 16988 47dab23 16987->16988 16989 47dab13 GetPEB 16987->16989 16990 47dab2d GetPEB 16988->16990 16991 47dab49 16988->16991 16989->16988 16990->16991 16992 47dab3c 16990->16992 16991->16923 17611 47d131b 16992->17611 16995 47e0278 16994->16995 16998 47e02c2 16995->16998 17038 47e0ea5 16995->17038 16997 47e02e9 16997->16975 16998->16997 17065 476cf85 16998->17065 17002 47e05d1 17000->17002 17001 47e06db 17001->16977 17002->17001 17005 47da80d 28 API calls 17002->17005 17006 47e0652 17002->17006 17003 47da854 33 API calls 17004 47e0672 17003->17004 17004->17001 17305 47e1293 17004->17305 17005->17006 17006->17003 17009 4737d50 GetPEB 17010 47e069c 17009->17010 17011 47e06b0 17010->17011 17012 47e06a0 GetPEB 17010->17012 17011->17001 17013 47e06ba GetPEB 17011->17013 17012->17011 17013->17001 17014 47e06c9 17013->17014 17015 47d138a 14 API calls 17014->17015 17015->17001 17017 47e0734 17016->17017 17018 47e07d2 17017->17018 17019 47dafde 33 API calls 17017->17019 17018->16979 17020 47e0782 17019->17020 17021 47e1293 33 API calls 17020->17021 17022 47e078e 17021->17022 17023 4737d50 GetPEB 17022->17023 17024 47e0793 17023->17024 17025 47e07a7 17024->17025 17026 47e0797 GetPEB 17024->17026 17025->17018 17027 47e07b1 GetPEB 17025->17027 17026->17025 17027->17018 17028 47e07c0 17027->17028 17309 47d14fb 17028->17309 17031 47e0a3c 17030->17031 17317 47e0392 17031->17317 17034 476cf85 33 API calls 17035 47e0aec 17034->17035 17036 47e0b19 17035->17036 17037 47e1074 35 API calls 17035->17037 17036->16976 17037->17036 17069 47dff69 17038->17069 17040 47e105b 17042 47e1055 17040->17042 17113 47e1074 17040->17113 17041 47e0f32 17079 47da854 17041->17079 17042->16998 17045 47e0ecb 17045->17040 17045->17041 17075 47da80d 17045->17075 17047 47e0fab 17048 4737d50 GetPEB 17047->17048 17050 47e0fcf 17048->17050 17051 47e0fe3 17050->17051 17052 47e0fd3 GetPEB 17050->17052 17054 47e100e 17051->17054 17055 47e0fed GetPEB 17051->17055 17052->17051 17053 47e0f50 17053->17040 17053->17047 17087 47e15b5 17053->17087 17057 4737d50 GetPEB 17054->17057 17055->17054 17056 47e0ffc 17055->17056 17091 47d138a 17056->17091 17059 47e1013 17057->17059 17060 47e1027 17059->17060 17061 47e1017 GetPEB 17059->17061 17062 47e1041 17060->17062 17099 47cfec0 17060->17099 17061->17060 17062->17042 17107 47d52f8 17062->17107 17067 476cf98 17065->17067 17066 476cfb1 17066->16997 17067->17066 17068 47d52f8 33 API calls 17067->17068 17068->17066 17073 47dff9f 17069->17073 17074 47dffd1 17069->17074 17070 47da854 33 API calls 17071 47dfff1 17070->17071 17071->17045 17072 47da80d 28 API calls 17072->17074 17073->17072 17073->17074 17074->17070 17076 47da81c 17075->17076 17077 47da84e 17075->17077 17125 47cff41 17076->17125 17077->17041 17080 47da8c0 17079->17080 17082 47da941 17079->17082 17080->17082 17198 47df021 17080->17198 17083 47daa00 17082->17083 17202 47d53d9 17082->17202 17085 475b640 _vswprintf_s 12 API calls 17083->17085 17086 47daa10 17085->17086 17086->17053 17088 47e15d0 17087->17088 17090 47e15d7 17087->17090 17089 47e165e LdrInitializeThunk 17088->17089 17089->17090 17090->17053 17092 47d13af _vswprintf_s 17091->17092 17093 4737d50 GetPEB 17092->17093 17094 47d13d2 17093->17094 17095 47d13d6 GetPEB 17094->17095 17096 47d13e6 _vswprintf_s 17094->17096 17095->17096 17097 475b640 _vswprintf_s 12 API calls 17096->17097 17098 47d140b 17097->17098 17098->17054 17100 47cfee5 _vswprintf_s 17099->17100 17101 4737d50 GetPEB 17100->17101 17102 47cff02 17101->17102 17103 47cff06 GetPEB 17102->17103 17104 47cff16 _vswprintf_s 17102->17104 17103->17104 17105 475b640 _vswprintf_s 12 API calls 17104->17105 17106 47cff3b 17105->17106 17106->17062 17108 47d53c7 17107->17108 17109 47d5321 17107->17109 17111 475b640 _vswprintf_s 12 API calls 17108->17111 17110 4797b9c 33 API calls 17109->17110 17110->17108 17112 47d53d5 17111->17112 17112->17042 17114 47e1095 17113->17114 17115 47e10b0 17113->17115 17116 47e165e LdrInitializeThunk 17114->17116 17263 47dafde 17115->17263 17116->17115 17119 4737d50 GetPEB 17120 47e10cd 17119->17120 17121 47e10e1 17120->17121 17122 47e10d1 GetPEB 17120->17122 17123 47e10fa 17121->17123 17272 47cfe3f 17121->17272 17122->17121 17123->17042 17126 47cff4d _vswprintf_s 17125->17126 17127 47cffaf _vswprintf_s 17126->17127 17129 47d2073 17126->17129 17127->17077 17139 47cfd22 17129->17139 17131 47d207d 17132 47d2085 17131->17132 17133 47d20a4 17131->17133 17134 47c8df1 13 API calls 17132->17134 17138 47d20be 17133->17138 17142 47d1c06 GetPEB 17133->17142 17135 47d20a2 17134->17135 17135->17127 17138->17127 17140 4759670 _vswprintf_s LdrInitializeThunk 17139->17140 17141 47cfd3d 17140->17141 17141->17131 17143 47d1c3d 17142->17143 17144 47d1c20 GetPEB 17142->17144 17146 471b150 _vswprintf_s 12 API calls 17143->17146 17145 471b150 _vswprintf_s 12 API calls 17144->17145 17147 47d1c3a 17145->17147 17146->17147 17148 471b150 _vswprintf_s 12 API calls 17147->17148 17149 47d1c5a GetPEB 17148->17149 17151 47d1d04 17149->17151 17152 47d1ce7 GetPEB 17149->17152 17154 471b150 _vswprintf_s 12 API calls 17151->17154 17153 471b150 _vswprintf_s 12 API calls 17152->17153 17155 47d1d01 17153->17155 17154->17155 17156 471b150 _vswprintf_s 12 API calls 17155->17156 17157 47d1d1c 17156->17157 17158 47d1d66 17157->17158 17159 47d1d27 GetPEB 17157->17159 17160 47d1daf 17158->17160 17161 47d1d70 GetPEB 17158->17161 17162 47d1d4f 17159->17162 17163 47d1d32 GetPEB 17159->17163 17164 47d1db9 GetPEB 17160->17164 17165 47d1df8 17160->17165 17168 47d1d98 17161->17168 17169 47d1d7b GetPEB 17161->17169 17167 471b150 _vswprintf_s 12 API calls 17162->17167 17166 471b150 _vswprintf_s 12 API calls 17163->17166 17170 47d1dc4 GetPEB 17164->17170 17171 47d1de1 17164->17171 17174 47d1e0a GetPEB 17165->17174 17178 47d1e52 GetPEB 17165->17178 17172 47d1d4c 17166->17172 17167->17172 17175 471b150 _vswprintf_s 12 API calls 17168->17175 17173 471b150 _vswprintf_s 12 API calls 17169->17173 17176 471b150 _vswprintf_s 12 API calls 17170->17176 17177 471b150 _vswprintf_s 12 API calls 17171->17177 17181 471b150 _vswprintf_s 12 API calls 17172->17181 17182 47d1d95 17173->17182 17179 47d1e15 GetPEB 17174->17179 17180 47d1e32 17174->17180 17175->17182 17184 47d1dde 17176->17184 17177->17184 17185 47d1e5d GetPEB 17178->17185 17186 47d1e7a 17178->17186 17187 471b150 _vswprintf_s 12 API calls 17179->17187 17183 471b150 _vswprintf_s 12 API calls 17180->17183 17181->17158 17188 471b150 _vswprintf_s 12 API calls 17182->17188 17190 47d1e2f 17183->17190 17189 471b150 _vswprintf_s 12 API calls 17184->17189 17191 471b150 _vswprintf_s 12 API calls 17185->17191 17192 471b150 _vswprintf_s 12 API calls 17186->17192 17187->17190 17188->17160 17189->17165 17193 471b150 _vswprintf_s 12 API calls 17190->17193 17194 47d1e77 17191->17194 17192->17194 17195 47d1e4f 17193->17195 17196 471b150 _vswprintf_s 12 API calls 17194->17196 17195->17178 17197 47d1e90 GetPEB 17196->17197 17197->17138 17199 47df03a 17198->17199 17216 47dee22 17199->17216 17203 47d53f7 17202->17203 17204 47d5552 17202->17204 17205 47d54eb 17203->17205 17206 47d5403 17203->17206 17208 4797b9c 33 API calls 17204->17208 17214 47d547c 17204->17214 17211 4797b9c 33 API calls 17205->17211 17205->17214 17209 47d5481 17206->17209 17212 47d540b 17206->17212 17207 475b640 _vswprintf_s 12 API calls 17210 47d55bd 17207->17210 17208->17214 17213 4797b9c 33 API calls 17209->17213 17209->17214 17210->17083 17211->17214 17212->17214 17247 4797b9c 17212->17247 17213->17214 17214->17207 17217 47dee5d 17216->17217 17219 47dee73 17217->17219 17220 47def09 17217->17220 17218 475b640 _vswprintf_s 12 API calls 17221 47defd4 17218->17221 17225 47deef5 17219->17225 17227 47df607 17219->17227 17220->17225 17232 47df8c5 17220->17232 17221->17082 17225->17218 17230 47df626 17227->17230 17228 47deedd 17228->17225 17231 47596e0 LdrInitializeThunk 17228->17231 17230->17228 17238 47e165e 17230->17238 17231->17225 17233 47df8ea 17232->17233 17234 47df932 17233->17234 17235 47df607 LdrInitializeThunk 17233->17235 17234->17225 17236 47df90f 17235->17236 17236->17234 17246 47596e0 LdrInitializeThunk 17236->17246 17240 47e166a _vswprintf_s 17238->17240 17239 47e1869 _vswprintf_s 17239->17230 17240->17239 17242 47e1d55 17240->17242 17244 47e1d61 _vswprintf_s 17242->17244 17243 47e1fc5 _vswprintf_s 17243->17240 17244->17243 17245 47596e0 _vswprintf_s LdrInitializeThunk 17244->17245 17245->17243 17246->17234 17250 4751130 17247->17250 17253 475115f 17250->17253 17254 47511a8 17253->17254 17255 478cd96 17253->17255 17254->17255 17256 478cd9d 17254->17256 17261 47511e9 _vswprintf_s 17254->17261 17257 47512bd 17256->17257 17259 47e5ba5 33 API calls 17256->17259 17257->17255 17258 475b640 _vswprintf_s 12 API calls 17257->17258 17260 4751159 17258->17260 17259->17257 17260->17214 17261->17257 17262 471ccc0 _vswprintf_s 12 API calls 17261->17262 17262->17257 17264 47db00a 17263->17264 17266 47db039 17263->17266 17265 47db00e 17264->17265 17264->17266 17268 47db026 17265->17268 17280 47df209 17265->17280 17267 47db035 17266->17267 17289 47596e0 LdrInitializeThunk 17266->17289 17267->17268 17271 47d53d9 33 API calls 17267->17271 17268->17119 17271->17268 17273 47cfe64 _vswprintf_s 17272->17273 17274 4737d50 GetPEB 17273->17274 17275 47cfe81 17274->17275 17276 47cfe85 GetPEB 17275->17276 17277 47cfe95 _vswprintf_s 17275->17277 17276->17277 17278 475b640 _vswprintf_s 12 API calls 17277->17278 17279 47cfeba 17278->17279 17279->17123 17281 47df23b 17280->17281 17282 47df27a 17281->17282 17283 47df241 17281->17283 17288 47df28f _vswprintf_s 17282->17288 17291 47596e0 LdrInitializeThunk 17282->17291 17290 47596e0 LdrInitializeThunk 17283->17290 17287 47df26d 17287->17267 17288->17287 17292 47df7dd 17288->17292 17289->17267 17290->17287 17291->17288 17293 47df803 17292->17293 17298 47df4a1 17293->17298 17297 47df82d 17297->17287 17299 47df4bc 17298->17299 17300 47e165e LdrInitializeThunk 17299->17300 17302 47df4ea 17300->17302 17301 47df51c 17304 47596e0 LdrInitializeThunk 17301->17304 17302->17301 17303 47e165e LdrInitializeThunk 17302->17303 17303->17302 17304->17297 17306 47e0697 17305->17306 17307 47e12b2 17305->17307 17306->17009 17308 47d52f8 33 API calls 17307->17308 17308->17306 17310 47d1520 _vswprintf_s 17309->17310 17311 4737d50 GetPEB 17310->17311 17312 47d1543 17311->17312 17313 47d1547 GetPEB 17312->17313 17314 47d1557 _vswprintf_s 17312->17314 17313->17314 17315 475b640 _vswprintf_s 12 API calls 17314->17315 17316 47d157c 17315->17316 17316->17018 17318 47e03a0 17317->17318 17319 47e0589 17318->17319 17320 47e070d 36 API calls 17318->17320 17322 47bda47 17318->17322 17319->17034 17320->17318 17323 47bda9b 17322->17323 17324 47bda51 17322->17324 17323->17318 17324->17323 17328 473c4a0 17324->17328 17345 473c577 17328->17345 17330 475b640 _vswprintf_s 12 API calls 17332 473c545 17330->17332 17331 473c4cc 17338 473c52c 17331->17338 17353 473c182 17331->17353 17332->17323 17339 47d526e 17332->17339 17334 473c515 17334->17338 17368 473dbe9 17334->17368 17335 473c4f9 17335->17334 17335->17338 17386 473e180 17335->17386 17338->17330 17340 47d528d 17339->17340 17341 47d52a4 17339->17341 17342 4797b9c 33 API calls 17340->17342 17343 475b640 _vswprintf_s 12 API calls 17341->17343 17342->17341 17344 47d52af 17343->17344 17344->17323 17346 473c5b5 17345->17346 17350 473c583 17345->17350 17347 473c5bb GetPEB 17346->17347 17348 473c5ce 17346->17348 17347->17348 17351 473c5ad 17347->17351 17349 47e88f5 33 API calls 17348->17349 17349->17351 17350->17346 17352 473c59e GetPEB 17350->17352 17351->17331 17352->17346 17352->17351 17354 473c1c4 17353->17354 17361 473c1a2 17353->17361 17355 4737d50 GetPEB 17354->17355 17356 473c1dc 17355->17356 17357 473c1e4 17356->17357 17358 4782d65 GetPEB 17356->17358 17359 4782d78 17357->17359 17362 473c1f2 17357->17362 17358->17359 17412 47e8d34 17359->17412 17361->17335 17362->17361 17389 473bb2d 17362->17389 17365 473bb2d 28 API calls 17366 473c227 17365->17366 17394 473b944 17366->17394 17369 473dc05 17368->17369 17379 473dc54 17369->17379 17442 4714510 17369->17442 17370 4737d50 GetPEB 17372 473dd10 17370->17372 17374 4783aff GetPEB 17372->17374 17375 473dd18 17372->17375 17377 4783b12 17374->17377 17375->17377 17378 473dd29 17375->17378 17376 471cc50 33 API calls 17376->17379 17450 47e8ed6 17377->17450 17433 473dd82 17378->17433 17379->17370 17381 4783b1b 17381->17381 17383 473dd3b 17384 473b944 17 API calls 17383->17384 17385 473dd45 17384->17385 17385->17338 17387 473c577 35 API calls 17386->17387 17388 473e198 17387->17388 17388->17334 17390 473bb33 17389->17390 17391 47da80d 28 API calls 17390->17391 17393 473bb92 17390->17393 17392 4782d06 17391->17392 17393->17365 17395 473badd 17394->17395 17408 473b980 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 17394->17408 17397 4737d50 GetPEB 17395->17397 17402 473bab7 17395->17402 17396 475b640 _vswprintf_s 12 API calls 17398 473bad9 17396->17398 17399 473baee 17397->17399 17398->17361 17400 473baf6 17399->17400 17401 4782caf GetPEB 17399->17401 17400->17402 17419 47e8cd6 17400->17419 17404 4782cc2 GetPEB 17401->17404 17402->17396 17403 4737d50 GetPEB 17405 473baa1 17403->17405 17409 4782cd5 17404->17409 17405->17404 17407 473baa9 17405->17407 17407->17402 17407->17409 17408->17402 17408->17403 17426 47e8f6a 17409->17426 17411 4782ce2 17411->17411 17413 4737d50 GetPEB 17412->17413 17414 47e8d5a 17413->17414 17415 47e8d5e GetPEB 17414->17415 17416 47e8d6e _vswprintf_s 17414->17416 17415->17416 17417 475b640 _vswprintf_s 12 API calls 17416->17417 17418 47e8d91 17417->17418 17418->17361 17420 4737d50 GetPEB 17419->17420 17421 47e8cf9 17420->17421 17422 47e8cfd GetPEB 17421->17422 17423 47e8d0d _vswprintf_s 17421->17423 17422->17423 17424 475b640 _vswprintf_s 12 API calls 17423->17424 17425 47e8d30 17424->17425 17425->17402 17427 4737d50 GetPEB 17426->17427 17428 47e8f9c 17427->17428 17429 47e8fa0 GetPEB 17428->17429 17430 47e8fb0 _vswprintf_s 17428->17430 17429->17430 17431 475b640 _vswprintf_s 12 API calls 17430->17431 17432 47e8fd3 17431->17432 17432->17411 17434 473ddbc 17433->17434 17435 472eef0 27 API calls 17434->17435 17440 473de19 17434->17440 17436 473ded7 17435->17436 17437 473df1f 17436->17437 17438 472eb70 33 API calls 17436->17438 17437->17383 17439 473df0b 17438->17439 17439->17440 17457 473df70 17439->17457 17440->17383 17443 471458f 17442->17443 17444 4714523 17442->17444 17443->17376 17444->17443 17445 471b150 _vswprintf_s 12 API calls 17444->17445 17446 47708f7 17445->17446 17447 471b150 _vswprintf_s 12 API calls 17446->17447 17448 4770901 17447->17448 17449 471b150 _vswprintf_s 12 API calls 17448->17449 17449->17443 17451 4737d50 GetPEB 17450->17451 17452 47e8f2f 17451->17452 17453 47e8f33 GetPEB 17452->17453 17454 47e8f43 _vswprintf_s 17452->17454 17453->17454 17455 475b640 _vswprintf_s 12 API calls 17454->17455 17456 47e8f66 17455->17456 17456->17381 17458 473df7c _vswprintf_s 17457->17458 17459 473dfe5 17458->17459 17460 473dfba 17458->17460 17478 473dfbf 17458->17478 17462 473dff2 17459->17462 17463 473e07c 17459->17463 17479 472e510 17460->17479 17466 473e075 17462->17466 17467 473dffb 17462->17467 17576 474f8f2 17463->17576 17465 473dfdf _vswprintf_s 17465->17440 17562 47436e9 17466->17562 17507 4740075 17467->17507 17471 473e000 17472 4783b30 17471->17472 17473 473e01e 17471->17473 17471->17478 17591 4795510 17472->17591 17473->17478 17535 471b1e1 17473->17535 17498 473e090 17478->17498 17480 472b02a 20 API calls 17479->17480 17490 472e57e 17480->17490 17481 472e95a 17481->17478 17482 4728794 63 API calls 17484 472e8d0 17482->17484 17483 472e904 17486 472e90c 17483->17486 17487 471b1e1 19 API calls 17483->17487 17488 472b02a 20 API calls 17484->17488 17497 472e8ec 17484->17497 17485 47597a0 _vswprintf_s LdrInitializeThunk 17485->17483 17486->17478 17489 477b98c 17487->17489 17488->17497 17490->17481 17491 477b7e9 17490->17491 17493 472e8b4 17490->17493 17494 472e783 17490->17494 17496 476cdfa 12 API calls 17490->17496 17490->17497 17492 4795510 12 API calls 17491->17492 17491->17497 17492->17497 17493->17482 17493->17497 17495 4795510 12 API calls 17494->17495 17494->17497 17495->17497 17496->17490 17497->17483 17497->17485 17499 4783b90 17498->17499 17500 473e099 17498->17500 17501 471b1e1 19 API calls 17499->17501 17503 473e0e1 17500->17503 17504 472eef0 27 API calls 17500->17504 17502 4783ba6 17501->17502 17502->17502 17503->17465 17505 473e0bc 17504->17505 17506 472eb70 33 API calls 17505->17506 17506->17503 17508 47400d9 17507->17508 17530 47400ea _vswprintf_s 17507->17530 17509 473c07f 20 API calls 17508->17509 17508->17530 17509->17530 17510 473fda0 98 API calls 17510->17530 17511 4740223 17513 474022f 17511->17513 17514 47402ba 17511->17514 17512 472a8c0 14 API calls 17512->17530 17515 474002d 6 API calls 17513->17515 17516 474f99e 64 API calls 17514->17516 17517 4740234 17515->17517 17518 474023c 17516->17518 17517->17518 17522 4796dc9 62 API calls 17517->17522 17523 4784c11 17518->17523 17524 474024a 17518->17524 17519 471ad30 GetPEB 17519->17530 17520 47402d6 GetPEB 17520->17530 17521 47402f3 53 API calls 17521->17530 17522->17518 17526 471ad30 GetPEB 17523->17526 17527 47402d6 GetPEB 17524->17527 17525 47403e2 233 API calls 17525->17530 17529 4784c1a 17526->17529 17528 474026a 17527->17528 17531 4740274 17528->17531 17533 474b390 GetPEB 17528->17533 17529->17529 17530->17510 17530->17511 17530->17512 17530->17519 17530->17520 17530->17521 17530->17525 17532 475b640 _vswprintf_s 12 API calls 17531->17532 17534 4740287 17532->17534 17533->17531 17534->17471 17536 4737d50 GetPEB 17535->17536 17537 471b1f1 17536->17537 17538 471b1f9 17537->17538 17539 4774a0e GetPEB 17537->17539 17540 4774a21 GetPEB 17538->17540 17547 471b207 17538->17547 17539->17540 17541 4774a34 17540->17541 17540->17547 17542 4737d50 GetPEB 17541->17542 17543 4774a39 17542->17543 17544 4774a4d 17543->17544 17545 4774a3d GetPEB 17543->17545 17546 4797016 16 API calls 17544->17546 17544->17547 17545->17544 17546->17547 17548 471aa16 17547->17548 17549 471aa42 17548->17549 17550 4774458 GetPEB 17548->17550 17549->17550 17551 471aa52 _vswprintf_s 17549->17551 17550->17551 17554 4745e50 47 API calls 17551->17554 17559 471aa64 17551->17559 17552 475b640 _vswprintf_s 12 API calls 17553 471aa71 17552->17553 17553->17478 17555 47744ad 17554->17555 17556 47744e6 17555->17556 17558 474b230 33 API calls 17555->17558 17557 47744ee GetPEB 17556->17557 17556->17559 17557->17559 17560 47744db 17558->17560 17559->17552 17561 471f7a0 35 API calls 17560->17561 17561->17556 17563 4726a3a 53 API calls 17562->17563 17564 4743743 17563->17564 17565 4743792 17564->17565 17566 47402f3 53 API calls 17564->17566 17567 47403e2 233 API calls 17565->17567 17570 47437a5 17565->17570 17573 4743760 17566->17573 17567->17570 17568 47437b9 17571 475b640 _vswprintf_s 12 API calls 17568->17571 17569 471ad30 GetPEB 17569->17568 17570->17568 17570->17569 17572 47437cc 17571->17572 17572->17471 17573->17565 17574 47437d0 17573->17574 17575 474f99e 64 API calls 17574->17575 17575->17570 17577 474f948 17576->17577 17578 474f952 17577->17578 17579 474f97e 17577->17579 17580 474f99e 64 API calls 17578->17580 17581 4726b6b 52 API calls 17579->17581 17589 474f959 17580->17589 17582 474f989 17581->17582 17586 47403e2 233 API calls 17582->17586 17582->17589 17583 474f967 17585 475b640 _vswprintf_s 12 API calls 17583->17585 17584 478bdad 17587 471ad30 GetPEB 17584->17587 17588 474f97a 17585->17588 17586->17589 17590 478bdb6 17587->17590 17588->17471 17589->17583 17589->17584 17590->17590 17594 4795543 17591->17594 17592 4795612 17593 475b640 _vswprintf_s 12 API calls 17592->17593 17596 479561f 17593->17596 17594->17592 17595 4795767 12 API calls 17594->17595 17597 47955f6 17595->17597 17596->17478 17598 471b171 _vswprintf_s 12 API calls 17597->17598 17598->17592 17600 47dab79 17599->17600 17601 47dab88 17599->17601 17618 47dcac9 17600->17618 17603 47daba4 17601->17603 17604 47dabb1 17601->17604 17608 47dab8f 17601->17608 17624 47e28ec 17603->17624 17606 47dabb6 17604->17606 17607 47dabc1 17604->17607 17609 47df9a1 255 API calls 17606->17609 17633 47de539 17607->17633 17608->16984 17609->17608 17612 4737d50 GetPEB 17611->17612 17613 47d134d 17612->17613 17614 47d1351 GetPEB 17613->17614 17615 47d1361 _vswprintf_s 17613->17615 17614->17615 17616 475b640 _vswprintf_s 12 API calls 17615->17616 17617 47d1384 17616->17617 17617->16991 17619 47dcadd 17618->17619 17622 47dcafc 17619->17622 17654 47dc8f7 17619->17654 17623 47dcb00 _vswprintf_s 17622->17623 17658 47dd12f 17622->17658 17623->17601 17631 47e2908 17624->17631 17626 47e29f5 17627 47e2a8c 17626->17627 17628 47e2a60 17626->17628 17761 47e25dd 17627->17761 17630 47da80d 28 API calls 17628->17630 17632 47e2a70 _vswprintf_s 17630->17632 17631->17626 17631->17632 17757 47e3149 17631->17757 17632->17608 17634 47dbbbb 266 API calls 17633->17634 17640 47de567 17634->17640 17635 47de635 17636 47dafde 33 API calls 17635->17636 17652 47de804 17635->17652 17636->17652 17637 47de5f6 17638 47da854 33 API calls 17637->17638 17641 47de614 17638->17641 17639 47dbcd2 256 API calls 17639->17635 17640->17635 17640->17637 17642 47de618 17640->17642 17643 47da80d 28 API calls 17640->17643 17641->17642 17645 47da80d 28 API calls 17641->17645 17646 47de68f 17641->17646 17642->17635 17642->17639 17643->17637 17644 47da854 33 API calls 17647 47de6ae 17644->17647 17645->17646 17646->17644 17647->17642 17648 4737d50 GetPEB 17647->17648 17649 47de7a8 17648->17649 17650 47de7ac GetPEB 17649->17650 17651 47de7c0 17649->17651 17650->17651 17651->17652 17653 47cfec0 14 API calls 17651->17653 17652->17608 17653->17642 17655 47dc94b 17654->17655 17656 47dc915 17654->17656 17655->17622 17656->17655 17674 47dc43e 17656->17674 17663 47dd15d 17658->17663 17659 47dd29e 17684 47dd38e 17659->17684 17661 47dd2ac 17664 47dd2c1 17661->17664 17689 47ddbd2 17661->17689 17663->17659 17663->17664 17666 47dd2d8 17663->17666 17678 47dd616 17663->17678 17667 47dd31c 17664->17667 17698 47dc7a2 17664->17698 17668 47dd38e 13 API calls 17666->17668 17670 47dd330 17667->17670 17704 47dc52d 17667->17704 17672 47dd2e8 17668->17672 17670->17623 17672->17664 17673 47ddbd2 243 API calls 17672->17673 17673->17664 17677 47dc46c _vswprintf_s 17674->17677 17675 475b640 _vswprintf_s 12 API calls 17676 47dc529 17675->17676 17676->17655 17677->17675 17683 47dd651 17678->17683 17679 475b640 _vswprintf_s 12 API calls 17681 47dd85e 17679->17681 17680 47dd757 17680->17679 17681->17663 17683->17680 17708 47ddef6 17683->17708 17726 471774a 17684->17726 17686 47dd3d2 17688 47dd419 17686->17688 17731 47dd466 17686->17731 17688->17661 17690 47ddc12 17689->17690 17691 47ddd1f 17689->17691 17692 47ddcb2 17690->17692 17694 47ddcca 17690->17694 17695 47ddcd1 17690->17695 17691->17694 17696 47dc52d 243 API calls 17691->17696 17693 47da80d 28 API calls 17692->17693 17693->17694 17694->17664 17695->17691 17735 47dd8df 17695->17735 17696->17694 17701 47dc7c6 _vswprintf_s 17698->17701 17699 475b640 _vswprintf_s 12 API calls 17700 47dc87f 17699->17700 17700->17667 17703 47dc863 17701->17703 17741 47dc59e 17701->17741 17703->17699 17706 47dc548 17704->17706 17705 47dc595 17705->17670 17706->17705 17745 47ddb14 17706->17745 17709 47ddfe8 17708->17709 17712 47da6b3 17709->17712 17717 4741164 17712->17717 17715 4741164 13 API calls 17716 47da6d7 17715->17716 17716->17680 17718 4785490 17717->17718 17722 474117f 17717->17722 17720 4759670 _vswprintf_s LdrInitializeThunk 17718->17720 17720->17722 17723 4745720 17722->17723 17724 4744e70 13 API calls 17723->17724 17725 4741185 17724->17725 17725->17715 17727 471777a 17726->17727 17728 47728d8 17726->17728 17727->17686 17729 4741164 13 API calls 17728->17729 17730 47728dd 17729->17730 17732 47dd4bc 17731->17732 17733 475b640 _vswprintf_s 12 API calls 17732->17733 17734 47dd591 17733->17734 17734->17688 17738 47dd917 17735->17738 17736 475b640 _vswprintf_s 12 API calls 17737 47dda95 17736->17737 17737->17691 17739 47bda47 243 API calls 17738->17739 17740 47dd96d 17738->17740 17739->17740 17740->17736 17743 47dc5c9 17741->17743 17742 475b640 _vswprintf_s 12 API calls 17744 47dc5f9 17742->17744 17743->17742 17744->17703 17746 47ddbae 17745->17746 17749 47ddb4f 17745->17749 17751 47dc95a 17746->17751 17748 475b640 _vswprintf_s 12 API calls 17750 47ddbcc 17748->17750 17749->17748 17750->17705 17752 47dc9e8 17751->17752 17756 47dc99f 17751->17756 17753 47dd8df 243 API calls 17752->17753 17753->17756 17754 475b640 _vswprintf_s 12 API calls 17755 47dca15 17754->17755 17755->17749 17756->17754 17760 47e3169 17757->17760 17758 475b640 _vswprintf_s 12 API calls 17759 47e31ce 17758->17759 17759->17631 17760->17758 17762 47e2603 17761->17762 17765 47e27a5 17762->17765 17767 47e2fbd 17762->17767 17763 47e286b 17763->17632 17765->17763 17771 47e241a 17765->17771 17768 47e2fe4 17767->17768 17769 475b640 _vswprintf_s 12 API calls 17768->17769 17770 47e30f0 17769->17770 17770->17765 17772 47e242f 17771->17772 17774 47e246c 17772->17774 17775 47e22ae 17772->17775 17774->17763 17776 47e22dd 17775->17776 17777 47e2fbd 12 API calls 17776->17777 17778 47e23ee 17776->17778 17777->17778 17778->17772 17785 47ee667 _vswprintf_s 17779->17785 17780 47ee66f 17781 475b640 _vswprintf_s 12 API calls 17780->17781 17782 47ee725 17781->17782 17782->16934 17783 47ee704 17783->17780 17784 47ee5b6 12 API calls 17783->17784 17784->17780 17785->17780 17785->17783 17793 47ee824 17785->17793 17788 47ee608 17787->17788 17789 47ee5e1 17787->17789 17791 475b640 _vswprintf_s 12 API calls 17788->17791 17789->17788 17797 47eed52 17789->17797 17792 47ee626 17791->17792 17792->16932 17796 47ee853 _vswprintf_s 17793->17796 17794 475b640 _vswprintf_s 12 API calls 17795 47eed3b 17794->17795 17795->17785 17796->17794 17800 47eed73 17797->17800 17798 475b640 _vswprintf_s 12 API calls 17799 47eee6d 17798->17799 17799->17789 17800->17798 17802 47dbbbb 267 API calls 17801->17802 17803 47d016d 17802->17803 17803->16939 17804 47d0180 17803->17804 17805 47dbcd2 256 API calls 17804->17805 17806 47d0199 17805->17806 17806->16939 17809 47dae6a 17807->17809 17808 47daf3d 17810 47daf6c 17808->17810 17811 47dafc3 17808->17811 17809->17808 17814 47daf27 17809->17814 17815 47daf38 17809->17815 17825 47dea55 17810->17825 17847 47dfde2 17811->17847 17817 47da80d 28 API calls 17814->17817 17815->16906 17817->17815 17818 4737d50 GetPEB 17819 47daf85 17818->17819 17820 47daf99 17819->17820 17821 47daf89 GetPEB 17819->17821 17820->17815 17822 47dafa3 GetPEB 17820->17822 17821->17820 17822->17815 17823 47dafb2 17822->17823 17823->17815 17840 47d1608 17823->17840 17826 47dea74 17825->17826 17827 47dea8d 17826->17827 17830 47deab0 17826->17830 17828 47da80d 28 API calls 17827->17828 17829 47daf7a 17828->17829 17829->17818 17831 47dafde 33 API calls 17830->17831 17832 47deb12 17831->17832 17833 47dbcd2 255 API calls 17832->17833 17834 47deb3d 17833->17834 17835 4737d50 GetPEB 17834->17835 17836 47deb48 17835->17836 17837 47deb4c GetPEB 17836->17837 17838 47deb60 17836->17838 17837->17838 17838->17829 17839 47cfe3f 14 API calls 17838->17839 17839->17829 17841 4737d50 GetPEB 17840->17841 17842 47d1634 17841->17842 17843 47d1638 GetPEB 17842->17843 17844 47d1648 _vswprintf_s 17842->17844 17843->17844 17845 475b640 _vswprintf_s 12 API calls 17844->17845 17846 47d166b 17845->17846 17846->17815 17848 47dfdf5 17847->17848 17849 47dfdfe 17848->17849 17850 47dfe12 17848->17850 17851 47da80d 28 API calls 17849->17851 17852 47dfebd 17850->17852 17853 47dfe2c 17850->17853 17854 47dfe0d 17851->17854 17857 47e0a13 248 API calls 17852->17857 17855 47dfe45 17853->17855 17856 47dfe35 17853->17856 17854->17815 17876 47e2b28 17855->17876 17858 47ddbd2 243 API calls 17856->17858 17860 47dfecb 17857->17860 17861 47dfe41 17858->17861 17863 4737d50 GetPEB 17860->17863 17865 4737d50 GetPEB 17861->17865 17862 47dfe55 17862->17861 17869 47dc8f7 12 API calls 17862->17869 17864 47dfed3 17863->17864 17866 47dfee7 17864->17866 17867 47dfed7 GetPEB 17864->17867 17868 47dfe77 17865->17868 17866->17854 17870 47dfef1 GetPEB 17866->17870 17867->17866 17871 47dfe8b 17868->17871 17872 47dfe7b GetPEB 17868->17872 17869->17861 17870->17854 17875 47dfea4 17870->17875 17871->17854 17873 47dfe95 GetPEB 17871->17873 17872->17871 17873->17854 17873->17875 17874 47d1608 14 API calls 17874->17854 17875->17854 17875->17874 17880 47e2b46 17876->17880 17877 47e2bbf 17879 47da80d 28 API calls 17877->17879 17878 47e2bd3 17881 47e2c36 17878->17881 17882 47e2c15 17878->17882 17886 47e2bce 17879->17886 17880->17877 17880->17878 17884 47e241a 12 API calls 17881->17884 17883 47da80d 28 API calls 17882->17883 17883->17886 17885 47e2c4a 17884->17885 17885->17886 17888 47e3209 17885->17888 17886->17862 17889 47e3240 17888->17889 17890 475b640 _vswprintf_s 12 API calls 17889->17890 17891 47e324d 17890->17891 17891->17886 17892 47140e1 17893 4770423 GetPEB 17892->17893 17894 47140f7 17892->17894 17895 477042f GetPEB 17893->17895 17896 477044c 17893->17896 17897 471b150 _vswprintf_s 12 API calls 17895->17897 17898 471b150 _vswprintf_s 12 API calls 17896->17898 17899 4770449 17897->17899 17898->17899 17900 471b150 _vswprintf_s 12 API calls 17899->17900 17901 4770462 17900->17901 17902 4770473 17901->17902 17903 471b150 _vswprintf_s 12 API calls 17901->17903 17904 471b150 _vswprintf_s 12 API calls 17902->17904 17903->17902 17905 477047f GetPEB 17904->17905 17906 477048c 17905->17906 17907 4710b60 17908 4710b72 17907->17908 17910 4710baf 17907->17910 17908->17910 17911 4710bd0 17908->17911 17912 4710c66 17911->17912 17917 4710c05 17911->17917 17913 476e915 17912->17913 17914 476e940 17912->17914 17918 4710c8d _vswprintf_s 17912->17918 17913->17918 17920 4761700 17913->17920 17916 4761700 12 API calls 17914->17916 17914->17918 17916->17918 17917->17912 17917->17918 17919 4761700 12 API calls 17917->17919 17918->17910 17919->17917 17923 47614e9 17920->17923 17922 476171c 17922->17918 17924 47614fb 17923->17924 17925 475b58e _vswprintf_s 12 API calls 17924->17925 17926 476150e __cftof 17924->17926 17925->17926 17926->17922 17927 47435a1 17928 47435a7 17927->17928 17929 47435b7 17928->17929 17930 47435b8 GetPEB 17928->17930 17931 472eb70 33 API calls 17930->17931 17931->17929 17932 47d49a4 17933 47d49bc 17932->17933 17945 47d4a99 17932->17945 17935 47d49e4 _vswprintf_s 17933->17935 17952 4759660 LdrInitializeThunk 17933->17952 17936 47d4a21 GetPEB 17935->17936 17935->17945 17937 47d4a2d GetPEB 17936->17937 17938 47d4a4a 17936->17938 17939 471b150 _vswprintf_s 12 API calls 17937->17939 17940 471b150 _vswprintf_s 12 API calls 17938->17940 17941 47d4a47 17939->17941 17940->17941 17942 471b150 _vswprintf_s 12 API calls 17941->17942 17943 47d4a6b 17942->17943 17944 47d4a9b GetPEB 17943->17944 17943->17945 17946 47d4ac4 17944->17946 17947 47d4aa7 GetPEB 17944->17947 17949 471b150 _vswprintf_s 12 API calls 17946->17949 17948 471b150 _vswprintf_s 12 API calls 17947->17948 17950 47d4ac1 17948->17950 17949->17950 17951 471b150 _vswprintf_s 12 API calls 17950->17951 17951->17945 17952->17935 16880 47e5ba5 16881 47e5bb4 _vswprintf_s 16880->16881 16883 47e4c56 12 API calls 16881->16883 16887 47e5c10 16881->16887 16889 47e5c2a _vswprintf_s 16881->16889 16882 476d130 _vswprintf_s 12 API calls 16884 47e63e5 16882->16884 16883->16889 16886 4756de6 32 API calls 16886->16889 16887->16882 16888 47e60cf GetPEB 16888->16889 16889->16886 16889->16887 16889->16888 16890 4759710 LdrInitializeThunk 16889->16890 16890->16889 17953 4711190 17954 47111a0 17953->17954 17956 47111be 17953->17956 17954->17956 17957 47111e0 17954->17957 17960 4711204 17957->17960 17958 475b640 _vswprintf_s 12 API calls 17959 4711296 17958->17959 17959->17956 17960->17958 17961 47c239a 17962 47c23d5 17961->17962 17963 475b640 _vswprintf_s 12 API calls 17962->17963 17964 47c23df 17963->17964 17965 479b111 17966 479b131 17965->17966 17967 479b143 17965->17967 17969 47a21b7 17966->17969 17972 475e3a0 17969->17972 17975 475e3bd 17972->17975 17974 475e3b8 17974->17967 17976 475e3cc 17975->17976 17978 475e3e3 17975->17978 17977 475b58e _vswprintf_s 12 API calls 17976->17977 17980 475e3d8 _vswprintf_s 17977->17980 17979 475b58e _vswprintf_s 12 API calls 17978->17979 17978->17980 17979->17980 17980->17974 17981 4719240 17982 471924c _vswprintf_s 17981->17982 17983 471925f 17982->17983 17999 47595d0 LdrInitializeThunk 17982->17999 18000 4719335 17983->18000 17987 4719335 LdrInitializeThunk 17988 4719276 17987->17988 18005 47595d0 LdrInitializeThunk 17988->18005 17990 471927e GetPEB 17991 47377f0 17990->17991 17992 471929a GetPEB 17991->17992 17993 47377f0 17992->17993 17994 47192b6 GetPEB 17993->17994 17996 47192d2 17994->17996 17995 4719330 17996->17995 17997 4719305 GetPEB 17996->17997 17998 471931f _vswprintf_s 17997->17998 17999->17983 18006 47595d0 LdrInitializeThunk 18000->18006 18002 4719342 18007 47595d0 LdrInitializeThunk 18002->18007 18004 471926b 18004->17987 18005->17990 18006->18002 18007->18004 16894 4759540 LdrInitializeThunk 18008 4711e04 18009 4711e10 _vswprintf_s 18008->18009 18010 47da80d 28 API calls 18009->18010 18012 4711e37 _vswprintf_s 18009->18012 18011 476f18b 18010->18011 18013 47436cc 18014 47436d4 GetPEB 18013->18014 18015 47436e6 18013->18015 18016 47436e5 18014->18016 18017 47d30c4 18018 47d30d8 18017->18018 18019 47d30ca 18017->18019 18020 472eb70 33 API calls 18019->18020 18020->18018 18021 47637cc 18022 47637db 18021->18022 18023 47637ea 18022->18023 18025 476590b 18022->18025 18026 4765917 18025->18026 18029 476592d 18025->18029 18027 475b58e _vswprintf_s 12 API calls 18026->18027 18028 4765923 18027->18028 18028->18023 18029->18023 18030 47cd380 18031 47cd393 18030->18031 18033 47cd38c 18030->18033 18032 47cd3a0 GetPEB 18031->18032 18032->18033 18034 474174b 18041 47596e0 LdrInitializeThunk 18034->18041 18036 4741765 18037 4741773 18036->18037 18042 47c3c60 18036->18042 18041->18036 18043 478562b 18042->18043 18045 47c3c78 18042->18045 18043->18037 18046 47596e0 LdrInitializeThunk 18043->18046 18045->18043 18047 47c3d40 18045->18047 18046->18037 18052 47c3d7f 18047->18052 18048 47c3e55 18049 475b640 _vswprintf_s 12 API calls 18048->18049 18051 47c3e65 18049->18051 18050 47c3e37 GetPEB 18050->18052 18051->18043 18052->18048 18052->18050

                                                Executed Functions

                                                Function 04759540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 4 4759540-475954c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: fcfa9ac65d32f7a58cb9e0417870f31b46e7976e51765fe2472b47f48efcbce5
                                                • Instruction ID: b4af5f8b4738ca3a0e6702fc8e8fe0cd94735362c56a2373959f281266678dd1
                                                • Opcode Fuzzy Hash: fcfa9ac65d32f7a58cb9e0417870f31b46e7976e51765fe2472b47f48efcbce5
                                                • Instruction Fuzzy Hash: 9B900265321004072115A55A0704507004797D9395351C031F5016560CDA61D8657161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047595D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 5 47595d0-47595dc LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 710dea04f878087b4b1160c2c08cfe7415753af99b077d9327e0a94f1e4e7838
                                                • Instruction ID: ca8831c0d0951b5e836d989cc9b38417dd8a0f3e7ab5af073d5a57e4205f7723
                                                • Opcode Fuzzy Hash: 710dea04f878087b4b1160c2c08cfe7415753af99b077d9327e0a94f1e4e7838
                                                • Instruction Fuzzy Hash: 669002A1312004076115715A4414616400B97E4245B51C031E50155A0DC965D8957165
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 6 4759660-475966c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: a4b47399cbd7d8aaee1db3f73f9840a08fe6d71c6312731dc1fb3f4441b98095
                                                • Instruction ID: ed8d36bb267b7db43c3223278b2b45803a2fb3b9f42e9cd5664d3b1442766e8a
                                                • Opcode Fuzzy Hash: a4b47399cbd7d8aaee1db3f73f9840a08fe6d71c6312731dc1fb3f4441b98095
                                                • Instruction Fuzzy Hash: 8F90027131100C06F190715A440464A000697D5345F91C025A4026664DCE55DA5D77E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047596E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 7 47596e0-47596ec LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: ffec9f3408c46fd3b644a6a38d3854b961fa70fdb4f251b65e3f3b293a28e955
                                                • Instruction ID: 90ac95544075aee2acfaaac4b809585912dc5182c42b0129b77018d4cc62f3aa
                                                • Opcode Fuzzy Hash: ffec9f3408c46fd3b644a6a38d3854b961fa70fdb4f251b65e3f3b293a28e955
                                                • Instruction Fuzzy Hash: 6790027131108C06F120615A840474A000697D4345F55C421A8425668D8AD5D8957161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 8 4759710-475971c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 19d99196883921f834f84f4c9b199cf45db8c68b7cb3d7a11bf9dda8e716f114
                                                • Instruction ID: dad6cf1e4f0ad834719d4e16d80d161c93b7e5bba9f08b335192d0d8455bda8c
                                                • Opcode Fuzzy Hash: 19d99196883921f834f84f4c9b199cf45db8c68b7cb3d7a11bf9dda8e716f114
                                                • Instruction Fuzzy Hash: EE90027131100806F110659A5408646000697E4345F51D021A9025565ECAA5D8957171
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: df24b3a42f9a75ba7c99bf7d2e64d94efb0d78819e9fdf9196195dff5867c050
                                                • Instruction ID: bbbcb9925a4019d13af2b2df6a0efe8ec772907e0fa7d4a82419036c7a6f0eaa
                                                • Opcode Fuzzy Hash: df24b3a42f9a75ba7c99bf7d2e64d94efb0d78819e9fdf9196195dff5867c050
                                                • Instruction Fuzzy Hash: F690027132114806F120615A8404706000697D5245F51C421A4825568D8AD5D8957162
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047597A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 10 47597a0-47597ac LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 01845b30b0ec11edb4479e71425666f1f817f96fa80cd283932bb2a89c6347e9
                                                • Instruction ID: 2eaaf21da05d94835a24d50732a1e63e6aa4f80293aa1d1eefbc22bc4d7e2632
                                                • Opcode Fuzzy Hash: 01845b30b0ec11edb4479e71425666f1f817f96fa80cd283932bb2a89c6347e9
                                                • Instruction Fuzzy Hash: E690026131100407F150715A54186064006E7E5345F51D021E4415564CDD55D85A7262
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 9 4759780-475978c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: a635867d53757ef37ecf8f063ee296043b3dedd24a0f2dbfd2ddde79f6c21d85
                                                • Instruction ID: 7bf244503d1ce90e869ce6bce55997e6d404367aee22b6676611c07ef53e11d6
                                                • Opcode Fuzzy Hash: a635867d53757ef37ecf8f063ee296043b3dedd24a0f2dbfd2ddde79f6c21d85
                                                • Instruction Fuzzy Hash: BA90026932300406F190715A540860A000697D5246F91D425A4016568CCD55D86D7361
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 12 4759860-475986c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: b627be1ddc83cbc0ce25bf4c31a971afb97422ba20b24291bdf8825ff707a177
                                                • Instruction ID: 0e7f9173ac04a4a8fea50714a32809216c28f4e42636a9e7cd9a2d26959e5a59
                                                • Opcode Fuzzy Hash: b627be1ddc83cbc0ce25bf4c31a971afb97422ba20b24291bdf8825ff707a177
                                                • Instruction Fuzzy Hash: C090027131100817F121615A4504707000A97D4285F91C422A4425568D9A96D956B161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 11 4759840-475984c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 900184389f1d6709540620f8198de9992e29bc2276c0bf5120eb582d52f06e46
                                                • Instruction ID: 72931ceb68eccd93b99a1943e9c573e52166fa6b70496fdb55a71cf130f906a9
                                                • Opcode Fuzzy Hash: 900184389f1d6709540620f8198de9992e29bc2276c0bf5120eb582d52f06e46
                                                • Instruction Fuzzy Hash: BE900261352045567555B15A44045074007A7E4285791C022A5415960C8966E85AF661
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047598F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 13 47598f0-47598fc LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 8acaef3cf2fecfd7b3c72f50d8ea9039fd0a073989aa9a896304e1feeec1f27c
                                                • Instruction ID: a09c4dbe63bbbc84aa547610e6b8cdfec85087dd40300ebab12bbdc7302eb61f
                                                • Opcode Fuzzy Hash: 8acaef3cf2fecfd7b3c72f50d8ea9039fd0a073989aa9a896304e1feeec1f27c
                                                • Instruction Fuzzy Hash: 0690026171100906F111715A4404616000B97D4285F91C032A5025565ECE65D996B171
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 14 4759910-475991c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 263029108cec09c9ad1e40ee4cc2b59c4a6fcef6a61f61153e8bcadffff96ebe
                                                • Instruction ID: 39a780efaebe617248cccf511e912c6d5e223f2847762a4eba12bd1f408b1607
                                                • Opcode Fuzzy Hash: 263029108cec09c9ad1e40ee4cc2b59c4a6fcef6a61f61153e8bcadffff96ebe
                                                • Instruction Fuzzy Hash: 839002B131100806F150715A4404746000697D4345F51C021A9065564E8A99DDD976A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047599A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 15 47599a0-47599ac LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: c5d076dccc0ae5b5201c9ae37812a95e7c9fc0a09d35c9540b5b0f63ffb35e58
                                                • Instruction ID: 9f50da34c0e6a100dd5173755a12307f56c5370803994f41991cfc659d766a22
                                                • Opcode Fuzzy Hash: c5d076dccc0ae5b5201c9ae37812a95e7c9fc0a09d35c9540b5b0f63ffb35e58
                                                • Instruction Fuzzy Hash: 089002A135100846F110615A4414B060006D7E5345F51C025E5065564D8A59DC567166
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 9f8d00ce59beb37ac52d591ba4cf433612ba435730d8cea87269cb0c27e35e3b
                                                • Instruction ID: aa8b4856d150f179971cb5dfd6cc56a90c47b06dc0a64c48f549bf13f32856d1
                                                • Opcode Fuzzy Hash: 9f8d00ce59beb37ac52d591ba4cf433612ba435730d8cea87269cb0c27e35e3b
                                                • Instruction Fuzzy Hash: 3890026132180446F210656A4C14B07000697D4347F51C125A4155564CCD55D8657561
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 17 4759a20-4759a2c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 8d10b48c18d48d42d85d82db1e3d2f6f57bd7a3c326b9fc01df9a35cd6da9514
                                                • Instruction ID: 28974bd5647ee828ed73e5825dc7f4f652aee92a0156489e1605e335761b6649
                                                • Opcode Fuzzy Hash: 8d10b48c18d48d42d85d82db1e3d2f6f57bd7a3c326b9fc01df9a35cd6da9514
                                                • Instruction Fuzzy Hash: E2900261711004466150716A88449064006BBE5255751C131A4999560D8999D86976A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 16 4759a00-4759a0c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: f907398169d565232bb329d05efdc8a9f616f2837e159cf53f31fcb941544808
                                                • Instruction ID: 63955797c30d3c78dc7a98c94a6c09032ea7712f165ff8b4086f8d922cd72142
                                                • Opcode Fuzzy Hash: f907398169d565232bb329d05efdc8a9f616f2837e159cf53f31fcb941544808
                                                • Instruction Fuzzy Hash: AE90027131140806F110615A481470B000697D4346F51C021A5165565D8A65D85575B1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 0 475967a-475967f 1 4759681-4759688 0->1 2 475968f-4759696 LdrInitializeThunk 0->2
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 21125f89330d971932eea50c5c0c433e3d4237def6ecd50b590f09a6d0c7e683
                                                • Instruction ID: b94afe87321e16a6a16f893691ae4aaaf642eba09d90e9c5190e6ff73dd9d076
                                                • Opcode Fuzzy Hash: 21125f89330d971932eea50c5c0c433e3d4237def6ecd50b590f09a6d0c7e683
                                                • Instruction Fuzzy Hash: 2BB09BF19014C5C9F711D76146087177941B7D4745F16C061D6030651B4778D095F5B5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Non-executed Functions

                                                Function 047CB260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE
                                                Download Yara Rule
                                                Strings
                                                • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 047CB39B
                                                • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 047CB305
                                                • *** enter .cxr %p for the context, xrefs: 047CB50D
                                                • *** A stack buffer overrun occurred in %ws:%s, xrefs: 047CB2F3
                                                • The resource is owned shared by %d threads, xrefs: 047CB37E
                                                • *** then kb to get the faulting stack, xrefs: 047CB51C
                                                • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 047CB484
                                                • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 047CB2DC
                                                • <unknown>, xrefs: 047CB27E, 047CB2D1, 047CB350, 047CB399, 047CB417, 047CB48E
                                                • The critical section is owned by thread %p., xrefs: 047CB3B9
                                                • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 047CB476
                                                • read from, xrefs: 047CB4AD, 047CB4B2
                                                • Go determine why that thread has not released the critical section., xrefs: 047CB3C5
                                                • The resource is owned exclusively by thread %p, xrefs: 047CB374
                                                • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 047CB323
                                                • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 047CB38F
                                                • The instruction at %p referenced memory at %p., xrefs: 047CB432
                                                • *** enter .exr %p for the exception record, xrefs: 047CB4F1
                                                • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 047CB53F
                                                • *** An Access Violation occurred in %ws:%s, xrefs: 047CB48F
                                                • The instruction at %p tried to %s , xrefs: 047CB4B6
                                                • write to, xrefs: 047CB4A6
                                                • *** Inpage error in %ws:%s, xrefs: 047CB418
                                                • an invalid address, %p, xrefs: 047CB4CF
                                                • *** Resource timeout (%p) in %ws:%s, xrefs: 047CB352
                                                • This failed because of error %Ix., xrefs: 047CB446
                                                • a NULL pointer, xrefs: 047CB4E0
                                                • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 047CB3D6
                                                • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 047CB47D
                                                • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 047CB314
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                                • API String ID: 0-108210295
                                                • Opcode ID: 3a773d01e337b360a4070191633ec333a10cffe1915b5b025fcd5ad6dc56ed9b
                                                • Instruction ID: 6af1c5ad4e4ec3a0be10539de6cfdec390444fd907456d84747114911dea6bb9
                                                • Opcode Fuzzy Hash: 3a773d01e337b360a4070191633ec333a10cffe1915b5b025fcd5ad6dc56ed9b
                                                • Instruction Fuzzy Hash: 238103B5A01210FFEB216B85EC4AD7F3B6AEF86B55F40804CF5042B352E261B551DBB2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D1C06 Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 44%
                                                			E047D1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x46f48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0471B150();
				} else {
					E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x480589c);
				E0471B150("Heap error detected at %p (heap handle %p)\n",  *0x48058a0);
				_t27 =  *0x4805898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M047D1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0471B150();
				} else {
					E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0471B150("Error code: %d - %s\n",  *0x4805898);
				_t113 =  *0x48058a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0471B150();
					} else {
						E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0471B150("Parameter1: %p\n",  *0x48058a4);
				}
				_t115 =  *0x48058a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0471B150();
					} else {
						E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0471B150("Parameter2: %p\n",  *0x48058a8);
				}
				_t117 =  *0x48058ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0471B150();
					} else {
						E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0471B150("Parameter3: %p\n",  *0x48058ac);
				}
				_t119 =  *0x48058b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0471B150();
					} else {
						E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x48058b4);
					E0471B150("Last known valid blocks: before - %p, after - %p\n",  *0x48058b0);
				} else {
					_t120 =  *0x48058b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0471B150();
				} else {
					E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0471B150("Stack trace available at %p\n", 0x48058c0);
			}











                                                0x047d1c10
                                                0x047d1c16
                                                0x047d1c1e
                                                0x047d1c3d
                                                0x047d1c3e
                                                0x047d1c20
                                                0x047d1c35
                                                0x047d1c3a
                                                0x047d1c44
                                                0x047d1c55
                                                0x047d1c5a
                                                0x047d1c65
                                                0x047d1c67
                                                0x00000000
                                                0x047d1c6e
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d1c67
                                                0x047d1cdc
                                                0x047d1ce5
                                                0x047d1d04
                                                0x047d1d05
                                                0x047d1ce7
                                                0x047d1cfc
                                                0x047d1d01
                                                0x047d1d0b
                                                0x047d1d17
                                                0x047d1d1f
                                                0x047d1d25
                                                0x047d1d30
                                                0x047d1d4f
                                                0x047d1d50
                                                0x047d1d32
                                                0x047d1d47
                                                0x047d1d4c
                                                0x047d1d61
                                                0x047d1d67
                                                0x047d1d68
                                                0x047d1d6e
                                                0x047d1d79
                                                0x047d1d98
                                                0x047d1d99
                                                0x047d1d7b
                                                0x047d1d90
                                                0x047d1d95
                                                0x047d1daa
                                                0x047d1db0
                                                0x047d1db1
                                                0x047d1db7
                                                0x047d1dc2
                                                0x047d1de1
                                                0x047d1de2
                                                0x047d1dc4
                                                0x047d1dd9
                                                0x047d1dde
                                                0x047d1df3
                                                0x047d1df9
                                                0x047d1dfa
                                                0x047d1e00
                                                0x047d1e0a
                                                0x047d1e13
                                                0x047d1e32
                                                0x047d1e33
                                                0x047d1e15
                                                0x047d1e2a
                                                0x047d1e2f
                                                0x047d1e39
                                                0x047d1e4a
                                                0x047d1e02
                                                0x047d1e02
                                                0x047d1e08
                                                0x00000000
                                                0x00000000
                                                0x047d1e08
                                                0x047d1e5b
                                                0x047d1e7a
                                                0x047d1e7b
                                                0x047d1e5d
                                                0x047d1e72
                                                0x047d1e77
                                                0x047d1e95

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                • API String ID: 0-2897834094
                                                • Opcode ID: ccf1d8de43c0be20133f75147b83ba77eb6d1676a2d4e24ce89e2ed4a86e4480
                                                • Instruction ID: 3b466ddb77b5f2a38781545695d31554036ee8f5c85ec54672fd0d47ce4fb91d
                                                • Opcode Fuzzy Hash: ccf1d8de43c0be20133f75147b83ba77eb6d1676a2d4e24ce89e2ed4a86e4480
                                                • Instruction Fuzzy Hash: 7A619432632144DFE7119B99E888E2573F4EB05A3174A887AF80E5B351E624FC81AF19
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04723D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 96%
                                                			E04723D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04721B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04721B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04721B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04721B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04721B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04734620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0475F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04761370(_t276, 0x46f4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0475BB40(0,  &_v68, _t170);
									if(L047243C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0475BB40(_t257,  &_v68, _t243);
								if(L047243C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04761370(_t278, 0x46f4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04734620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0475F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04761370(_v16, 0x46f4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0475BB40(_t262,  &_v68, _t244);
								if(L047243C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04761370(_t282, 0x46f4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0475BB40(_t262,  &_v68, _t201);
							if(L047243C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04734620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0475F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04761370(_t280, 0x46f4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0475BB40(_t267,  &_v68, _t245);
							if(L047243C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04761370(_t284, 0x46f4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0475BB40(_t267,  &_v68, _t224);
						if(L047243C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}










































                                                0x04723d3c
                                                0x04723d42
                                                0x04723d44
                                                0x04723d46
                                                0x04723d49
                                                0x04723d4c
                                                0x04723d4f
                                                0x04723d52
                                                0x04723d55
                                                0x04723d58
                                                0x04723d5b
                                                0x04723d5f
                                                0x04723d61
                                                0x04723d66
                                                0x04778213
                                                0x04778218
                                                0x04724085
                                                0x04724088
                                                0x0472408e
                                                0x04724094
                                                0x0472409a
                                                0x047240a0
                                                0x047240a6
                                                0x047240a9
                                                0x047240af
                                                0x047240b6
                                                0x047240bd
                                                0x047240bd
                                                0x04723d83
                                                0x0477821f
                                                0x04778229
                                                0x04778238
                                                0x04778238
                                                0x0477823d
                                                0x0477823d
                                                0x04723da0
                                                0x04723daf
                                                0x04723db5
                                                0x04723dba
                                                0x04723dba
                                                0x04723dd4
                                                0x04723e94
                                                0x04723eab
                                                0x04723f6d
                                                0x04723f84
                                                0x0472406b
                                                0x0472406b
                                                0x0472406e
                                                0x0472406e
                                                0x04724070
                                                0x04724074
                                                0x04778351
                                                0x04778351
                                                0x0472407a
                                                0x0472407f
                                                0x0477835d
                                                0x04778370
                                                0x04778377
                                                0x04778379
                                                0x0477837c
                                                0x0477837c
                                                0x0477835d
                                                0x00000000
                                                0x0472407f
                                                0x04723f8a
                                                0x04723f8d
                                                0x04723f90
                                                0x04723f95
                                                0x0477830d
                                                0x0477830f
                                                0x04723f9b
                                                0x04723fac
                                                0x04723fae
                                                0x04723fb1
                                                0x04723fb1
                                                0x04723fb6
                                                0x04778317
                                                0x0477831a
                                                0x00000000
                                                0x04723fbc
                                                0x04723fc1
                                                0x04723fc9
                                                0x04723fd7
                                                0x04723fda
                                                0x04723fdd
                                                0x04724021
                                                0x04724021
                                                0x04724029
                                                0x04724030
                                                0x04724044
                                                0x04724046
                                                0x04724046
                                                0x04724044
                                                0x04724049
                                                0x04778327
                                                0x04778334
                                                0x04778339
                                                0x0477833c
                                                0x0472404f
                                                0x0472404f
                                                0x0472404f
                                                0x04724051
                                                0x04724056
                                                0x04724063
                                                0x04724063
                                                0x04724068
                                                0x00000000
                                                0x04724068
                                                0x04723fdf
                                                0x04723fe2
                                                0x04723fe4
                                                0x04723fe7
                                                0x04723fef
                                                0x04724003
                                                0x04724005
                                                0x04724005
                                                0x0472400c
                                                0x04724013
                                                0x04724016
                                                0x04724017
                                                0x0472401b
                                                0x0472401e
                                                0x00000000
                                                0x0472401e
                                                0x04723fb6
                                                0x04723eb1
                                                0x04723eb4
                                                0x04723eb7
                                                0x04723ebc
                                                0x047782a9
                                                0x047782ab
                                                0x04723ec2
                                                0x04723ed3
                                                0x04723ed5
                                                0x04723ed8
                                                0x04723ed8
                                                0x04723edd
                                                0x047782b3
                                                0x047782b6
                                                0x00000000
                                                0x04723ee3
                                                0x04723ee8
                                                0x04723eed
                                                0x04723ef0
                                                0x04723ef3
                                                0x04723f02
                                                0x04723f05
                                                0x04723f08
                                                0x047782c0
                                                0x047782c3
                                                0x047782c5
                                                0x047782c8
                                                0x047782d0
                                                0x047782e4
                                                0x047782e6
                                                0x047782e6
                                                0x047782ed
                                                0x047782f4
                                                0x047782f7
                                                0x047782f8
                                                0x047782fc
                                                0x047782ff
                                                0x047782ff
                                                0x04723f0e
                                                0x04723f11
                                                0x04723f16
                                                0x04723f1d
                                                0x04723f31
                                                0x04778307
                                                0x04778307
                                                0x04723f31
                                                0x04723f39
                                                0x04723f48
                                                0x04723f4d
                                                0x04723f50
                                                0x04723f50
                                                0x04723f53
                                                0x04723f58
                                                0x04723f65
                                                0x04723f65
                                                0x04723f6a
                                                0x00000000
                                                0x04723f6a
                                                0x04723edd
                                                0x04723dda
                                                0x04723ddd
                                                0x04723de0
                                                0x04723de5
                                                0x04778245
                                                0x04723deb
                                                0x04723df7
                                                0x04723dfc
                                                0x04723dfe
                                                0x04723e01
                                                0x04723e01
                                                0x04723e06
                                                0x0477824d
                                                0x0477824f
                                                0x04778254
                                                0x00000000
                                                0x04723e0c
                                                0x04723e11
                                                0x04723e16
                                                0x04723e19
                                                0x04723e29
                                                0x04723e2c
                                                0x04723e2f
                                                0x0477825c
                                                0x0477825f
                                                0x04778261
                                                0x04778264
                                                0x0477826c
                                                0x04778280
                                                0x04778282
                                                0x04778282
                                                0x04778289
                                                0x04778290
                                                0x04778293
                                                0x04778294
                                                0x04778298
                                                0x0477829b
                                                0x0477829b
                                                0x04723e35
                                                0x04723e38
                                                0x04723e3d
                                                0x04723e44
                                                0x04723e58
                                                0x047782a3
                                                0x047782a3
                                                0x04723e58
                                                0x04723e60
                                                0x04723e6f
                                                0x04723e74
                                                0x04723e77
                                                0x04723e77
                                                0x04723e7a
                                                0x04723e7f
                                                0x04723e8c
                                                0x04723e8c
                                                0x04723e91
                                                0x00000000
                                                0x04723e91

                                                Strings
                                                • WindowsExcludedProcs, xrefs: 04723D6F
                                                • Kernel-MUI-Number-Allowed, xrefs: 04723D8C
                                                • Kernel-MUI-Language-Allowed, xrefs: 04723DC0
                                                • Kernel-MUI-Language-Disallowed, xrefs: 04723E97
                                                • Kernel-MUI-Language-SKU, xrefs: 04723F70
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                • API String ID: 0-258546922
                                                • Opcode ID: 14afd96ef052c8a4d4e3ef1db321ca014bb87b40ac0e92c2ee4a6ba5d0abd3fc
                                                • Instruction ID: 842d1986a85d5be727cab1cd31d20a5bc5ffe6a2525b9e6abf68a769b79f74dd
                                                • Opcode Fuzzy Hash: 14afd96ef052c8a4d4e3ef1db321ca014bb87b40ac0e92c2ee4a6ba5d0abd3fc
                                                • Instruction Fuzzy Hash: 12F13D72D00628EFDB11DFA9CA84AEEB7B9FF08750F15405AE905A7311E774AE41CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047140E1 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 29%
                                                			E047140E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E0471B150();
					} else {
						E0471B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0471B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E0471B150(", passed to %s", _t29);
					}
					_push("\n");
					E0471B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x4806378 = 1;
						asm("int3");
						 *0x4806378 = 0;
					}
					return 0;
				}
				return 1;
			}





                                                0x047140e6
                                                0x047140e8
                                                0x047140f1
                                                0x0477042d
                                                0x0477044c
                                                0x04770451
                                                0x0477042f
                                                0x04770444
                                                0x04770449
                                                0x0477045d
                                                0x04770466
                                                0x0477046e
                                                0x04770474
                                                0x04770475
                                                0x0477047a
                                                0x0477048a
                                                0x0477048c
                                                0x04770493
                                                0x04770494
                                                0x04770494
                                                0x00000000
                                                0x0477049b
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
                                                • API String ID: 0-188067316
                                                • Opcode ID: b010fb30633305a1513f0f7250c7d1f9e5371b7a1dcc1f80c1b1d43e0e3b0c0f
                                                • Instruction ID: e7f186d62cbda3eaecc4d55578d2e8f72d45a222a1676e61f4151742ebd8017a
                                                • Opcode Fuzzy Hash: b010fb30633305a1513f0f7250c7d1f9e5371b7a1dcc1f80c1b1d43e0e3b0c0f
                                                • Instruction Fuzzy Hash: BC017032254280AFE325976CE84DF5277B4DB03F34F1A4069F00447752EAA4B891D690
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04748E00 Relevance: 5.1, Strings: 4, Instructions: 126COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 44%
                                                			E04748E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x480d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4808464; // 0x74e10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4805780 & 0x00000003) != 0) {
							E04795510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4805780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0475B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4807984; // 0x2ac2c48
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4808464; // 0x74e10110
					 *0x480b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04749B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4805780 & 0x00000005) != 0) {
						_push(_t49);
						E04795510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}




















                                                0x04748e0f
                                                0x04748e16
                                                0x04748e19
                                                0x04748e1b
                                                0x04748e21
                                                0x04748e7f
                                                0x04748e85
                                                0x04789354
                                                0x0478936c
                                                0x04789371
                                                0x0478937b
                                                0x04789381
                                                0x04789381
                                                0x0478937b
                                                0x04748e9d
                                                0x04748e9d
                                                0x04748e29
                                                0x04748e2c
                                                0x04748e38
                                                0x04748e3e
                                                0x04748e43
                                                0x04748eb5
                                                0x04748eb9
                                                0x047892aa
                                                0x047892af
                                                0x047892e8
                                                0x047892e8
                                                0x047892af
                                                0x04748eb9
                                                0x04748e45
                                                0x04748e53
                                                0x04748e5b
                                                0x04748e5f
                                                0x04748e78
                                                0x04748e78
                                                0x04748e7d
                                                0x04748ec3
                                                0x04748ecd
                                                0x04748ed2
                                                0x04748ed2
                                                0x04748ec5
                                                0x04748ec5
                                                0x00000000
                                                0x04748e7d
                                                0x04748e67
                                                0x04748ea4
                                                0x0478931a
                                                0x00000000
                                                0x00000000
                                                0x04789320
                                                0x04748ea4
                                                0x04748e70
                                                0x04789325
                                                0x04789340
                                                0x04789345
                                                0x04789345
                                                0x04748e76
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Strings
                                                • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0478932A
                                                • Querying the active activation context failed with status 0x%08lx, xrefs: 04789357
                                                • LdrpFindDllActivationContext, xrefs: 04789331, 0478935D
                                                • minkernel\ntdll\ldrsnap.c, xrefs: 0478933B, 04789367
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                • API String ID: 0-3779518884
                                                • Opcode ID: 718494dee833d15c3b71c108e8949422aad93aac016c6a57d6e46da4408155f6
                                                • Instruction ID: f34fd3dac376d1ded1f996ff3f0cb86367ad3d6afe581ff4a4792ba481b689a8
                                                • Opcode Fuzzy Hash: 718494dee833d15c3b71c108e8949422aad93aac016c6a57d6e46da4408155f6
                                                • Instruction Fuzzy Hash: D141F97AA40339AFDB75BE38C84DA3576A5EB80754F0B4569D90457360F760BEC08683
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D49A4 Relevance: 5.1, Strings: 4, Instructions: 114COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                • API String ID: 2994545307-336120773
                                                • Opcode ID: 4f3a681333c7db45590ef75ba5206a1c73c3eb92506ca193e6bab6358a7a4194
                                                • Instruction ID: 7050da4fac9e04e27fcabe7b8a751c61e880637565ec8316ec24de55c0ec3457
                                                • Opcode Fuzzy Hash: 4f3a681333c7db45590ef75ba5206a1c73c3eb92506ca193e6bab6358a7a4194
                                                • Instruction Fuzzy Hash: D131FE71220200EFE330DB59C889FAA73B8EF45764F194465F945DB3A0E674B880DA68
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04728794 Relevance: 4.0, Strings: 3, Instructions: 255COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 83%
                                                			E04728794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0472934A() != 0) {
								_t159 = E0479A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4805780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E04795510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4805780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0472849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04728999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04728999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4805c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4805c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04732280(_t92, 0x48086cc);
															_t94 = E047E9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E047461A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4805c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04728A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4805c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4805c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0475F380(_t136, 0x46f1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04732280(_t108, 0x48086cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E047461A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E047E9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0472FFB0(_t118, _t156, 0x48086cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04759A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}












































                                                0x04728799
                                                0x0472879d
                                                0x047287a1
                                                0x047287a3
                                                0x047287a8
                                                0x047287c3
                                                0x047287c3
                                                0x047287c8
                                                0x047287d1
                                                0x047287d4
                                                0x047287d8
                                                0x047287e5
                                                0x047287ec
                                                0x04779bfe
                                                0x04779c00
                                                0x04779c02
                                                0x04779c08
                                                0x04779c0d
                                                0x04779c0f
                                                0x04779c14
                                                0x04779c2d
                                                0x04779c32
                                                0x04779c37
                                                0x04779c3a
                                                0x04779c3c
                                                0x04779c42
                                                0x04779c42
                                                0x04779c3c
                                                0x04779c02
                                                0x047287da
                                                0x047287df
                                                0x047287e3
                                                0x00000000
                                                0x00000000
                                                0x047287e3
                                                0x047287f2
                                                0x00000000
                                                0x047287fb
                                                0x047287fd
                                                0x047287fe
                                                0x0472880e
                                                0x0472880f
                                                0x04728810
                                                0x04728814
                                                0x0472881a
                                                0x0472881c
                                                0x0472881f
                                                0x04728821
                                                0x04728822
                                                0x04728824
                                                0x04728826
                                                0x0472882c
                                                0x0472882e
                                                0x04779c48
                                                0x04779c48
                                                0x04728834
                                                0x04728834
                                                0x04728837
                                                0x00000000
                                                0x00000000
                                                0x04728837
                                                0x0472882e
                                                0x0472883d
                                                0x04728840
                                                0x04728843
                                                0x04728846
                                                0x04728849
                                                0x0472884c
                                                0x0472884e
                                                0x04728850
                                                0x04728852
                                                0x04728854
                                                0x04728857
                                                0x047288b4
                                                0x047288b6
                                                0x047288b6
                                                0x04728859
                                                0x04728859
                                                0x04728859
                                                0x04728861
                                                0x04728866
                                                0x0472886a
                                                0x0472893d
                                                0x04728941
                                                0x00000000
                                                0x04728947
                                                0x04728947
                                                0x0472894a
                                                0x0472894c
                                                0x00000000
                                                0x04728952
                                                0x04728955
                                                0x0472895a
                                                0x0472895d
                                                0x0472895d
                                                0x0472895f
                                                0x04728961
                                                0x04728961
                                                0x04728968
                                                0x00000000
                                                0x00000000
                                                0x0472896a
                                                0x0472896b
                                                0x0472896e
                                                0x00000000
                                                0x04728970
                                                0x04728970
                                                0x04728970
                                                0x04728970
                                                0x04728972
                                                0x04728972
                                                0x04728974
                                                0x00000000
                                                0x0472897a
                                                0x0472897a
                                                0x0472897d
                                                0x00000000
                                                0x04728983
                                                0x04779c65
                                                0x04779c6d
                                                0x04779c72
                                                0x04779c75
                                                0x04779c75
                                                0x04779c82
                                                0x04779c86
                                                0x04779c87
                                                0x04779c88
                                                0x04779c89
                                                0x04779c8c
                                                0x04779c90
                                                0x04779c95
                                                0x04779c97
                                                0x04779ca0
                                                0x04779ca3
                                                0x04779ca9
                                                0x04779ca9
                                                0x00000000
                                                0x04779ca9
                                                0x04779ca3
                                                0x00000000
                                                0x04779c97
                                                0x0472897d
                                                0x00000000
                                                0x04728974
                                                0x04728988
                                                0x04728992
                                                0x04728996
                                                0x00000000
                                                0x04728996
                                                0x0472894c
                                                0x00000000
                                                0x04728870
                                                0x0472887b
                                                0x0472887d
                                                0x0472887f
                                                0x04728881
                                                0x04728884
                                                0x04728884
                                                0x04728886
                                                0x04728889
                                                0x0472888c
                                                0x0472888e
                                                0x04728891
                                                0x04728891
                                                0x04728898
                                                0x00000000
                                                0x00000000
                                                0x0472889a
                                                0x0472889b
                                                0x0472889e
                                                0x00000000
                                                0x00000000
                                                0x047288a0
                                                0x047288a8
                                                0x047288b0
                                                0x047288b2
                                                0x047288d3
                                                0x047288d5
                                                0x00000000
                                                0x047288d7
                                                0x047288db
                                                0x047288dc
                                                0x047288e0
                                                0x047288e8
                                                0x047288ee
                                                0x047288f0
                                                0x047288f3
                                                0x047288fc
                                                0x04728901
                                                0x04728906
                                                0x0472890c
                                                0x0472890c
                                                0x0472890f
                                                0x04728916
                                                0x04728917
                                                0x04728918
                                                0x04728919
                                                0x0472891a
                                                0x0472891f
                                                0x04728921
                                                0x04779c52
                                                0x04779c55
                                                0x04779c5b
                                                0x04779cac
                                                0x04779cc0
                                                0x04779cc0
                                                0x04779c55
                                                0x04728927
                                                0x04728927
                                                0x0472892f
                                                0x04728933
                                                0x00000000
                                                0x047288f5
                                                0x047288f5
                                                0x00000000
                                                0x047288f7
                                                0x047288f7
                                                0x047288fa
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047288fa
                                                0x047288f5
                                                0x047288f3
                                                0x00000000
                                                0x047288d5
                                                0x00000000
                                                0x047288b2
                                                0x047288c9
                                                0x00000000
                                                0x047288c9
                                                0x0472887f
                                                0x0472886a
                                                0x04728857
                                                0x04728852
                                                0x047288bf
                                                0x047288bf
                                                0x047287aa
                                                0x047287ad
                                                0x047287ae
                                                0x047287b4
                                                0x047287b5
                                                0x047287b6
                                                0x047287b8
                                                0x047287bd
                                                0x047287c1
                                                0x047287f4
                                                0x047287fa
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047287c1
                                                0x00000000

                                                Strings
                                                • LdrpDoPostSnapWork, xrefs: 04779C1E
                                                • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04779C18
                                                • minkernel\ntdll\ldrsnap.c, xrefs: 04779C28
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                                • API String ID: 2994545307-1948996284
                                                • Opcode ID: 88a0703eec1c85f3665bcfaa7076ad7afd476bcc6e8644f85fbeb8fdc2d900a4
                                                • Instruction ID: caca3724f6e8236e3d10dc5cce3267dc328e0964db3d225b44041e435f052ad8
                                                • Opcode Fuzzy Hash: 88a0703eec1c85f3665bcfaa7076ad7afd476bcc6e8644f85fbeb8fdc2d900a4
                                                • Instruction Fuzzy Hash: C89147B1A10225EFEF18EF55CA849BA77B5FF44304B464269D941AB350E732FD40CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04727E41 Relevance: 3.9, Strings: 3, Instructions: 174COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 98%
                                                			E04727E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0472CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0471C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4805780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E04795510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4805780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04737D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04737D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E04797016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04737D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04737D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E04797016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0474A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0471B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}




















                                                0x04727e4c
                                                0x04727e50
                                                0x04727e55
                                                0x04727e58
                                                0x04727e5d
                                                0x04727e71
                                                0x04727f33
                                                0x04727e77
                                                0x04727e77
                                                0x04727e79
                                                0x04727e79
                                                0x04727e7e
                                                0x04727f45
                                                0x04779848
                                                0x00000000
                                                0x04779848
                                                0x04727f4e
                                                0x04727f53
                                                0x04727f5a
                                                0x00000000
                                                0x00000000
                                                0x0477985a
                                                0x04779862
                                                0x04779866
                                                0x00000000
                                                0x0477986c
                                                0x00000000
                                                0x0477986c
                                                0x04727e84
                                                0x04727e84
                                                0x04727e8d
                                                0x04779871
                                                0x04727eb8
                                                0x04727ec0
                                                0x04727ec0
                                                0x04727e9a
                                                0x0477987e
                                                0x00000000
                                                0x00000000
                                                0x04779884
                                                0x0477988b
                                                0x047798a7
                                                0x047798ac
                                                0x047798b1
                                                0x047798b6
                                                0x047798b8
                                                0x047798b8
                                                0x047798b9
                                                0x00000000
                                                0x047798b9
                                                0x04727ea0
                                                0x04727ea7
                                                0x00000000
                                                0x00000000
                                                0x04727eac
                                                0x04727eb1
                                                0x04727ec6
                                                0x04727ed0
                                                0x047798cc
                                                0x04727ed6
                                                0x04727ed6
                                                0x04727ed6
                                                0x04727ede
                                                0x04727ee3
                                                0x047798e3
                                                0x047798f0
                                                0x04779902
                                                0x047798f2
                                                0x047798fb
                                                0x047798fb
                                                0x04779907
                                                0x0477991d
                                                0x0477991d
                                                0x04779907
                                                0x047798e3
                                                0x04727ef0
                                                0x04727f14
                                                0x04727f14
                                                0x04727f1e
                                                0x04779946
                                                0x04727f24
                                                0x04727f24
                                                0x04727f24
                                                0x04727f2c
                                                0x0477996a
                                                0x04779975
                                                0x04779975
                                                0x0477997e
                                                0x04779993
                                                0x04779993
                                                0x0477997e
                                                0x00000000
                                                0x04727ef2
                                                0x04727efc
                                                0x04727f0a
                                                0x04727f0e
                                                0x04779933
                                                0x00000000
                                                0x04779933
                                                0x00000000
                                                0x04727f0e
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04727eb1

                                                Strings
                                                • LdrpCompleteMapModule, xrefs: 04779898
                                                • Could not validate the crypto signature for DLL %wZ, xrefs: 04779891
                                                • minkernel\ntdll\ldrmap.c, xrefs: 047798A2
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                • API String ID: 0-1676968949
                                                • Opcode ID: 2328140a6ac9d3b14b74bde960fff96d816056b3b72e70b80cf7658e3d5f6a36
                                                • Instruction ID: 33732436f1bd6e04e9ca7f42347ac486c758abf7b603f457e5418a2248accd2d
                                                • Opcode Fuzzy Hash: 2328140a6ac9d3b14b74bde960fff96d816056b3b72e70b80cf7658e3d5f6a36
                                                • Instruction Fuzzy Hash: 6C51E1B1A047459BEB29CB69CB48B2ABBE4BF41314F440659E9519B3E1E734FD00CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471E620 Relevance: 3.9, Strings: 3, Instructions: 165COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 93%
                                                			E0471E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0471F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E047595D0();
						}
						if(_t78 != 0) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0475FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0475BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04759600();
					if(_t97 < 0) {
						goto L6;
					}
					E0475BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0471F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0475BB40(_t83, _t102 + 0x24, _t78);
								if(L047243C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0475BB40(_t84, _t102 + 0x24, _t94);
									if(L047243C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}































                                                0x0471e620
                                                0x0471e628
                                                0x0471e62f
                                                0x0471e631
                                                0x0471e635
                                                0x0471e637
                                                0x0471e63e
                                                0x04775503
                                                0x04775503
                                                0x0471e64c
                                                0x0471e64c
                                                0x0471e651
                                                0x00000000
                                                0x00000000
                                                0x0471e661
                                                0x0471e665
                                                0x0477542a
                                                0x0471e715
                                                0x0471e71a
                                                0x0471e71c
                                                0x0471e720
                                                0x0471e720
                                                0x0471e727
                                                0x0471e736
                                                0x0471e736
                                                0x0471e743
                                                0x0471e743
                                                0x0471e673
                                                0x0471e678
                                                0x0471e67d
                                                0x0471e682
                                                0x0471e685
                                                0x0471e692
                                                0x0471e69b
                                                0x0471e6a3
                                                0x0471e6ad
                                                0x0471e6b1
                                                0x0471e6b2
                                                0x0471e6bb
                                                0x0471e6bf
                                                0x0471e6c0
                                                0x0471e6c8
                                                0x0471e6cc
                                                0x0471e6d5
                                                0x0471e6d9
                                                0x00000000
                                                0x00000000
                                                0x0471e6e5
                                                0x0471e6ea
                                                0x0471e6f9
                                                0x0471e70b
                                                0x0471e70f
                                                0x04775439
                                                0x0477545e
                                                0x0477545e
                                                0x00000000
                                                0x0477545e
                                                0x0477543b
                                                0x0477543e
                                                0x04775440
                                                0x04775445
                                                0x04775472
                                                0x04775475
                                                0x0477548d
                                                0x04775493
                                                0x047754a9
                                                0x00000000
                                                0x00000000
                                                0x047754ab
                                                0x047754b4
                                                0x047754bc
                                                0x047754c8
                                                0x047754de
                                                0x047754fb
                                                0x047754e0
                                                0x047754e6
                                                0x047754eb
                                                0x047754eb
                                                0x047754de
                                                0x00000000
                                                0x047754bc
                                                0x04775477
                                                0x0477547a
                                                0x04775480
                                                0x04775483
                                                0x04775486
                                                0x0477548b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477548b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04775447
                                                0x04775447
                                                0x04775447
                                                0x04775447
                                                0x0477544e
                                                0x00000000
                                                0x00000000
                                                0x04775450
                                                0x04775452
                                                0x04775455
                                                0x0477545a
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477545c
                                                0x0477546a
                                                0x0477546d
                                                0x0477546f
                                                0x00000000
                                                0x0477546f
                                                0x0471e70f

                                                Strings
                                                • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0471E68C
                                                • @, xrefs: 0471E6C0
                                                • InstallLanguageFallback, xrefs: 0471E6DB
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                                • API String ID: 0-1757540487
                                                • Opcode ID: 7a4d3e0f2b5d6b2d5fb8b8f0ac8041639681e8bf437df0a6b1c89472b3079720
                                                • Instruction ID: e913fc268481c6e83eaaaa4ccc401666a4c488a83fe020bc789a4d2a867b7dbd
                                                • Opcode Fuzzy Hash: 7a4d3e0f2b5d6b2d5fb8b8f0ac8041639681e8bf437df0a6b1c89472b3079720
                                                • Instruction Fuzzy Hash: E8519FB2508355ABDB14DF28C444A6BB3E8AF88714F45092EF985E7750FB74FA0487A2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DE539 Relevance: 2.8, Strings: 2, Instructions: 261COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 60%
                                                			E047DE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E047DBBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E047DBCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E047DAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E04759730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E047DA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E047DA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E04759730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E047DA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E047DA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E04732280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0472B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0472FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E04737D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E047CFEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}




































                                                0x047de547
                                                0x047de549
                                                0x047de54f
                                                0x047de553
                                                0x047de557
                                                0x047de55a
                                                0x047de55c
                                                0x047de55f
                                                0x047de561
                                                0x047de567
                                                0x047de56b
                                                0x047de7e2
                                                0x00000000
                                                0x047de571
                                                0x047de575
                                                0x047de577
                                                0x047de57b
                                                0x047de57c
                                                0x047de57d
                                                0x047de57e
                                                0x047de57f
                                                0x047de588
                                                0x047de58f
                                                0x047de591
                                                0x047de592
                                                0x047de592
                                                0x047de596
                                                0x047de59e
                                                0x047de5a0
                                                0x047de5a6
                                                0x047de61d
                                                0x047de61d
                                                0x047de621
                                                0x047de623
                                                0x047de630
                                                0x047de630
                                                0x047de7e6
                                                0x047de7eb
                                                0x047de7ed
                                                0x047de7f4
                                                0x047de7fa
                                                0x047de7ff
                                                0x047de7ff
                                                0x047de80a
                                                0x047de812
                                                0x047de812
                                                0x047de5ab
                                                0x047de5b4
                                                0x047de5b9
                                                0x047de5be
                                                0x047de5c0
                                                0x047de5c2
                                                0x047de5c8
                                                0x047de5c9
                                                0x047de5cb
                                                0x047de5cc
                                                0x047de5d5
                                                0x047de5e4
                                                0x047de5f1
                                                0x047de5f8
                                                0x047de5f8
                                                0x047de5d5
                                                0x047de602
                                                0x047de616
                                                0x047de63d
                                                0x047de644
                                                0x047de64d
                                                0x047de652
                                                0x047de657
                                                0x047de659
                                                0x047de65b
                                                0x047de661
                                                0x047de662
                                                0x047de664
                                                0x047de665
                                                0x047de66e
                                                0x047de67d
                                                0x047de68a
                                                0x047de691
                                                0x047de691
                                                0x047de66e
                                                0x047de6b0
                                                0x00000000
                                                0x047de6b6
                                                0x047de6bd
                                                0x047de6c7
                                                0x047de6d7
                                                0x047de6d9
                                                0x047de6db
                                                0x047de6de
                                                0x047de6e3
                                                0x047de6f3
                                                0x047de6fc
                                                0x047de700
                                                0x047de700
                                                0x047de704
                                                0x047de70a
                                                0x047de70a
                                                0x047de713
                                                0x047de716
                                                0x047de719
                                                0x047de720
                                                0x047de761
                                                0x047de76b
                                                0x047de774
                                                0x047de77a
                                                0x047de77a
                                                0x047de78a
                                                0x047de791
                                                0x047de799
                                                0x047de79b
                                                0x047de79f
                                                0x047de7aa
                                                0x047de7c0
                                                0x047de7ac
                                                0x047de7b2
                                                0x047de7b9
                                                0x047de7b9
                                                0x047de7c7
                                                0x047de806
                                                0x00000000
                                                0x047de7c9
                                                0x047de7d1
                                                0x047de7d8
                                                0x00000000
                                                0x047de7d8
                                                0x00000000
                                                0x00000000
                                                0x047de722
                                                0x047de72e
                                                0x047de748
                                                0x047de74c
                                                0x047de754
                                                0x047de756
                                                0x047de75c
                                                0x047de75c
                                                0x00000000
                                                0x047de75c
                                                0x047de758
                                                0x047de758
                                                0x00000000
                                                0x047de758
                                                0x047de750
                                                0x00000000
                                                0x00000000
                                                0x047de752
                                                0x00000000
                                                0x047de752
                                                0x047de730
                                                0x047de735
                                                0x047de73d
                                                0x047de73f
                                                0x00000000
                                                0x00000000
                                                0x047de741
                                                0x047de741
                                                0x00000000
                                                0x047de741
                                                0x047de739
                                                0x00000000
                                                0x00000000
                                                0x047de73b
                                                0x00000000
                                                0x047de73b
                                                0x047de722
                                                0x047de720
                                                0x047de6b0
                                                0x047de618
                                                0x00000000
                                                0x047de618

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: `$`
                                                • API String ID: 0-197956300
                                                • Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                                • Instruction ID: b1772281fd71bdf4cc99f32b934ac94a97fabb7fa0febeda9b0a3dc0ea264c25
                                                • Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                                • Instruction Fuzzy Hash: B6918B71214B419BE766CE25CC44B1BB7EABF84724F14892DF999CA380E774F904CB52
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047951BE Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 77%
                                                			E047951BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x47f05f0);
				E0476D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0472EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E047953CA(0);
						return E0476D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0475F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04733690(1, _t117, 0x46f1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0475AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04734620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0475AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E0479500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04759860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}






















                                                0x047951be
                                                0x047951c3
                                                0x047951c8
                                                0x047951cd
                                                0x047951d0
                                                0x047951d3
                                                0x047951d8
                                                0x047951db
                                                0x047951de
                                                0x047951e0
                                                0x047951e3
                                                0x047951e6
                                                0x047951e8
                                                0x04795342
                                                0x04795351
                                                0x04795356
                                                0x0479535a
                                                0x04795360
                                                0x04795363
                                                0x04795366
                                                0x04795369
                                                0x04795369
                                                0x0479536b
                                                0x0479536b
                                                0x04795370
                                                0x047953a3
                                                0x047953a4
                                                0x047953a6
                                                0x047953ab
                                                0x047953ab
                                                0x047953ae
                                                0x047953ae
                                                0x047953b5
                                                0x047953bf
                                                0x047953bf
                                                0x04795375
                                                0x04795396
                                                0x047953a0
                                                0x047953a0
                                                0x00000000
                                                0x04795396
                                                0x04795377
                                                0x04795379
                                                0x0479537f
                                                0x0479538c
                                                0x04795390
                                                0x00000000
                                                0x04795390
                                                0x047951ee
                                                0x047951f1
                                                0x04795301
                                                0x04795310
                                                0x04795315
                                                0x04795318
                                                0x0479531b
                                                0x04795320
                                                0x0479532e
                                                0x04795331
                                                0x00000000
                                                0x04795331
                                                0x04795328
                                                0x04795329
                                                0x00000000
                                                0x04795329
                                                0x047951fa
                                                0x04795235
                                                0x04795236
                                                0x04795239
                                                0x0479523f
                                                0x04795240
                                                0x04795241
                                                0x04795242
                                                0x04795246
                                                0x04795247
                                                0x0479524e
                                                0x04795251
                                                0x04795267
                                                0x04795269
                                                0x0479526e
                                                0x0479527d
                                                0x0479527e
                                                0x04795281
                                                0x04795282
                                                0x04795287
                                                0x04795288
                                                0x0479528a
                                                0x0479528f
                                                0x04795294
                                                0x00000000
                                                0x00000000
                                                0x0479529a
                                                0x0479529c
                                                0x0479529e
                                                0x0479529e
                                                0x047952a4
                                                0x047952b0
                                                0x00000000
                                                0x00000000
                                                0x047952ba
                                                0x047952bc
                                                0x047952bc
                                                0x047952d4
                                                0x047952d9
                                                0x047952dc
                                                0x047952e1
                                                0x00000000
                                                0x00000000
                                                0x047952e7
                                                0x047952f4
                                                0x00000000
                                                0x047952f4
                                                0x04795270
                                                0x00000000
                                                0x04795270
                                                0x047951fc
                                                0x047951fd
                                                0x04795202
                                                0x04795203
                                                0x04795205
                                                0x0479520a
                                                0x0479520f
                                                0x00000000
                                                0x00000000
                                                0x0479521b
                                                0x04795226
                                                0x0479522b
                                                0x0479521d
                                                0x0479521d
                                                0x04795222
                                                0x04795222
                                                0x0479522d
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID: Legacy$UEFI
                                                • API String ID: 2994545307-634100481
                                                • Opcode ID: effbdc2e588226a708c3abff1b116db790ecf4cfa5a1caa957e6be044e5238a1
                                                • Instruction ID: e091549e84d4e1472c67639bc3f574cd818c4e62de75287d3db7fffa663cf85d
                                                • Opcode Fuzzy Hash: effbdc2e588226a708c3abff1b116db790ecf4cfa5a1caa957e6be044e5238a1
                                                • Instruction Fuzzy Hash: 8A518CB2A00618AFDF25DFA9D940AADBBF8FF48704F54402DE949EB351E670AD40CB10
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471B171 Relevance: 1.7, APIs: 1, Instructions: 166COMMONLIBRARYCODE
                                                Download Yara Rule
                                                C-Code - Quality: 78%
                                                			E0471B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x47ef7a8);
				E0476D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0476D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0475D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0475F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0476DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0475B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0475B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0475E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0475A890() != 0) {
					goto L6;
				}
				goto L3;
			}






















                                                0x0471b171
                                                0x0471b171
                                                0x0471b171
                                                0x0471b171
                                                0x0471b171
                                                0x0471b176
                                                0x0471b17b
                                                0x0471b180
                                                0x0471b186
                                                0x0471b18f
                                                0x0471b198
                                                0x0471b1a4
                                                0x0471b1aa
                                                0x04774802
                                                0x04774802
                                                0x04774805
                                                0x0477480c
                                                0x0477480e
                                                0x0471b1d1
                                                0x0471b1d3
                                                0x0471b1de
                                                0x0471b1de
                                                0x04774817
                                                0x0477481e
                                                0x04774820
                                                0x04774822
                                                0x04774822
                                                0x04774824
                                                0x04774824
                                                0x0477482a
                                                0x00000000
                                                0x00000000
                                                0x04774835
                                                0x0477483a
                                                0x0477483d
                                                0x0477483f
                                                0x04774842
                                                0x04774842
                                                0x04774842
                                                0x04774846
                                                0x0477484c
                                                0x0477484e
                                                0x04774851
                                                0x04774851
                                                0x04774853
                                                0x04774854
                                                0x04774854
                                                0x04774858
                                                0x0477485a
                                                0x0477485a
                                                0x0477485d
                                                0x0477485f
                                                0x04774861
                                                0x04774861
                                                0x04774866
                                                0x0477486b
                                                0x0477486e
                                                0x04774871
                                                0x04774876
                                                0x04774876
                                                0x04774878
                                                0x0477487b
                                                0x04774884
                                                0x04774884
                                                0x00000000
                                                0x0477487d
                                                0x0477487d
                                                0x04774882
                                                0x04774889
                                                0x04774889
                                                0x0477488f
                                                0x04774891
                                                0x047748e0
                                                0x047748e2
                                                0x047748e4
                                                0x047748e4
                                                0x047748e7
                                                0x047748e7
                                                0x047748ed
                                                0x047748f4
                                                0x047748f6
                                                0x04774951
                                                0x04774951
                                                0x04774953
                                                0x04774953
                                                0x04774956
                                                0x04774956
                                                0x04774958
                                                0x04774959
                                                0x04774959
                                                0x0477495d
                                                0x0477495d
                                                0x0477495f
                                                0x0477495f
                                                0x04774965
                                                0x04774969
                                                0x047749ba
                                                0x047749ba
                                                0x047749c1
                                                0x047749c5
                                                0x047749cc
                                                0x047749d4
                                                0x047749d7
                                                0x047749da
                                                0x047749e4
                                                0x047749e5
                                                0x047749f3
                                                0x04774a02
                                                0x00000000
                                                0x04774a02
                                                0x04774972
                                                0x04774974
                                                0x00000000
                                                0x00000000
                                                0x04774976
                                                0x04774979
                                                0x04774982
                                                0x04774983
                                                0x04774984
                                                0x0477498b
                                                0x0477498d
                                                0x04774991
                                                0x04774993
                                                0x04774999
                                                0x0477499d
                                                0x047749a2
                                                0x047749a2
                                                0x047749a2
                                                0x04774999
                                                0x047749ac
                                                0x00000000
                                                0x047749b3
                                                0x047748f8
                                                0x047748fe
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047748fe
                                                0x04774895
                                                0x0477489c
                                                0x047748ad
                                                0x047748b2
                                                0x047748b5
                                                0x047748b7
                                                0x047748ba
                                                0x047748bc
                                                0x047748c6
                                                0x047748c6
                                                0x047748cb
                                                0x047748d1
                                                0x047748d4
                                                0x047748d8
                                                0x047748d8
                                                0x00000000
                                                0x047748d8
                                                0x047748be
                                                0x047748c0
                                                0x00000000
                                                0x00000000
                                                0x047748c2
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047748c4
                                                0x00000000
                                                0x04774882
                                                0x0477487b
                                                0x04774904
                                                0x04774906
                                                0x00000000
                                                0x00000000
                                                0x04774908
                                                0x0477490e
                                                0x00000000
                                                0x00000000
                                                0x04774910
                                                0x04774917
                                                0x04774917
                                                0x00000000
                                                0x04774917
                                                0x0471b1ba
                                                0x047747f9
                                                0x047747fc
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047747fc
                                                0x0471b1c0
                                                0x0471b1c0
                                                0x0471b1c3
                                                0x0471b1cb
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: _vswprintf_s
                                                • String ID:
                                                • API String ID: 677850445-0
                                                • Opcode ID: bdfeea4e713e4b4d27b813fabda9e75954e5069a440d105895bf845bd78aa61c
                                                • Instruction ID: d206273c9305222201517f092679109a1f83fef1384b8ddac058c951cd6e8c8c
                                                • Opcode Fuzzy Hash: bdfeea4e713e4b4d27b813fabda9e75954e5069a440d105895bf845bd78aa61c
                                                • Instruction Fuzzy Hash: 7251FF71E002598FEF31CF68C844BAEBBB0AF04314F5041ADE859AB392D7746981DF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473B944 Relevance: 1.7, APIs: 1, Instructions: 166COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 76%
                                                			E0473B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x480d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04737D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E047E8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04759E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0475B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0475CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04737D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E047E8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0475AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4808628; // 0x0
								_v68 = _t77;
								_t78 =  *0x480862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4808628; // 0x0
							_t116 =  *0x480862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}
















































                                                0x0473b94c
                                                0x0473b956
                                                0x0473b95c
                                                0x0473b95e
                                                0x0473b964
                                                0x0473b969
                                                0x0473b96d
                                                0x0473b96d
                                                0x0473b970
                                                0x0473b974
                                                0x0473b97a
                                                0x0473badf
                                                0x0473badf
                                                0x0473bae2
                                                0x0473bae4
                                                0x0473bae6
                                                0x0473baf0
                                                0x04782cb8
                                                0x0473baf6
                                                0x0473baf6
                                                0x0473baf6
                                                0x0473bafd
                                                0x0473bb1f
                                                0x0473bb1f
                                                0x0473baff
                                                0x0473bb00
                                                0x0473bb00
                                                0x0473bb03
                                                0x0473bb03
                                                0x0473bacb
                                                0x0473bacf
                                                0x0473bad0
                                                0x0473bad1
                                                0x0473badc
                                                0x0473badc
                                                0x0473b980
                                                0x0473b980
                                                0x0473b988
                                                0x0473b98b
                                                0x0473b98d
                                                0x0473b990
                                                0x0473b993
                                                0x0473b999
                                                0x0473b99b
                                                0x0473b9a1
                                                0x0473b9a5
                                                0x0473b9aa
                                                0x0473b9b0
                                                0x0473b9bb
                                                0x0473b9c0
                                                0x0473b9c3
                                                0x0473b9ca
                                                0x0473b9cc
                                                0x0473b9cf
                                                0x0473b9d3
                                                0x0473b9d7
                                                0x0473ba94
                                                0x0473ba94
                                                0x0473ba98
                                                0x0473baa3
                                                0x04782ccb
                                                0x0473baa9
                                                0x0473baa9
                                                0x0473baa9
                                                0x0473bab1
                                                0x04782cd5
                                                0x04782cdd
                                                0x04782cdd
                                                0x0473babb
                                                0x0473babc
                                                0x0473bac2
                                                0x0473bac3
                                                0x0473bac3
                                                0x0473bac6
                                                0x00000000
                                                0x0473b9dd
                                                0x0473b9dd
                                                0x0473b9e7
                                                0x0473b9e7
                                                0x0473b9ec
                                                0x0473b9ec
                                                0x0473b9f1
                                                0x0473b9f5
                                                0x0473b9fa
                                                0x0473ba00
                                                0x0473ba0c
                                                0x0473ba10
                                                0x0473ba10
                                                0x0473ba12
                                                0x0473ba18
                                                0x00000000
                                                0x00000000
                                                0x0473bb26
                                                0x0473bb26
                                                0x0473ba1e
                                                0x0473ba1e
                                                0x0473ba23
                                                0x0473ba25
                                                0x0473ba2c
                                                0x0473ba30
                                                0x0473ba35
                                                0x0473ba35
                                                0x0473ba41
                                                0x0473ba46
                                                0x0473ba4c
                                                0x0473ba50
                                                0x0473ba54
                                                0x0473ba6a
                                                0x0473ba6e
                                                0x0473ba70
                                                0x0473ba74
                                                0x0473ba78
                                                0x0473ba7a
                                                0x0473ba7c
                                                0x0473ba8e
                                                0x0473ba90
                                                0x0473ba92
                                                0x0473bb14
                                                0x0473bb14
                                                0x0473bb16
                                                0x0473bb16
                                                0x00000000
                                                0x0473ba7c
                                                0x0473bb0a
                                                0x0473bb0d
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473bb0f

                                                APIs
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0473B9A5
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                • String ID:
                                                • API String ID: 885266447-0
                                                • Opcode ID: ed9893fbfc7317d93d29efbf5dd50abe4422a82b6220b959e9e22b2f7c762e45
                                                • Instruction ID: 76221329c482feb63ed56b4cd00da0d62678cfe8933c06b24064ebf3c3deaecc
                                                • Opcode Fuzzy Hash: ed9893fbfc7317d93d29efbf5dd50abe4422a82b6220b959e9e22b2f7c762e45
                                                • Instruction Fuzzy Hash: 695156B1A08740CFC720DF29C48492ABBE5FB88715F15896EE99587356EB70FC44CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04742581 Relevance: 1.6, Strings: 1, Instructions: 329COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 87%
                                                			E04742581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, void* _a12, void* _a16, void* _a20, void* _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				void* _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t246;
				signed int _t250;
				signed int _t251;
				signed int _t284;
				intOrPtr _t290;
				signed int _t292;
				signed int _t294;
				unsigned int _t299;
				signed int _t303;
				void* _t304;
				signed int _t332;
				signed int _t334;
				signed int _t339;
				signed int _t340;
				signed int _t345;
				signed int _t347;
				void* _t348;

				_t345 = _t347;
				_t348 = _t347 - 0x4c;
				_v8 =  *0x480d360 ^ _t345;
				_t339 = 0x480b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t299 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t290 = 0x48;
				_t320 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t332 = 0;
				_v37 = _t320;
				if(_v48 <= 0) {
					L16:
					_t45 = _t290 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t340 = 0xc0000106;
						goto L32;
					} else {
						_t339 = L04734620(_t299,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t290);
						_v52 = _t339;
						__eflags = _t339;
						if(_t339 == 0) {
							_t340 = 0xc0000017;
							goto L32;
						} else {
							 *(_t339 + 0x44) =  *(_t339 + 0x44) & 0x00000000;
							_t50 = _t339 + 0x48; // 0x48
							_t334 = _t50;
							_t320 = _v32;
							 *((intOrPtr*)(_t339 + 0x3c)) = _t290;
							_t292 = 0;
							 *((short*)(_t339 + 0x30)) = _v48;
							__eflags = _t320;
							if(_t320 != 0) {
								 *(_t339 + 0x18) = _t334;
								__eflags = _t320 - 0x4808478;
								 *_t339 = ((0 | _t320 == 0x04808478) - 0x00000001 & 0xfffffffb) + 7;
								E0475F3E0(_t334,  *((intOrPtr*)(_t320 + 4)),  *_t320 & 0x0000ffff);
								_t320 = _v32;
								_t348 = _t348 + 0xc;
								_t292 = 1;
								__eflags = _a8;
								_t334 = _t334 + (( *_t320 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t284 = E047A39F2(_t334);
									_t320 = _v32;
									_t334 = _t284;
								}
							}
							_t303 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t340 = _v68;
								__eflags = 0;
								 *((short*)(_t334 - 2)) = 0;
								goto L32;
							} else {
								_t294 = _t339 + _t292 * 4;
								_v56 = _t294;
								do {
									__eflags = _t320;
									if(_t320 != 0) {
										_t246 =  *(_v60 + _t303 * 4);
										__eflags = _t246;
										if(_t246 == 0) {
											goto L30;
										} else {
											__eflags = _t246 == 5;
											if(_t246 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t294 =  *(_v60 + _t303 * 4);
										 *(_t294 + 0x18) = _t334;
										_t250 =  *(_v60 + _t303 * 4);
										__eflags = _t250 - 8;
										if(__eflags > 0) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t250 * 4 +  &M04742959))) {
												case 0:
													__ax =  *0x4808488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0475F3E0(__edi,  *0x480848c, __ax & 0x0000ffff);
														__eax =  *0x4808488 & 0x0000ffff;
														goto L26;
													}
													goto L126;
												case 1:
													L45:
													E0475F3E0(_t334, _v80, _v64);
													_t279 = _v64;
													goto L26;
												case 2:
													 *0x4808480 & 0x0000ffff = E0475F3E0(__edi,  *0x4808484,  *0x4808480 & 0x0000ffff);
													__eax =  *0x4808480 & 0x0000ffff;
													__eax = ( *0x4808480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0475F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L126;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0475F3E0(_t334, _v76, _v36);
														_t279 = _v36;
													}
													L26:
													_t348 = _t348 + 0xc;
													_t334 = _t334 + (_t279 >> 1) * 2 + 2;
													__eflags = _t334;
													L27:
													_push(0x3b);
													_pop(_t281);
													 *((short*)(_t334 - 2)) = _t281;
													goto L28;
												case 6:
													__ebx = "\\Wow\\Wow";
													__eflags = __ebx - "\\Wow\\Wow";
													if(__ebx != "\\Wow\\Wow") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0475F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\Wow\\Wow";
														} while (__ebx != "\\Wow\\Wow");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4808478 & 0x0000ffff = E0475F3E0(__edi,  *0x480847c,  *0x4808478 & 0x0000ffff);
													__eax =  *0x4808478 & 0x0000ffff;
													__eax = ( *0x4808478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E047A39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4806e58 & 0x0000ffff = E0475F3E0(__edi,  *0x4806e5c,  *0x4806e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4806e58 & 0x0000ffff;
													__eax = ( *0x4806e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t303 = _v16;
													_t320 = _v32;
													L29:
													_t294 = _t294 + 4;
													__eflags = _t294;
													_v56 = _t294;
													goto L30;
											}
										}
									}
									goto L126;
									L30:
									_t303 = _t303 + 1;
									_v16 = _t303;
									__eflags = _t303 - _v48;
								} while (_t303 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t250 =  *(_v60 + _t332 * 4);
						if(_t250 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t250 * 4 +  &M04742935))) {
							case 0:
								__ax =  *0x4808488;
								__eflags = __ax;
								if(__eflags != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t320 =  &_v64;
								_v80 = E04742E3E(0,  &_v64);
								_t290 = _t290 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4808480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x4808480;
									goto L98;
								}
								goto L14;
							case 3:
								__eax = E0472EEF0(0x48079a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L75();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0472EB70(__ecx, 0x48079a0);
									__eflags = __esi - 0xc0000100;
									if(__eflags == 0) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t224 = _v72;
											__eflags = _t224;
											if(_t224 != 0) {
												L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t224);
											}
											_t225 = _v52;
											__eflags = _t225;
											if(_t225 != 0) {
												__eflags = _t340;
												if(_t340 < 0) {
													L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t225);
													_t225 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t299 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4807b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0472EB70(__ecx, 0x48079a0);
										__eax = _v52;
										L36:
										_pop(_t333);
										_pop(_t341);
										__eflags = _v8 ^ _t345;
										_pop(_t291);
										return E0475B640(_t225, _t291, _v8 ^ _t345, _t320, _t333, _t341);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L75();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L126;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t286 = _v56;
								if(_v56 != 0) {
									_t320 =  &_v36;
									_t288 = E04742E3E(_t286,  &_v36);
									_t299 = _v36;
									_v76 = _t288;
								}
								if(_t299 == 0) {
									goto L44;
								} else {
									_t290 = _t290 + 2 + _t299;
								}
								goto L14;
							case 6:
								__eax =  *0x4805764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4808478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x4808478;
									L98:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4806e58 & 0x0000ffff;
								__eax = ( *0x4806e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t332 = _t332 + 1;
								if(_t332 >= _v48) {
									goto L16;
								} else {
									_t320 = _v37;
									goto L1;
								}
								goto L126;
						}
					}
					L56:
					_t304 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					if(__eflags != 0) {
						asm("o16 sub [esp+eax-0x20], dh");
					}
					asm("loopne 0x29");
					if(__eflags == 0 || __eflags != 0) {
						_t339 = _t339 + 1;
						_t105 = _t348 + _t250 + 5;
						 *_t105 =  *(_t348 + _t250 + 5) - _t320;
						__eflags =  *_t105;
					}
					_t251 = _t250 + 0x1f047426;
					__eflags = _t251;
				}
				L126:
			}






































                                                0x04742584
                                                0x04742586
                                                0x04742590
                                                0x04742599
                                                0x0474259e
                                                0x047425a4
                                                0x047425a9
                                                0x047425ac
                                                0x047425ae
                                                0x047425b1
                                                0x047425b2
                                                0x047425b5
                                                0x047425b8
                                                0x047425bb
                                                0x047425bc
                                                0x047425bf
                                                0x047425c2
                                                0x047425c5
                                                0x047425c6
                                                0x047425cb
                                                0x047425ce
                                                0x047425d8
                                                0x047425dd
                                                0x047425de
                                                0x047425e1
                                                0x047425e3
                                                0x047425e9
                                                0x047426da
                                                0x047426da
                                                0x047426dd
                                                0x047426e2
                                                0x04785b56
                                                0x00000000
                                                0x047426e8
                                                0x047426f9
                                                0x047426fb
                                                0x047426fe
                                                0x04742700
                                                0x04785b60
                                                0x00000000
                                                0x04742706
                                                0x04742706
                                                0x0474270a
                                                0x0474270a
                                                0x0474270d
                                                0x04742713
                                                0x04742716
                                                0x04742718
                                                0x0474271c
                                                0x0474271e
                                                0x04785b6c
                                                0x04785b6f
                                                0x04785b7f
                                                0x04785b89
                                                0x04785b8e
                                                0x04785b93
                                                0x04785b96
                                                0x04785b9c
                                                0x04785ba0
                                                0x04785ba3
                                                0x04785bab
                                                0x04785bb0
                                                0x04785bb3
                                                0x04785bb3
                                                0x04785ba3
                                                0x04742724
                                                0x04742726
                                                0x04742729
                                                0x0474272c
                                                0x0474279d
                                                0x0474279d
                                                0x047427a0
                                                0x047427a2
                                                0x00000000
                                                0x0474272e
                                                0x0474272e
                                                0x04742731
                                                0x04742734
                                                0x04742734
                                                0x04742736
                                                0x04785bc1
                                                0x04785bc1
                                                0x04785bc4
                                                0x00000000
                                                0x04785bca
                                                0x04785bca
                                                0x04785bcd
                                                0x00000000
                                                0x04785bd3
                                                0x00000000
                                                0x04785bd3
                                                0x04785bcd
                                                0x0474273c
                                                0x0474273c
                                                0x04742742
                                                0x04742747
                                                0x0474274a
                                                0x0474274d
                                                0x04742750
                                                0x00000000
                                                0x04742756
                                                0x04742756
                                                0x00000000
                                                0x04742902
                                                0x04742908
                                                0x0474290b
                                                0x00000000
                                                0x04742911
                                                0x0474291c
                                                0x04742921
                                                0x00000000
                                                0x04742921
                                                0x00000000
                                                0x00000000
                                                0x04742880
                                                0x04742887
                                                0x0474288c
                                                0x00000000
                                                0x00000000
                                                0x04742805
                                                0x0474280a
                                                0x04742814
                                                0x04742816
                                                0x00000000
                                                0x00000000
                                                0x0474281e
                                                0x04742821
                                                0x04742823
                                                0x00000000
                                                0x04742829
                                                0x04742829
                                                0x04742831
                                                0x0474283c
                                                0x0474283e
                                                0x00000000
                                                0x0474283e
                                                0x00000000
                                                0x00000000
                                                0x0474284e
                                                0x04742850
                                                0x04742851
                                                0x04742854
                                                0x04742857
                                                0x0474285a
                                                0x0474285c
                                                0x0474285d
                                                0x00000000
                                                0x00000000
                                                0x0474275d
                                                0x04742761
                                                0x00000000
                                                0x04742767
                                                0x0474276e
                                                0x04742773
                                                0x04742773
                                                0x04742776
                                                0x04742778
                                                0x0474277e
                                                0x0474277e
                                                0x04742781
                                                0x04742781
                                                0x04742783
                                                0x04742784
                                                0x00000000
                                                0x00000000
                                                0x04785bd8
                                                0x04785bde
                                                0x04785be4
                                                0x04785be6
                                                0x04785be8
                                                0x04785be9
                                                0x04785bee
                                                0x04785bf8
                                                0x04785bff
                                                0x04785c01
                                                0x04785c04
                                                0x04785c07
                                                0x04785c0b
                                                0x04785c0d
                                                0x04785c0d
                                                0x04785c15
                                                0x04785c18
                                                0x04785c1b
                                                0x04785c1b
                                                0x04785c1e
                                                0x00000000
                                                0x00000000
                                                0x047428c3
                                                0x047428c8
                                                0x047428d2
                                                0x047428d4
                                                0x047428d8
                                                0x047428db
                                                0x04785c26
                                                0x04785c28
                                                0x04785c2d
                                                0x04785c2d
                                                0x00000000
                                                0x00000000
                                                0x04785c34
                                                0x04785c36
                                                0x04785c49
                                                0x04785c4e
                                                0x04785c54
                                                0x04785c5b
                                                0x04785c5d
                                                0x04785c60
                                                0x04742788
                                                0x04742788
                                                0x0474278b
                                                0x0474278e
                                                0x0474278e
                                                0x0474278e
                                                0x04742791
                                                0x00000000
                                                0x00000000
                                                0x04742756
                                                0x04742750
                                                0x00000000
                                                0x04742794
                                                0x04742794
                                                0x04742795
                                                0x04742798
                                                0x04742798
                                                0x00000000
                                                0x04742734
                                                0x0474272c
                                                0x04742700
                                                0x047425ef
                                                0x047425ef
                                                0x047425ef
                                                0x047425f2
                                                0x047425f8
                                                0x00000000
                                                0x00000000
                                                0x047425fe
                                                0x00000000
                                                0x047428e6
                                                0x047428ec
                                                0x047428ef
                                                0x047428f5
                                                0x047428f8
                                                0x047428f8
                                                0x00000000
                                                0x047428f8
                                                0x00000000
                                                0x00000000
                                                0x04742866
                                                0x04742866
                                                0x04742876
                                                0x04742879
                                                0x00000000
                                                0x00000000
                                                0x047427e0
                                                0x047427e7
                                                0x047427e9
                                                0x047427eb
                                                0x04785afd
                                                0x00000000
                                                0x04785afd
                                                0x00000000
                                                0x00000000
                                                0x04742633
                                                0x04742638
                                                0x0474263b
                                                0x0474263c
                                                0x0474263e
                                                0x04742640
                                                0x04742642
                                                0x04742647
                                                0x04742649
                                                0x0474264e
                                                0x04742650
                                                0x04742653
                                                0x04742659
                                                0x047426a2
                                                0x047426a7
                                                0x047426ac
                                                0x047426b2
                                                0x04785b11
                                                0x04785b15
                                                0x04785b17
                                                0x00000000
                                                0x047426b8
                                                0x047426b8
                                                0x047426ba
                                                0x047427a6
                                                0x047427a6
                                                0x047427a9
                                                0x047427ab
                                                0x047427b9
                                                0x047427b9
                                                0x047427be
                                                0x047427c1
                                                0x047427c3
                                                0x047427c5
                                                0x047427c7
                                                0x04785c74
                                                0x04785c79
                                                0x04785c79
                                                0x047427c7
                                                0x00000000
                                                0x047426c0
                                                0x047426c0
                                                0x047426c3
                                                0x047426c6
                                                0x047426c6
                                                0x047426c9
                                                0x047426c9
                                                0x00000000
                                                0x047426c9
                                                0x047426ba
                                                0x0474265b
                                                0x0474265b
                                                0x0474265e
                                                0x04742667
                                                0x0474266d
                                                0x04742677
                                                0x0474267c
                                                0x0474267f
                                                0x04742681
                                                0x04785b49
                                                0x04785b4e
                                                0x047427cd
                                                0x047427d0
                                                0x047427d1
                                                0x047427d2
                                                0x047427d4
                                                0x047427dd
                                                0x04742687
                                                0x04742687
                                                0x0474268a
                                                0x0474268b
                                                0x0474268e
                                                0x0474268f
                                                0x04742691
                                                0x04742696
                                                0x04742698
                                                0x0474269d
                                                0x0474269f
                                                0x00000000
                                                0x0474269f
                                                0x04742681
                                                0x00000000
                                                0x00000000
                                                0x04742846
                                                0x00000000
                                                0x00000000
                                                0x04742605
                                                0x0474260a
                                                0x0474260c
                                                0x04742611
                                                0x04742616
                                                0x04742619
                                                0x04742619
                                                0x0474261e
                                                0x00000000
                                                0x04742624
                                                0x04742627
                                                0x04742627
                                                0x00000000
                                                0x00000000
                                                0x04785b1f
                                                0x00000000
                                                0x00000000
                                                0x04742894
                                                0x0474289b
                                                0x0474289d
                                                0x047428a1
                                                0x04785b2b
                                                0x04785b2e
                                                0x04785b2e
                                                0x047428a7
                                                0x047428a9
                                                0x04785b04
                                                0x04785b09
                                                0x04785b09
                                                0x04785b09
                                                0x00000000
                                                0x00000000
                                                0x04785b35
                                                0x04785b3c
                                                0x047428fb
                                                0x047428fb
                                                0x047426cc
                                                0x047426cc
                                                0x047426d0
                                                0x00000000
                                                0x047426d2
                                                0x047426d2
                                                0x00000000
                                                0x047426d2
                                                0x00000000
                                                0x00000000
                                                0x047425fe
                                                0x0474292d
                                                0x0474292f
                                                0x04742930
                                                0x04742935
                                                0x04742937
                                                0x04742939
                                                0x04742939
                                                0x0474293d
                                                0x0474293f
                                                0x04742945
                                                0x04742946
                                                0x04742946
                                                0x04742946
                                                0x04742946
                                                0x04742949
                                                0x04742949
                                                0x04742949
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: PATH
                                                • API String ID: 0-1036084923
                                                • Opcode ID: 4cbe6220ccb6a971615e9ca6ac267c0babb53fb0bc52e29941ef161836ad9135
                                                • Instruction ID: a4786ff900a5194f53a3e6bcdab68a8c897197a2fda9a85bc0dde6ab1ad661e4
                                                • Opcode Fuzzy Hash: 4cbe6220ccb6a971615e9ca6ac267c0babb53fb0bc52e29941ef161836ad9135
                                                • Instruction Fuzzy Hash: 3BC19C71E10219EBDB25DFA9D880ABDB7B5FF88784F048069F901AB351E734B951CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474FAB0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 80%
                                                			E0474FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0472EEF0(0x4807b60);
					_t134 =  *0x4807b84; // 0x776f7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4807b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4807b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04726D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E047276E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E047B8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0471B150();
													}
													_t116 = E047B6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E047275CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4808638; // 0x2acf1e0
																	_t122 = L047238A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E047276E2(_t154);
																			goto L41;
																		}
																	} else {
																		E047276E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0474FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L047270F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0474FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0474FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0474FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0474FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0474FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4807b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4807b84 = _t75;
						_t73 = E0472EB70(_t134, 0x4807b60);
						if( *0x4807b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0472FF60( *0x4807b20);
							}
						}
						goto L5;
					}
				}
			}

















































                                                0x0474fab0
                                                0x0474fab2
                                                0x0474fab3
                                                0x0474fab4
                                                0x0474fabc
                                                0x0474fac0
                                                0x0474fb14
                                                0x0474fb17
                                                0x0474fac2
                                                0x0474fac8
                                                0x0474facd
                                                0x0474fad3
                                                0x0474fad3
                                                0x0474fadd
                                                0x0474fb18
                                                0x0474fb1b
                                                0x0474fb1d
                                                0x0474fb1e
                                                0x0474fb1f
                                                0x0474fb20
                                                0x0474fb21
                                                0x0474fb22
                                                0x0474fb23
                                                0x0474fb24
                                                0x0474fb25
                                                0x0474fb26
                                                0x0474fb27
                                                0x0474fb28
                                                0x0474fb29
                                                0x0474fb2a
                                                0x0474fb2b
                                                0x0474fb2c
                                                0x0474fb2d
                                                0x0474fb2e
                                                0x0474fb2f
                                                0x0474fb3a
                                                0x0474fb3b
                                                0x0474fb3e
                                                0x0474fb41
                                                0x0474fb44
                                                0x0474fb47
                                                0x0474fb4a
                                                0x0474fb4d
                                                0x0474fb53
                                                0x0478bdcb
                                                0x0478bdcb
                                                0x0474fb59
                                                0x0474fb5b
                                                0x0474fb5b
                                                0x0474fb5e
                                                0x0478bdd5
                                                0x0478bdd8
                                                0x00000000
                                                0x0478bdda
                                                0x00000000
                                                0x0478bdda
                                                0x0474fb64
                                                0x0474fb64
                                                0x0474fb64
                                                0x0474fb67
                                                0x0474fb6e
                                                0x0474fb70
                                                0x0474fb72
                                                0x00000000
                                                0x0474fb78
                                                0x0474fb7a
                                                0x0474fb7a
                                                0x0474fb7d
                                                0x0474fb80
                                                0x0478bddf
                                                0x0478bde1
                                                0x00000000
                                                0x0478bde3
                                                0x00000000
                                                0x0478bde3
                                                0x0474fb86
                                                0x0474fb86
                                                0x0474fb86
                                                0x0474fb8b
                                                0x0474fb90
                                                0x0474fb92
                                                0x0474fb94
                                                0x0474fb9a
                                                0x0474fb9b
                                                0x0474fba1
                                                0x0478bde8
                                                0x0478bdeb
                                                0x0478bded
                                                0x0478beb5
                                                0x0478beb5
                                                0x0478bebb
                                                0x0478bebd
                                                0x0478bec3
                                                0x0478bed2
                                                0x0478bedd
                                                0x0478bedd
                                                0x0478beed
                                                0x00000000
                                                0x0478bdf3
                                                0x0478bdfe
                                                0x0478be06
                                                0x0478be0b
                                                0x0478be0d
                                                0x0478be0f
                                                0x0478be14
                                                0x0478be19
                                                0x0478be20
                                                0x0478be25
                                                0x0478be27
                                                0x0478be35
                                                0x0478be39
                                                0x0478be46
                                                0x0478be4f
                                                0x0478be54
                                                0x0478be56
                                                0x0478bef8
                                                0x0478bef8
                                                0x00000000
                                                0x0478be5c
                                                0x0478be5c
                                                0x0478be60
                                                0x00000000
                                                0x0478be66
                                                0x0478be66
                                                0x0478be7f
                                                0x0478be84
                                                0x0478be87
                                                0x0478be89
                                                0x0478be8b
                                                0x0478be99
                                                0x0478be9d
                                                0x0478bea0
                                                0x0478beac
                                                0x0478beaf
                                                0x0478beb1
                                                0x0478beb3
                                                0x0478beb3
                                                0x00000000
                                                0x0478bea2
                                                0x0478bea2
                                                0x00000000
                                                0x0478bea2
                                                0x0478be8d
                                                0x0478be8d
                                                0x0478be92
                                                0x00000000
                                                0x0478be92
                                                0x0478be8b
                                                0x0478be60
                                                0x0478be3b
                                                0x0478be3b
                                                0x0478be3e
                                                0x00000000
                                                0x0478be40
                                                0x0478be40
                                                0x0478be44
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0478be44
                                                0x0478be3e
                                                0x0478be29
                                                0x0478be29
                                                0x00000000
                                                0x0478be29
                                                0x0478be27
                                                0x00000000
                                                0x0474fba7
                                                0x0474fba7
                                                0x0474fbab
                                                0x0478bf02
                                                0x0474fbb1
                                                0x0474fbb1
                                                0x0474fbb8
                                                0x0474fbbd
                                                0x0474fbbd
                                                0x0474fbbf
                                                0x0474fbbf
                                                0x0474fbc5
                                                0x0474fbcb
                                                0x0474fbf8
                                                0x0474fbf8
                                                0x0474fbfa
                                                0x00000000
                                                0x0474fc00
                                                0x0474fc00
                                                0x0474fc03
                                                0x00000000
                                                0x0474fc09
                                                0x0474fc09
                                                0x0474fc0f
                                                0x0474fc15
                                                0x0474fc23
                                                0x0474fc23
                                                0x0474fc25
                                                0x0474fc27
                                                0x0474fc75
                                                0x0474fc7c
                                                0x0474fc84
                                                0x00000000
                                                0x0474fc29
                                                0x0474fc29
                                                0x0474fc2d
                                                0x0474fc30
                                                0x0478bf0f
                                                0x00000000
                                                0x0474fc36
                                                0x0474fc38
                                                0x0474fc3b
                                                0x0474fc41
                                                0x0478bf17
                                                0x0478bf19
                                                0x0478bf48
                                                0x0478bf4b
                                                0x00000000
                                                0x0478bf1b
                                                0x0478bf22
                                                0x0478bf24
                                                0x0478bf26
                                                0x00000000
                                                0x0478bf2c
                                                0x0478bf37
                                                0x0478bf39
                                                0x0478bf3b
                                                0x00000000
                                                0x0478bf41
                                                0x0478bf41
                                                0x0478bf41
                                                0x0478bf41
                                                0x0478bf45
                                                0x00000000
                                                0x0478bf45
                                                0x0478bf3b
                                                0x0478bf26
                                                0x00000000
                                                0x0474fc47
                                                0x0474fc47
                                                0x0474fc49
                                                0x0474fcb2
                                                0x0474fcb4
                                                0x0474fcb6
                                                0x0474fcdc
                                                0x0474fcdc
                                                0x00000000
                                                0x0474fcb8
                                                0x0474fcc3
                                                0x0474fcc5
                                                0x0474fcc7
                                                0x00000000
                                                0x0474fcc9
                                                0x0474fcc9
                                                0x0474fccd
                                                0x00000000
                                                0x0474fccd
                                                0x0474fcc7
                                                0x00000000
                                                0x0474fc4b
                                                0x0474fc4b
                                                0x0474fc4e
                                                0x0474fc4e
                                                0x0474fc51
                                                0x0474fc51
                                                0x0474fc54
                                                0x0474fc5a
                                                0x0474fc5c
                                                0x0474fc5f
                                                0x0474fc61
                                                0x0474fc63
                                                0x0474fc65
                                                0x0474fc67
                                                0x0474fc6e
                                                0x0474fc72
                                                0x0474fc72
                                                0x0474fc72
                                                0x0474fc72
                                                0x0474fc67
                                                0x0474fc61
                                                0x00000000
                                                0x0474fc5a
                                                0x0474fc49
                                                0x0474fc41
                                                0x0474fc30
                                                0x0474fc27
                                                0x0474fc03
                                                0x0474fbcd
                                                0x0474fbd3
                                                0x0474fbd9
                                                0x0474fbdc
                                                0x0474fbde
                                                0x0474fc99
                                                0x0474fc9b
                                                0x0474fc9d
                                                0x0474fcd5
                                                0x0474fcd5
                                                0x0474fc89
                                                0x0474fc89
                                                0x00000000
                                                0x0474fc9f
                                                0x0474fc9f
                                                0x0474fca3
                                                0x00000000
                                                0x0474fca3
                                                0x00000000
                                                0x0474fbe4
                                                0x0474fbe4
                                                0x0474fbe4
                                                0x0474fbe4
                                                0x0474fbe9
                                                0x0474fbf2
                                                0x00000000
                                                0x0474fbf2
                                                0x0474fbde
                                                0x0474fbcb
                                                0x0474fbab
                                                0x0474fc8b
                                                0x0474fc8b
                                                0x0474fc8c
                                                0x0474fb80
                                                0x0474fb72
                                                0x0474fb5e
                                                0x0474fc8d
                                                0x0474fc91
                                                0x0474fadf
                                                0x0474fadf
                                                0x0474fae1
                                                0x0474fae4
                                                0x0474fae7
                                                0x0474faec
                                                0x0474faf8
                                                0x0474fb00
                                                0x0474fb07
                                                0x0474fb0f
                                                0x0474fb0f
                                                0x0474fb07
                                                0x00000000
                                                0x0474faf8
                                                0x0474fadd

                                                Strings
                                                • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0478BE0F
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
                                                • API String ID: 0-865735534
                                                • Opcode ID: 47b2aea809574395053c453e027e8cee0507b45be5ac9651640359c5574e5d1b
                                                • Instruction ID: 1040a55f15d6786da94cd314b7956e154452f3f6721366b80e426bdb3492c34b
                                                • Opcode Fuzzy Hash: 47b2aea809574395053c453e027e8cee0507b45be5ac9651640359c5574e5d1b
                                                • Instruction Fuzzy Hash: 57A11431B006069FEB25EF79C454B7AB3A5AF88714F04456EE846DB780EB34F845CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04712D8A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 63%
                                                			E04712D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4805350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4807bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E047597C0();
				}
				if( *0x48079c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x48079c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04741624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04737D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E047AFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04759520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0474E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0476DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4806901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4806901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04759980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E047595D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04737D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04737D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E04797016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E047AFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4805350;
							if(_t109 != 0x4805350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E047AFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E047A5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}




































                                                0x04712d8a
                                                0x04712d8a
                                                0x04712d92
                                                0x04712d96
                                                0x04712d9e
                                                0x04712da0
                                                0x04712da3
                                                0x04712da5
                                                0x04712da8
                                                0x04712dab
                                                0x04712db2
                                                0x0476f9aa
                                                0x0476f9ab
                                                0x0476f9ae
                                                0x0476f9ae
                                                0x04712db8
                                                0x04712dc2
                                                0x0476f9b9
                                                0x0476f9be
                                                0x0476f9bf
                                                0x0476f9bf
                                                0x04712dcf
                                                0x0476f9c9
                                                0x04712dd5
                                                0x04712dd5
                                                0x04712dd5
                                                0x04712dde
                                                0x04712de1
                                                0x04712e70
                                                0x04712e72
                                                0x04712e72
                                                0x04712de7
                                                0x04712deb
                                                0x04712e7c
                                                0x04712e83
                                                0x04712e85
                                                0x04712e8b
                                                0x04712e8d
                                                0x04712e92
                                                0x04712e92
                                                0x04712e85
                                                0x04712df1
                                                0x04712df7
                                                0x04712df9
                                                0x04712df9
                                                0x04712dfc
                                                0x04712dff
                                                0x04712e02
                                                0x00000000
                                                0x04712e05
                                                0x04712e0c
                                                0x0476f9d9
                                                0x04712e12
                                                0x04712e12
                                                0x04712e12
                                                0x04712e1a
                                                0x0476f9e3
                                                0x0476f9e9
                                                0x0476f9f0
                                                0x0476f9f6
                                                0x0476f9f8
                                                0x0476f9f8
                                                0x0476f9f0
                                                0x04712e23
                                                0x0476fa02
                                                0x0476fa03
                                                0x0476fa05
                                                0x0476fa06
                                                0x00000000
                                                0x04712e29
                                                0x04712e29
                                                0x04712e2e
                                                0x04712e34
                                                0x04712e3e
                                                0x00000000
                                                0x00000000
                                                0x04712e44
                                                0x04712e47
                                                0x04712e4d
                                                0x00000000
                                                0x00000000
                                                0x04712e4f
                                                0x04712e54
                                                0x00000000
                                                0x00000000
                                                0x04712e5a
                                                0x04712e5f
                                                0x04712e9a
                                                0x04712ea4
                                                0x04712ea5
                                                0x04712ea8
                                                0x04712eaf
                                                0x04712eb2
                                                0x04712eb5
                                                0x0476fae9
                                                0x0476faeb
                                                0x0476faed
                                                0x0476faef
                                                0x0476faf7
                                                0x0476faf8
                                                0x0476fafd
                                                0x0476faff
                                                0x0476fb04
                                                0x0476fb04
                                                0x0476faff
                                                0x04712ec0
                                                0x04712ec4
                                                0x04712ec6
                                                0x04712ec8
                                                0x0476fb14
                                                0x0476fb18
                                                0x0476fb1e
                                                0x0476fb21
                                                0x0476fb21
                                                0x04712ece
                                                0x04712ece
                                                0x04712ece
                                                0x04712ed7
                                                0x04712e61
                                                0x04712e63
                                                0x0476fa6b
                                                0x0476fa71
                                                0x0476fa76
                                                0x0476fa78
                                                0x0476fa8a
                                                0x0476fa7a
                                                0x0476fa83
                                                0x0476fa83
                                                0x0476fa8f
                                                0x0476fa91
                                                0x0476fa97
                                                0x0476fa9d
                                                0x0476faa4
                                                0x0476faaa
                                                0x0476faaf
                                                0x0476fab1
                                                0x0476fac3
                                                0x0476fab3
                                                0x0476fabc
                                                0x0476fabc
                                                0x0476fac8
                                                0x0476facb
                                                0x0476fadf
                                                0x0476fadf
                                                0x0476facb
                                                0x0476faa4
                                                0x0476fa91
                                                0x04712e6f
                                                0x04712e6f
                                                0x04712e5f
                                                0x0476fa13
                                                0x0476fa15
                                                0x0476fa17
                                                0x0476fa1f
                                                0x0476fa21
                                                0x0476fa22
                                                0x0476fa25
                                                0x0476fa28
                                                0x0476fa2f
                                                0x0476fa2f
                                                0x0476fa2a
                                                0x0476fa2a
                                                0x0476fa2a
                                                0x0476fa31
                                                0x0476fa34
                                                0x0476fa36
                                                0x0476fa3c
                                                0x0476fa3e
                                                0x0476fa41
                                                0x0476fa43
                                                0x0476fa45
                                                0x0476fa45
                                                0x0476fa41
                                                0x0476fa3c
                                                0x0476fa4a
                                                0x0476fa4f
                                                0x0476fa51
                                                0x0476fa53
                                                0x0476fa56
                                                0x0476fa5b
                                                0x0476fa5e
                                                0x00000000
                                                0x0476fa5e
                                                0x04712e23

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: RTL: Re-Waiting
                                                • API String ID: 0-316354757
                                                • Opcode ID: 2a6701b3f8c0091d67914d4b7de2704a4f955323e7a4bb58d9ad09b0d9fb4c88
                                                • Instruction ID: be496c16e33f0088d740dc86ac2d936905c90c1877ae9254ef8774272185ca9a
                                                • Opcode Fuzzy Hash: 2a6701b3f8c0091d67914d4b7de2704a4f955323e7a4bb58d9ad09b0d9fb4c88
                                                • Instruction Fuzzy Hash: 53614770B00644AFEB31DF7CD888B7E77A6EB41328F1406A9D852A73E1D734B9458791
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E0EA5 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 80%
                                                			E047E0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E047DFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E047E1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04759730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E047DA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E047DA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4808b04 >> 0x14) + (_v44 -  *0x4808b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04737D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E047D138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04737D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E047CFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4808724 & 0x00000008) != 0) {
						E047D52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E047E15B5(0x4808ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}
























                                                0x047e0eb7
                                                0x047e0eb9
                                                0x047e0ec0
                                                0x047e0ec2
                                                0x047e0ecd
                                                0x047e105b
                                                0x047e105b
                                                0x047e1061
                                                0x047e1066
                                                0x047e1066
                                                0x047e106b
                                                0x047e1073
                                                0x047e1073
                                                0x047e0ed3
                                                0x047e0ed6
                                                0x047e0edc
                                                0x047e0ee0
                                                0x047e0ee7
                                                0x047e0ef0
                                                0x047e0ef5
                                                0x047e0efa
                                                0x047e0efc
                                                0x047e0efd
                                                0x047e0f03
                                                0x047e0f04
                                                0x047e0f06
                                                0x047e0f07
                                                0x047e0f09
                                                0x047e0f0e
                                                0x047e0f14
                                                0x047e0f23
                                                0x047e0f2d
                                                0x047e0f34
                                                0x047e0f34
                                                0x047e0f14
                                                0x047e0f52
                                                0x00000000
                                                0x00000000
                                                0x047e0f58
                                                0x047e0f73
                                                0x047e0f74
                                                0x047e0f79
                                                0x047e0f7d
                                                0x047e0f80
                                                0x047e0f86
                                                0x047e0fab
                                                0x047e0fb5
                                                0x047e0fc6
                                                0x047e0fd1
                                                0x047e0fe3
                                                0x047e0fd3
                                                0x047e0fdc
                                                0x047e0fdc
                                                0x047e0feb
                                                0x047e1009
                                                0x047e1009
                                                0x047e1015
                                                0x047e1027
                                                0x047e1017
                                                0x047e1020
                                                0x047e1020
                                                0x047e102f
                                                0x047e103c
                                                0x047e103c
                                                0x047e1048
                                                0x047e1050
                                                0x047e1050
                                                0x047e1055
                                                0x00000000
                                                0x047e1055
                                                0x047e0f88
                                                0x047e0f9e
                                                0x047e0fa2
                                                0x047e0fa9
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e0fa9
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: `
                                                • API String ID: 0-2679148245
                                                • Opcode ID: 5795adafe0bf7d234416cf61ce923d1b423d04be5a19e04e325b06566e8eea63
                                                • Instruction ID: 44ee2d57f2d11b72cce04a7304c9a0b59617d42c23adde3cf059c0ed2cd3fc9a
                                                • Opcode Fuzzy Hash: 5795adafe0bf7d234416cf61ce923d1b423d04be5a19e04e325b06566e8eea63
                                                • Instruction Fuzzy Hash: 2D51AC712043819FE325DF2AD885B2BB7E5EBC8318F444A2DF98697391D670F845CB62
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474F0BF Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 75%
                                                			E0474F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04734120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04759830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04759990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E047595D0();
							goto L11;
						} else {
							_t109 = L04734620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E0475F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E047595D0();
										L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

























                                                0x0474f0d3
                                                0x0474f0d9
                                                0x0474f0e0
                                                0x0474f0e7
                                                0x0474f0f2
                                                0x0474f0f4
                                                0x0474f0f8
                                                0x0474f100
                                                0x0474f108
                                                0x0474f10d
                                                0x0474f115
                                                0x0474f116
                                                0x0474f11f
                                                0x0474f123
                                                0x0474f124
                                                0x0474f12c
                                                0x0474f130
                                                0x0474f134
                                                0x0474f13d
                                                0x0474f144
                                                0x0474f14b
                                                0x0474f152
                                                0x0478bab0
                                                0x0478bab0
                                                0x0474f158
                                                0x0474f158
                                                0x0474f15a
                                                0x0474f160
                                                0x0474f165
                                                0x0474f166
                                                0x0474f16f
                                                0x0474f173
                                                0x0478baa7
                                                0x0478baa7
                                                0x0478baab
                                                0x00000000
                                                0x0474f179
                                                0x0474f18d
                                                0x0474f191
                                                0x0478baa2
                                                0x00000000
                                                0x0474f197
                                                0x0474f19b
                                                0x0474f1a2
                                                0x0474f1a9
                                                0x0474f1af
                                                0x0474f1b2
                                                0x0474f1b6
                                                0x0474f1b9
                                                0x0474f1c4
                                                0x0474f1d8
                                                0x0474f1df
                                                0x0474f1e3
                                                0x0474f1eb
                                                0x0474f1ee
                                                0x0474f1f4
                                                0x0474f20f
                                                0x0478bab7
                                                0x0478babb
                                                0x0478bacc
                                                0x0478bad1
                                                0x0474f215
                                                0x0474f218
                                                0x0474f226
                                                0x0474f22b
                                                0x00000000
                                                0x0474f22b
                                                0x0474f1f6
                                                0x0474f1f6
                                                0x0474f1f9
                                                0x0474f1fb
                                                0x0474f1fb
                                                0x0474f1f4
                                                0x0474f191
                                                0x0474f173
                                                0x0474f152
                                                0x0474f203

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                                • Instruction ID: 06fc5a532c711b77737c0d57869ef81c638f9396c032d6dc4f1feac484fd2e59
                                                • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                                • Instruction Fuzzy Hash: 9A513AB16047149FD321DF19C840A6BBBE8FF88714F00892DFA95977A0E7B4E954CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04793540 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 75%
                                                			E04793540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x480d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04750BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E04793706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0475FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E04793540;
						E0475FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0476DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E047A0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E047597C0();
					}
					return E0475B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E04793971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E04793884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0475FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04759650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E04793787(_a4,  &_v352, _t80);
						}
					}
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E047595D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}































                                                0x04793552
                                                0x0479355a
                                                0x0479355d
                                                0x04793566
                                                0x04793567
                                                0x0479357e
                                                0x0479358f
                                                0x047935a1
                                                0x047935a5
                                                0x0479366b
                                                0x0479366b
                                                0x0479366d
                                                0x04793672
                                                0x04793679
                                                0x04793685
                                                0x0479368d
                                                0x0479369d
                                                0x047936a7
                                                0x047936b8
                                                0x047936c6
                                                0x047936c7
                                                0x047936dc
                                                0x047936e1
                                                0x047936e7
                                                0x047936e9
                                                0x047936e9
                                                0x04793703
                                                0x04793703
                                                0x047935b5
                                                0x047935c0
                                                0x047935c4
                                                0x00000000
                                                0x00000000
                                                0x047935ca
                                                0x047935d7
                                                0x047935e2
                                                0x047935e6
                                                0x047935e8
                                                0x047935f5
                                                0x047935fa
                                                0x04793603
                                                0x04793604
                                                0x04793609
                                                0x0479360a
                                                0x04793612
                                                0x04793613
                                                0x0479361e
                                                0x04793622
                                                0x04793628
                                                0x0479362f
                                                0x0479362f
                                                0x04793636
                                                0x04793638
                                                0x0479363b
                                                0x04793642
                                                0x04793642
                                                0x04793636
                                                0x04793657
                                                0x04793657
                                                0x0479365c
                                                0x04793662
                                                0x04793669
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: BinaryHash
                                                • API String ID: 0-2202222882
                                                • Opcode ID: 6a902faa0e166a28769fdd20c40cf1d0009381b94aec6fc3744b63ce617a80cf
                                                • Instruction ID: eaa2b55e2c3a037e6df0013913f592d334641f871160da76c8efd8c14aaa78f2
                                                • Opcode Fuzzy Hash: 6a902faa0e166a28769fdd20c40cf1d0009381b94aec6fc3744b63ce617a80cf
                                                • Instruction Fuzzy Hash: 454105F1D0152C9BEF21DA50DC85F9EB77CAB44718F0045A5EA09AB350DB70AE888F95
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E05AC Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 71%
                                                			E047E05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E047E07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E04759730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E047DA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E047DA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E047E1293(_t79, _v40, E047E07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E04737D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E047D138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

















                                                0x047e05c5
                                                0x047e05ca
                                                0x047e05d3
                                                0x047e06db
                                                0x047e06db
                                                0x047e06dd
                                                0x047e06e3
                                                0x047e06e3
                                                0x047e05dd
                                                0x047e05e7
                                                0x047e05f6
                                                0x047e0600
                                                0x047e0607
                                                0x047e0610
                                                0x047e0615
                                                0x047e061a
                                                0x047e061c
                                                0x047e061e
                                                0x047e0624
                                                0x047e0625
                                                0x047e0627
                                                0x047e0628
                                                0x047e0631
                                                0x047e0640
                                                0x047e064d
                                                0x047e0654
                                                0x047e0654
                                                0x047e0631
                                                0x047e066d
                                                0x047e0674
                                                0x00000000
                                                0x00000000
                                                0x047e0692
                                                0x047e069e
                                                0x047e06b0
                                                0x047e06a0
                                                0x047e06a9
                                                0x047e06a9
                                                0x047e06b8
                                                0x047e06d6
                                                0x047e06d6
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: `
                                                • API String ID: 0-2679148245
                                                • Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                                • Instruction ID: b0ad7090a202b39d2a1f6c7cbf756f114d8a78458911355485a544ad08adbe53
                                                • Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                                • Instruction Fuzzy Hash: D631E272200395ABE720DE26CD45FA677D9EB88758F044229F954AB380D7B0F914CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04793884 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 72%
                                                			E04793884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04759650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04734620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04759650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}















                                                0x04793893
                                                0x04793896
                                                0x04793899
                                                0x0479389f
                                                0x047938a0
                                                0x047938a4
                                                0x047938a9
                                                0x047938ac
                                                0x047938ad
                                                0x047938ae
                                                0x047938af
                                                0x047938b1
                                                0x047938b4
                                                0x047938bb
                                                0x047938bc
                                                0x047938bd
                                                0x047938c4
                                                0x047938c8
                                                0x047938ca
                                                0x047938ca
                                                0x047938d5
                                                0x0479393e
                                                0x04793940
                                                0x04793942
                                                0x04793952
                                                0x04793954
                                                0x04793961
                                                0x04793961
                                                0x04793967
                                                0x0479396e
                                                0x0479396e
                                                0x04793947
                                                0x0479394c
                                                0x00000000
                                                0x0479394c
                                                0x047938ea
                                                0x047938ee
                                                0x047938f8
                                                0x047938f9
                                                0x047938ff
                                                0x04793900
                                                0x04793902
                                                0x04793903
                                                0x0479390b
                                                0x0479390f
                                                0x04793950
                                                0x00000000
                                                0x04793950
                                                0x04793915
                                                0x0479391d
                                                0x0479391d
                                                0x04793922
                                                0x04793926
                                                0x00000000
                                                0x04793928
                                                0x0479392b
                                                0x0479392b
                                                0x04793935
                                                0x04793937
                                                0x04793937
                                                0x00000000
                                                0x04793935
                                                0x04793926
                                                0x047938f0
                                                0x00000000

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: BinaryName
                                                • API String ID: 0-215506332
                                                • Opcode ID: 83f91217b141cb853d058c133e84b5e819b076385825df985e56b9040e7c1eca
                                                • Instruction ID: b204d7900e4549ec59e6728b72ab53b59dcf8d62c21994d4479424ec6692b640
                                                • Opcode Fuzzy Hash: 83f91217b141cb853d058c133e84b5e819b076385825df985e56b9040e7c1eca
                                                • Instruction Fuzzy Hash: DD31E072900519AFEF25DE59D945E7BB7B4EB88B28F01412DED04A7750D730BE00C7A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474D294 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 33%
                                                			E0474D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x480d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04734120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0475B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E047598D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E047595D0();
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

































                                                0x0474d29c
                                                0x0474d2a6
                                                0x0474d2b1
                                                0x0474d2b5
                                                0x0474d2b6
                                                0x0474d2bc
                                                0x0474d2bd
                                                0x0474d2be
                                                0x0474d2bf
                                                0x0474d2c2
                                                0x0474d2c4
                                                0x0474d2cc
                                                0x0474d384
                                                0x0474d34b
                                                0x0474d34f
                                                0x0474d350
                                                0x0474d351
                                                0x0474d35c
                                                0x0474d35c
                                                0x0474d2d6
                                                0x0474d2da
                                                0x0474d2e1
                                                0x0474d361
                                                0x0474d369
                                                0x0474d36d
                                                0x0474d2e3
                                                0x0474d2e3
                                                0x0474d2e3
                                                0x0474d2e5
                                                0x0474d2ed
                                                0x0474d2f5
                                                0x0474d2fa
                                                0x0474d302
                                                0x0474d303
                                                0x0474d30b
                                                0x0474d30f
                                                0x0474d313
                                                0x0474d318
                                                0x0474d31c
                                                0x0474d320
                                                0x0474d379
                                                0x0474d37d
                                                0x00000000
                                                0x00000000
                                                0x0478affe
                                                0x0478b001
                                                0x0478b011
                                                0x00000000
                                                0x0474d322
                                                0x0474d322
                                                0x0474d330
                                                0x0474d337
                                                0x0474d35d
                                                0x0474d339
                                                0x0474d33f
                                                0x0474d38c
                                                0x0474d38c
                                                0x0474d33f
                                                0x0474d349
                                                0x00000000
                                                0x0474d349

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @
                                                • API String ID: 0-2766056989
                                                • Opcode ID: 7cb35047e82e453edfa375315120fc4d9fa6f215c2787c442a246ccae11d965e
                                                • Instruction ID: 764d7787173bdca07393394c1c42bd94285d4de70d4325ffddd636a2927c21d1
                                                • Opcode Fuzzy Hash: 7cb35047e82e453edfa375315120fc4d9fa6f215c2787c442a246ccae11d965e
                                                • Instruction Fuzzy Hash: 10315AB1648305DFD321DF29898496BBBE8EBC5754F00092EF99493350E738ED04DB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04721B8F Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 72%
                                                			E04721B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0475BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0475A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0475A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04734620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}









                                                0x04721b8f
                                                0x04721b9a
                                                0x04721b9c
                                                0x04721b9e
                                                0x04721ba3
                                                0x04777010
                                                0x04777010
                                                0x00000000
                                                0x04721ba9
                                                0x04721ba9
                                                0x04721bae
                                                0x00000000
                                                0x04721bc5
                                                0x04721bca
                                                0x04721bcf
                                                0x04721bd0
                                                0x04721bd1
                                                0x04721bd2
                                                0x04721bd6
                                                0x04721bdc
                                                0x04721be0
                                                0x04776ffc
                                                0x04777000
                                                0x00000000
                                                0x04777006
                                                0x04777009
                                                0x04777009
                                                0x04721be6
                                                0x04721bec
                                                0x04721c0b
                                                0x04721c0b
                                                0x04721c0c
                                                0x04721c11
                                                0x04721c12
                                                0x04721c15
                                                0x04721c1b
                                                0x04721c1f
                                                0x04721c31
                                                0x04721c33
                                                0x04777026
                                                0x04777026
                                                0x04721c21
                                                0x04721c24
                                                0x04721c24
                                                0x04721bee
                                                0x04721bee
                                                0x04721bf2
                                                0x04721c3a
                                                0x04721bf4
                                                0x04721bf4
                                                0x04721c05
                                                0x04721c05
                                                0x04721c09
                                                0x04721c3e
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04721c09
                                                0x04721bec
                                                0x04721be0
                                                0x04721bae
                                                0x04721c2e

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: WindowsExcludedProcs
                                                • API String ID: 0-3583428290
                                                • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                                • Instruction ID: b01e6265709f2ced11f7d4f5266dae6f5d5ccc7686b044e0180317d7505238e5
                                                • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                                • Instruction Fuzzy Hash: CE21D07AA01238ABDB219E968A44F6FB7ADFB40B50F554865BD048B300E630FD44E7A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473F716 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0473F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}











                                                0x0473f71d
                                                0x0473f722
                                                0x0473f726
                                                0x04784770
                                                0x0473f765
                                                0x0473f769
                                                0x0473f769
                                                0x0473f732
                                                0x0478477a
                                                0x00000000
                                                0x0478477a
                                                0x0473f738
                                                0x0473f73a
                                                0x0473f73c
                                                0x0473f73f
                                                0x0473f746
                                                0x0473f778
                                                0x0473f7a9
                                                0x0473f7a9
                                                0x0473f754
                                                0x0473f75a
                                                0x0473f75d
                                                0x0473f75f
                                                0x0473f761
                                                0x0473f76f
                                                0x0473f771
                                                0x0473f771
                                                0x0473f76f
                                                0x0473f763
                                                0x00000000
                                                0x0473f763
                                                0x0473f77d
                                                0x0473f7a3
                                                0x0473f7a5
                                                0x00000000
                                                0x0473f7a5
                                                0x0473f77f
                                                0x0473f782
                                                0x0473f784
                                                0x0473f786
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473f788
                                                0x0473f748
                                                0x0473f74d
                                                0x0473f78d
                                                0x0473f793
                                                0x0473f7b7
                                                0x0473f7bc
                                                0x00000000
                                                0x0473f7bc
                                                0x0473f798
                                                0x00000000
                                                0x00000000
                                                0x0473f79d
                                                0x0473f7b0
                                                0x00000000
                                                0x0473f7b0
                                                0x0473f79f
                                                0x00000000
                                                0x0473f74f
                                                0x0473f74f
                                                0x00000000
                                                0x0473f74f

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Actx
                                                • API String ID: 0-89312691
                                                • Opcode ID: e331e0045ff12aaf9d16107175bad99e98361b27de697b3d30923f0a564eda91
                                                • Instruction ID: 91c06f2a430ca9cde97c3fd16c49c0e44f52b4bd3af900f6924a083be48eac5d
                                                • Opcode Fuzzy Hash: e331e0045ff12aaf9d16107175bad99e98361b27de697b3d30923f0a564eda91
                                                • Instruction Fuzzy Hash: 0411B675F047028BEB244E1E8490736729DAB957E6FA4453AE465CB393F770F8418340
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047C8DF1 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 71%
                                                			E047C8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x47f0d50);
				E0476D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E047A5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0476DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0476DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0476D130(_t34, _t39, _t40);
			}





                                                0x047c8df1
                                                0x047c8df1
                                                0x047c8df1
                                                0x047c8df1
                                                0x047c8df1
                                                0x047c8df1
                                                0x047c8df3
                                                0x047c8df8
                                                0x047c8dfd
                                                0x047c8e00
                                                0x047c8e0e
                                                0x047c8e2a
                                                0x047c8e36
                                                0x047c8e38
                                                0x047c8e3c
                                                0x047c8e46
                                                0x047c8e46
                                                0x047c8e36
                                                0x047c8e50
                                                0x047c8e56
                                                0x047c8e59
                                                0x047c8e5c
                                                0x047c8e60
                                                0x047c8e67
                                                0x047c8e6d
                                                0x047c8e73
                                                0x047c8e74
                                                0x047c8eb1
                                                0x047c8ebd

                                                Strings
                                                • Critical error detected %lx, xrefs: 047C8E21
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Critical error detected %lx
                                                • API String ID: 0-802127002
                                                • Opcode ID: 2afba09e0635814bb715d5a24008dd8185a3fb077584ce1690b49dbbeaeca683
                                                • Instruction ID: 15db0c03b13ed2c4c081468006a7693bb3d6e66a24cb99fd784c6fa626bb1430
                                                • Opcode Fuzzy Hash: 2afba09e0635814bb715d5a24008dd8185a3fb077584ce1690b49dbbeaeca683
                                                • Instruction Fuzzy Hash: 331179B1E10348DBEB24DFB589097ECBBB1AB04315F24421DD4296B382D3742601CF15
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047AFF10 Relevance: 1.3, Strings: 1, Instructions: 44COMMON
                                                Download Yara Rule
                                                Strings
                                                • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 047AFF60
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                                • API String ID: 0-1911121157
                                                • Opcode ID: 726b1df27fa1d6726bb1db6083a44f18478b292e13a780812149f73875f1a8fd
                                                • Instruction ID: 177ad566272588d97ca0e3c898f7e51daaeb165126c6b9d81b34c7f507e290a3
                                                • Opcode Fuzzy Hash: 726b1df27fa1d6726bb1db6083a44f18478b292e13a780812149f73875f1a8fd
                                                • Instruction Fuzzy Hash: 9311EDB1A20144EFEB22EB50CC48F98B7B2FB48718F158544E5096B3A1C778B990CB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471F900 Relevance: .9, Instructions: 863COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 99%
                                                			E0471F900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}








































































































                                                0x0471f90b
                                                0x0471f911
                                                0x0471f917
                                                0x0471f919
                                                0x0471f91c
                                                0x04775d63
                                                0x04775d69
                                                0x04775d69
                                                0x04775d63
                                                0x0471f922
                                                0x0471f927
                                                0x04775d72
                                                0x04775d78
                                                0x04775d78
                                                0x04775d72
                                                0x0471f92d
                                                0x0471f931
                                                0x0471fa2d
                                                0x0471fa2d
                                                0x0471f939
                                                0x0471f940
                                                0x0471f944
                                                0x0471fa37
                                                0x0471fa39
                                                0x0471fa3c
                                                0x0471fa3e
                                                0x0471fa41
                                                0x0471fa48
                                                0x0471fe68
                                                0x0471fe6c
                                                0x0471fe6c
                                                0x0471fe78
                                                0x0471fe78
                                                0x0471fe7a
                                                0x0471fe7a
                                                0x0471fe7e
                                                0x0471fe6e
                                                0x0471fe6e
                                                0x0471fe72
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0471fe80
                                                0x0471fe80
                                                0x0471fe83
                                                0x00000000
                                                0x0471fe83
                                                0x04775d7f
                                                0x04775d81
                                                0x00000000
                                                0x00000000
                                                0x04775d87
                                                0x00000000
                                                0x04775d87
                                                0x0471fa4e
                                                0x0471fa50
                                                0x04775d90
                                                0x00000000
                                                0x00000000
                                                0x04775d98
                                                0x0471fa58
                                                0x0471fa58
                                                0x0471fa5d
                                                0x0471fa60
                                                0x0471fa63
                                                0x0471fa69
                                                0x0471fa6b
                                                0x0471fa6e
                                                0x0471fa71
                                                0x04775da1
                                                0x04775da7
                                                0x04775da7
                                                0x04775da1
                                                0x0471fa79
                                                0x04720071
                                                0x04720073
                                                0x04720074
                                                0x00000000
                                                0x0471fa7f
                                                0x0471fa83
                                                0x0471fa85
                                                0x04775dae
                                                0x04775dae
                                                0x0471fa8b
                                                0x0471fa8f
                                                0x0471fa98
                                                0x0471faa1
                                                0x0471faa4
                                                0x0471faa6
                                                0x0471faa9
                                                0x0471faac
                                                0x04775db7
                                                0x04775dbd
                                                0x04775dbd
                                                0x04775db7
                                                0x0471fab4
                                                0x00000000
                                                0x0471faba
                                                0x0471fabc
                                                0x0471fac2
                                                0x0471fac5
                                                0x0471fac7
                                                0x0471fac7
                                                0x0471fad6
                                                0x0471fad9
                                                0x0471fadf
                                                0x0471fae2
                                                0x0471fae4
                                                0x0471fae7
                                                0x0471faea
                                                0x0471faed
                                                0x04775dc4
                                                0x04775dc9
                                                0x00000000
                                                0x00000000
                                                0x04775dcf
                                                0x0471faf6
                                                0x0471fafa
                                                0x0471fafc
                                                0x0471fafc
                                                0x0471fafe
                                                0x0471fb01
                                                0x0471fb09
                                                0x0471fb0c
                                                0x0471fb12
                                                0x0471fb14
                                                0x0471fb17
                                                0x04775dd6
                                                0x04775dd9
                                                0x04775dde
                                                0x00000000
                                                0x00000000
                                                0x04775de4
                                                0x04775de7
                                                0x0471fb29
                                                0x0471fb2c
                                                0x04775df3
                                                0x04775df6
                                                0x04775e06
                                                0x04775e0c
                                                0x04775e0f
                                                0x04775e11
                                                0x00000000
                                                0x04775e1f
                                                0x00000000
                                                0x04775e1f
                                                0x04775e11
                                                0x04775df8
                                                0x04775dfb
                                                0x04775e00
                                                0x00000000
                                                0x00000000
                                                0x04775e02
                                                0x00000000
                                                0x04775e02
                                                0x0471fb32
                                                0x0471fb35
                                                0x0471fb3c
                                                0x04775e26
                                                0x04775e28
                                                0x04775e28
                                                0x04775e2e
                                                0x04775e3c
                                                0x04775e3c
                                                0x04775e2e
                                                0x0471fb45
                                                0x0471fb47
                                                0x0471fb53
                                                0x0471fb56
                                                0x0471fb59
                                                0x0471fb5c
                                                0x0471fb65
                                                0x0472000d
                                                0x00000000
                                                0x0472000f
                                                0x0472000f
                                                0x00000000
                                                0x0472000f
                                                0x0471fb6b
                                                0x0471fb6e
                                                0x0471fb71
                                                0x0471fb73
                                                0x0471fb76
                                                0x04775e45
                                                0x04775e4b
                                                0x04775e4b
                                                0x04775e45
                                                0x0471fb80
                                                0x0471fb83
                                                0x04775e54
                                                0x04775e5a
                                                0x04775e5a
                                                0x04775e54
                                                0x0471fb89
                                                0x0471fb98
                                                0x0471fb9b
                                                0x0471fb9e
                                                0x0471fba0
                                                0x04775e63
                                                0x04775e69
                                                0x04775e69
                                                0x04775e63
                                                0x0471fba8
                                                0x00000000
                                                0x0471fbae
                                                0x0471fbb2
                                                0x04775e70
                                                0x0471fbb8
                                                0x0471fbb8
                                                0x0471fbb8
                                                0x0471fbbd
                                                0x0471fbbf
                                                0x0471fbbf
                                                0x0471f9a8
                                                0x0471f9a8
                                                0x0471f9ad
                                                0x0471f9b4
                                                0x04775eda
                                                0x00000000
                                                0x00000000
                                                0x04775ee2
                                                0x0471f9bc
                                                0x0471f9bc
                                                0x0471f9bf
                                                0x0471f9c4
                                                0x0471fde6
                                                0x0471fde9
                                                0x0471fdec
                                                0x0471fdef
                                                0x0471fdf2
                                                0x04775eeb
                                                0x04775ef1
                                                0x04775ef1
                                                0x04775eeb
                                                0x0471fdfa
                                                0x00000000
                                                0x0471fe00
                                                0x0471fe04
                                                0x04775efa
                                                0x04775f00
                                                0x04775f00
                                                0x04775efa
                                                0x0471fe0a
                                                0x0471fa24
                                                0x0471fa2a
                                                0x0471fa2a
                                                0x0471fdfa
                                                0x0471f9cd
                                                0x00000000
                                                0x0471f9cf
                                                0x0471f9cf
                                                0x0471f9d1
                                                0x0471f9d4
                                                0x0471f9d7
                                                0x0471f9d9
                                                0x0471f9dc
                                                0x0471f9df
                                                0x0471f9e2
                                                0x0471f9e7
                                                0x04775f09
                                                0x00000000
                                                0x00000000
                                                0x04775f11
                                                0x0471f9ef
                                                0x0471f9f3
                                                0x0471fed5
                                                0x0471fed8
                                                0x0471fedb
                                                0x04775f1a
                                                0x04775f20
                                                0x04775f20
                                                0x04775f1a
                                                0x0471fee3
                                                0x00000000
                                                0x0471fee9
                                                0x0471feeb
                                                0x04775f29
                                                0x04775f2f
                                                0x04775f2f
                                                0x04775f29
                                                0x0471fef3
                                                0x00000000
                                                0x0471fef9
                                                0x0471fefc
                                                0x0471ff01
                                                0x04775f38
                                                0x04720052
                                                0x04720054
                                                0x00000000
                                                0x04720056
                                                0x04720056
                                                0x0471ff40
                                                0x0471ff42
                                                0x04775f6e
                                                0x04775f74
                                                0x04775f74
                                                0x04775f6e
                                                0x0471ff50
                                                0x0471ff56
                                                0x0471ff5b
                                                0x04775f7d
                                                0x00000000
                                                0x00000000
                                                0x04775f83
                                                0x00000000
                                                0x0471ff61
                                                0x0471ff61
                                                0x0471ff63
                                                0x04720021
                                                0x04720026
                                                0x0472002b
                                                0x0472007e
                                                0x04720080
                                                0x04720080
                                                0x0472007e
                                                0x0472002f
                                                0x00000000
                                                0x04720031
                                                0x04720033
                                                0x04720086
                                                0x04720035
                                                0x04720035
                                                0x04720035
                                                0x0472003c
                                                0x00000000
                                                0x0472003c
                                                0x0472002f
                                                0x0471ff69
                                                0x0471ff6b
                                                0x04775f8c
                                                0x04775f92
                                                0x04775f92
                                                0x04775f8c
                                                0x0471ff74
                                                0x0471ff77
                                                0x0471ff7b
                                                0x04775f99
                                                0x04775f9b
                                                0x0471ff81
                                                0x0471ff81
                                                0x0471ff83
                                                0x0471ff83
                                                0x0471ff88
                                                0x0471ff8b
                                                0x0471ff90
                                                0x0471ff92
                                                0x0471ff92
                                                0x0471ff9c
                                                0x0471ffa2
                                                0x0471ffa6
                                                0x0471ffaa
                                                0x0471ffad
                                                0x0471ffb2
                                                0x04775fa4
                                                0x04775faa
                                                0x04775faa
                                                0x04775fa4
                                                0x0471ffb8
                                                0x00000000
                                                0x0471ffb8
                                                0x0471ff5b
                                                0x04720054
                                                0x04775f3e
                                                0x04775f3e
                                                0x0471ff09
                                                0x00000000
                                                0x00000000
                                                0x0471ff0f
                                                0x0471ff14
                                                0x04775f47
                                                0x04775f4d
                                                0x04775f4d
                                                0x04775f47
                                                0x0471ff1c
                                                0x04720046
                                                0x04720076
                                                0x04720078
                                                0x00000000
                                                0x04720048
                                                0x04720048
                                                0x0472004a
                                                0x0472004a
                                                0x00000000
                                                0x0472004a
                                                0x0471ff22
                                                0x0471ff22
                                                0x0471ff26
                                                0x04775f56
                                                0x04775f5c
                                                0x04775f5c
                                                0x04775f56
                                                0x0471ff2e
                                                0x00000000
                                                0x0471ff34
                                                0x0471ff36
                                                0x04775f65
                                                0x0471ff3c
                                                0x0471ff3c
                                                0x0471ff3c
                                                0x0471ff3e
                                                0x00000000
                                                0x0471ff3e
                                                0x0471ff2e
                                                0x0471ff1c
                                                0x0471fef3
                                                0x0471fee3
                                                0x0471f9f9
                                                0x0471f9f9
                                                0x0471f9fb
                                                0x0471f9ff
                                                0x0471fbd5
                                                0x04775fb1
                                                0x04775fb1
                                                0x0471fbdf
                                                0x00000000
                                                0x0471fbe5
                                                0x0471fbe5
                                                0x0471fbe8
                                                0x0471fbed
                                                0x04775fdf
                                                0x0471fc01
                                                0x0471fc01
                                                0x0471fc04
                                                0x0471fc09
                                                0x04775fee
                                                0x04775ff4
                                                0x04775ff4
                                                0x04775fee
                                                0x0471fc0f
                                                0x0471fc13
                                                0x0471fc1d
                                                0x0471fc20
                                                0x0471fc23
                                                0x0471fc26
                                                0x0471fc2b
                                                0x04775ffd
                                                0x04776003
                                                0x04776003
                                                0x04775ffd
                                                0x0471fc33
                                                0x00000000
                                                0x0471fc39
                                                0x0471fc3b
                                                0x0471fc3e
                                                0x0471fc41
                                                0x0471fc46
                                                0x0477600c
                                                0x04776012
                                                0x04776012
                                                0x0477600c
                                                0x0471fc4e
                                                0x00000000
                                                0x0471fc54
                                                0x0471fc54
                                                0x0471fc59
                                                0x0477601b
                                                0x04776021
                                                0x04776021
                                                0x0477601b
                                                0x0471fc61
                                                0x00000000
                                                0x0471fc67
                                                0x0471fc6a
                                                0x0471fc6f
                                                0x0477602a
                                                0x04776030
                                                0x04776030
                                                0x0477602a
                                                0x0471fc77
                                                0x00000000
                                                0x0471fc7d
                                                0x0471fc7f
                                                0x0471fc81
                                                0x0471fc85
                                                0x0471fc87
                                                0x0471fc87
                                                0x0471fc8c
                                                0x0471fc8f
                                                0x0471fc94
                                                0x04776039
                                                0x0471fc9c
                                                0x0471fca4
                                                0x0471fcaa
                                                0x0471fcaf
                                                0x04776046
                                                0x0471fcbd
                                                0x0471fcbf
                                                0x0477606d
                                                0x04776073
                                                0x04776073
                                                0x0477606d
                                                0x0471fcc8
                                                0x0471fccd
                                                0x0471fccf
                                                0x0471fcd3
                                                0x0471fcd5
                                                0x0471fcd5
                                                0x0471fcde
                                                0x0471fce1
                                                0x0471fce3
                                                0x0471fce3
                                                0x0471fce8
                                                0x0471fcf0
                                                0x0471fcf2
                                                0x0471fcf5
                                                0x0471fcf7
                                                0x0471fcff
                                                0x0471fd02
                                                0x0471fd06
                                                0x0471fd11
                                                0x0471fd14
                                                0x0471fd17
                                                0x0477607c
                                                0x04776082
                                                0x04776082
                                                0x0477607c
                                                0x0471fd1f
                                                0x00000000
                                                0x0471fd25
                                                0x0471fd28
                                                0x0471fd2d
                                                0x0477608b
                                                0x04776091
                                                0x04776091
                                                0x0477608b
                                                0x0471fd35
                                                0x00000000
                                                0x0471fd3b
                                                0x0471fd3e
                                                0x0471fd43
                                                0x0477609a
                                                0x04720016
                                                0x04720018
                                                0x00000000
                                                0x0472001a
                                                0x0472001a
                                                0x0471fd82
                                                0x0471fd84
                                                0x047760d9
                                                0x047760df
                                                0x047760df
                                                0x047760d9
                                                0x0471fd8d
                                                0x0471fd95
                                                0x0471fd98
                                                0x0471fd9d
                                                0x047760e8
                                                0x00000000
                                                0x00000000
                                                0x047760ee
                                                0x00000000
                                                0x0471fda3
                                                0x0471fda3
                                                0x0471fda5
                                                0x0471fe8b
                                                0x0471fe90
                                                0x0471fe95
                                                0x047760f7
                                                0x047760fd
                                                0x047760fd
                                                0x047760f7
                                                0x0471fe9d
                                                0x00000000
                                                0x0471fea3
                                                0x0471fea5
                                                0x04776106
                                                0x0471feab
                                                0x0471feab
                                                0x0471feab
                                                0x0471feb2
                                                0x0471feb5
                                                0x00000000
                                                0x0471feb5
                                                0x0471fe9d
                                                0x0471fdab
                                                0x0471fdad
                                                0x0477610f
                                                0x04776115
                                                0x04776115
                                                0x0477610f
                                                0x0471fdb6
                                                0x0471fdbb
                                                0x0477611e
                                                0x04776120
                                                0x0471fdc1
                                                0x0471fdc1
                                                0x0471fdc5
                                                0x0471fdc5
                                                0x0471fdc7
                                                0x0471fdcc
                                                0x0471fdce
                                                0x0471fdce
                                                0x0471fdd6
                                                0x0471fdd8
                                                0x00000000
                                                0x0471fdd8
                                                0x0471fd9d
                                                0x04720018
                                                0x047760a0
                                                0x047760a0
                                                0x0471fd4b
                                                0x00000000
                                                0x00000000
                                                0x0471fd51
                                                0x0471fd56
                                                0x047760a9
                                                0x047760af
                                                0x047760af
                                                0x047760a9
                                                0x0471fd5e
                                                0x0471febf
                                                0x047760b8
                                                0x0471fec5
                                                0x0471fec5
                                                0x0471fec5
                                                0x0471fec7
                                                0x00000000
                                                0x0471fd64
                                                0x0471fd64
                                                0x0471fd68
                                                0x047760c1
                                                0x047760c7
                                                0x047760c7
                                                0x047760c1
                                                0x0471fd70
                                                0x00000000
                                                0x0471fd76
                                                0x0471fd78
                                                0x047760d0
                                                0x0471fd7e
                                                0x0471fd7e
                                                0x0471fd7e
                                                0x0471fd80
                                                0x00000000
                                                0x0471fd80
                                                0x0471fd70
                                                0x0471fd5e
                                                0x0471fd35
                                                0x0471fd1f
                                                0x0477604c
                                                0x0477604c
                                                0x0471fcb7
                                                0x0471ffc0
                                                0x0471ffc3
                                                0x0471ffc6
                                                0x0471ffcb
                                                0x04776055
                                                0x0477605b
                                                0x0477605b
                                                0x04776055
                                                0x0471ffd3
                                                0x00000000
                                                0x0471ffd9
                                                0x0471ffdb
                                                0x04776064
                                                0x0471ffe1
                                                0x0471ffe1
                                                0x0471ffe1
                                                0x0471ffe3
                                                0x0471ffe7
                                                0x0471ffed
                                                0x00000000
                                                0x0471ffed
                                                0x0471ffd3
                                                0x00000000
                                                0x0471fcb7
                                                0x0477603f
                                                0x0471fc9a
                                                0x00000000
                                                0x0471fc9a
                                                0x0471fc77
                                                0x0471fc61
                                                0x0471fc4e
                                                0x0471fc33
                                                0x04775fe5
                                                0x04775fe5
                                                0x0471fbf5
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0471fbf5
                                                0x0471fbdf
                                                0x0471fa05
                                                0x0471fa05
                                                0x0471fa0a
                                                0x0471fe14
                                                0x04775fb8
                                                0x04775fb8
                                                0x0471fe1e
                                                0x00000000
                                                0x0471fe24
                                                0x00000000
                                                0x0471fe24
                                                0x0471fe1e
                                                0x0471fa10
                                                0x0471fa10
                                                0x0471fa15
                                                0x0471fe29
                                                0x0471fe2d
                                                0x0471fe35
                                                0x0471fe38
                                                0x0471fe3b
                                                0x04775fc1
                                                0x00000000
                                                0x00000000
                                                0x04775fc7
                                                0x0471fe43
                                                0x0471fe45
                                                0x00000000
                                                0x00000000
                                                0x0471fe4b
                                                0x0471fe50
                                                0x04775fd0
                                                0x04775fd6
                                                0x04775fd6
                                                0x04775fd0
                                                0x0471fe5d
                                                0x0471fe60
                                                0x00000000
                                                0x0471fe60
                                                0x0471fe41
                                                0x0471fe41
                                                0x00000000
                                                0x0471fa1b
                                                0x0471fa1b
                                                0x0471fa1d
                                                0x0471fa20
                                                0x00000000
                                                0x0471fa20
                                                0x0471fa15
                                                0x0471f9ed
                                                0x0471f9ed
                                                0x00000000
                                                0x0471f9ed
                                                0x0471f9cd
                                                0x0471f9ba
                                                0x0471f9ba
                                                0x00000000
                                                0x0471f9ba
                                                0x0471fba8
                                                0x0471fb65
                                                0x0471fb1d
                                                0x0471fb23
                                                0x0471fb26
                                                0x00000000
                                                0x0471fb26
                                                0x0471faf3
                                                0x0471faf3
                                                0x00000000
                                                0x0471faf3
                                                0x0471fab4
                                                0x0471fa79
                                                0x0471fa56
                                                0x0471fa56
                                                0x00000000
                                                0x0471fa56
                                                0x0471f94d
                                                0x0471f950
                                                0x0471f955
                                                0x04775e79
                                                0x04775e7f
                                                0x04775e7f
                                                0x04775e79
                                                0x0471f95b
                                                0x0471f960
                                                0x04775e88
                                                0x04775e8a
                                                0x04775e8a
                                                0x04775e8e
                                                0x04775e93
                                                0x00000000
                                                0x04775e99
                                                0x04775e9c
                                                0x04775e9f
                                                0x04775ea1
                                                0x04775ea3
                                                0x04775ea3
                                                0x04775ea7
                                                0x00000000
                                                0x04775ea7
                                                0x0471f966
                                                0x0471f966
                                                0x0471f96b
                                                0x04775eb0
                                                0x04775eb6
                                                0x04775eb6
                                                0x04775eb0
                                                0x0471f973
                                                0x0471fbc7
                                                0x0471f9a5
                                                0x0471f9a5
                                                0x00000000
                                                0x0471f979
                                                0x0471f97d
                                                0x0471f97f
                                                0x04775ebf
                                                0x04775ec5
                                                0x04775ec5
                                                0x04775ebf
                                                0x0471f987
                                                0x00000000
                                                0x0471f98d
                                                0x0471f98d
                                                0x0471f990
                                                0x0471f994
                                                0x0471f997
                                                0x0471f99f
                                                0x0471fff7
                                                0x04720061
                                                0x04720064
                                                0x0472006a
                                                0x04775ece
                                                0x04775ed0
                                                0x04775ed0
                                                0x00000000
                                                0x04720064
                                                0x0471fffd
                                                0x04720000
                                                0x00000000
                                                0x04720006
                                                0x04775ecc
                                                0x00000000
                                                0x04775ecc
                                                0x04720000
                                                0x00000000
                                                0x0471f99f
                                                0x0471f987
                                                0x0471f973

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
                                                • Instruction ID: 642c97bc07f3b087c444a955a16abc19f6a78862bf3d4e999276cb91aff53dc9
                                                • Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
                                                • Instruction Fuzzy Hash: 35620432B046629BCF31CF2D858067ABBB1AF45314F2986A9CC95EB365E371F841D790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E5BA5 Relevance: .6, Instructions: 592COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 88%
                                                			E047E5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x47f1178);
				E0476D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E047E4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0475D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E047E5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x48060e8;
								if( *0x48060e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x48060e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04759710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04756DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0475F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0475F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0475F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0475FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0475FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0475F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0475F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E047E4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0476D130(_t427, _t494, _t511);
				}
			}










































































                                                0x047e5ba5
                                                0x047e5baa
                                                0x047e5baf
                                                0x047e5bb4
                                                0x047e5bb6
                                                0x047e5bbc
                                                0x047e5bbe
                                                0x047e5bc4
                                                0x047e5bcd
                                                0x047e5bd3
                                                0x047e5bd6
                                                0x047e5bdc
                                                0x047e5be0
                                                0x047e5be3
                                                0x047e5beb
                                                0x047e5bf2
                                                0x047e5bf8
                                                0x047e5bfe
                                                0x047e5c04
                                                0x047e5c0e
                                                0x047e5c18
                                                0x047e5c1f
                                                0x047e5c25
                                                0x047e5c2a
                                                0x047e5c2c
                                                0x047e5c32
                                                0x047e5c3a
                                                0x047e5c3f
                                                0x047e5c42
                                                0x047e5c48
                                                0x047e5c5b
                                                0x047e5c5b
                                                0x047e5c2c
                                                0x047e5cb7
                                                0x047e5cb9
                                                0x047e5cbf
                                                0x047e5cc2
                                                0x047e5cca
                                                0x047e5ccb
                                                0x047e5ccb
                                                0x047e5cd1
                                                0x047e5cd7
                                                0x047e5cda
                                                0x047e5ce1
                                                0x047e5ce4
                                                0x047e5ce7
                                                0x047e5ced
                                                0x047e5cf3
                                                0x047e5cf9
                                                0x047e5cff
                                                0x047e5d08
                                                0x047e5d0a
                                                0x047e5d0e
                                                0x047e5d10
                                                0x00000000
                                                0x00000000
                                                0x047e5d16
                                                0x047e5d1a
                                                0x00000000
                                                0x00000000
                                                0x047e5d20
                                                0x047e5d22
                                                0x047e5d25
                                                0x047e5d2f
                                                0x047e5d2f
                                                0x047e5d33
                                                0x047e5d3d
                                                0x047e5d49
                                                0x047e5d4b
                                                0x00000000
                                                0x00000000
                                                0x047e5d5a
                                                0x047e5d5d
                                                0x047e5d60
                                                0x00000000
                                                0x00000000
                                                0x047e5d66
                                                0x047e5d69
                                                0x00000000
                                                0x00000000
                                                0x047e5d6f
                                                0x047e5d6f
                                                0x047e5d73
                                                0x047e5d79
                                                0x047e5d7f
                                                0x047e5d86
                                                0x047e5d95
                                                0x047e5d98
                                                0x047e5dba
                                                0x047e5dcb
                                                0x047e5dce
                                                0x047e5dd3
                                                0x047e5dd6
                                                0x047e5dd8
                                                0x047e5de6
                                                0x047e5dec
                                                0x047e5dee
                                                0x047e5df1
                                                0x047e5df3
                                                0x047e635a
                                                0x047e635a
                                                0x00000000
                                                0x047e635a
                                                0x047e5dfe
                                                0x047e5e02
                                                0x047e5e05
                                                0x047e5e07
                                                0x047e5e10
                                                0x047e5e13
                                                0x047e5e1b
                                                0x047e5e1c
                                                0x047e5e21
                                                0x047e5e22
                                                0x047e5e23
                                                0x047e5e25
                                                0x047e5e2a
                                                0x047e5e2c
                                                0x047e5e2e
                                                0x047e5e36
                                                0x047e5e39
                                                0x047e5e42
                                                0x047e5e47
                                                0x047e5e4d
                                                0x047e5e54
                                                0x047e5e54
                                                0x047e5e54
                                                0x047e5e2e
                                                0x047e5e5c
                                                0x047e5e5f
                                                0x047e5e62
                                                0x047e5e64
                                                0x047e5e6b
                                                0x047e5e70
                                                0x047e5e7a
                                                0x047e5e7a
                                                0x047e5e7a
                                                0x047e5e6b
                                                0x047e5e7e
                                                0x047e5e7f
                                                0x047e5e7f
                                                0x047e5e81
                                                0x047e5e87
                                                0x047e5e8b
                                                0x047e5e8c
                                                0x047e5e8c
                                                0x047e5e8c
                                                0x047e5e9a
                                                0x047e5e9c
                                                0x047e5ea2
                                                0x047e5ea6
                                                0x047e5f50
                                                0x047e5f50
                                                0x047e5f57
                                                0x047e5f66
                                                0x047e5f66
                                                0x047e5f66
                                                0x047e5f68
                                                0x047e5f6a
                                                0x047e63d0
                                                0x00000000
                                                0x047e5f70
                                                0x047e5f70
                                                0x047e5f91
                                                0x047e5f9c
                                                0x047e5f9e
                                                0x047e5fa4
                                                0x047e5fa6
                                                0x047e638c
                                                0x047e6392
                                                0x047e63a1
                                                0x047e63a7
                                                0x047e63af
                                                0x047e63af
                                                0x047e63bd
                                                0x047e63d8
                                                0x00000000
                                                0x047e63d8
                                                0x047e5fac
                                                0x047e5fb2
                                                0x047e5fb4
                                                0x047e5fbd
                                                0x047e5fc6
                                                0x047e5fce
                                                0x047e5fd4
                                                0x047e5fdc
                                                0x047e5fec
                                                0x047e5fed
                                                0x047e5fee
                                                0x047e5fef
                                                0x047e5ff9
                                                0x047e5ffa
                                                0x047e5ffb
                                                0x047e5ffc
                                                0x047e6000
                                                0x047e6004
                                                0x047e6012
                                                0x047e6012
                                                0x047e6018
                                                0x047e6019
                                                0x047e601a
                                                0x047e601b
                                                0x047e601c
                                                0x047e6020
                                                0x047e6059
                                                0x047e605c
                                                0x047e6061
                                                0x047e6061
                                                0x047e6022
                                                0x047e6022
                                                0x047e6022
                                                0x047e6025
                                                0x047e602a
                                                0x047e602b
                                                0x047e6031
                                                0x047e6037
                                                0x047e6038
                                                0x047e603e
                                                0x047e6048
                                                0x047e6049
                                                0x047e604a
                                                0x047e604b
                                                0x047e604c
                                                0x047e604d
                                                0x047e6053
                                                0x047e6054
                                                0x047e6054
                                                0x047e6062
                                                0x047e6065
                                                0x047e6067
                                                0x047e606a
                                                0x047e6070
                                                0x047e6075
                                                0x047e6076
                                                0x047e6081
                                                0x047e6087
                                                0x047e6095
                                                0x047e6099
                                                0x047e609e
                                                0x047e60a4
                                                0x047e60ae
                                                0x047e60b0
                                                0x047e60b3
                                                0x047e60b6
                                                0x047e60b8
                                                0x047e60ba
                                                0x047e60ba
                                                0x047e60ba
                                                0x047e60ba
                                                0x047e60be
                                                0x047e60c0
                                                0x047e60c5
                                                0x047e60c5
                                                0x047e60c5
                                                0x047e60c6
                                                0x047e60cd
                                                0x047e6114
                                                0x047e60cf
                                                0x047e60cf
                                                0x047e60d4
                                                0x047e60d5
                                                0x047e60da
                                                0x047e60db
                                                0x047e60e1
                                                0x047e60e2
                                                0x047e60e8
                                                0x047e60f8
                                                0x047e60fd
                                                0x047e60fe
                                                0x047e6102
                                                0x047e6104
                                                0x047e6107
                                                0x047e6109
                                                0x047e610b
                                                0x047e610b
                                                0x047e610b
                                                0x047e610b
                                                0x047e610f
                                                0x047e610f
                                                0x047e6117
                                                0x047e611a
                                                0x047e611f
                                                0x047e6125
                                                0x047e6134
                                                0x047e6139
                                                0x047e613f
                                                0x047e6146
                                                0x047e6148
                                                0x047e614b
                                                0x047e614d
                                                0x047e614f
                                                0x047e614f
                                                0x047e614f
                                                0x047e614f
                                                0x047e6153
                                                0x047e6159
                                                0x047e6159
                                                0x047e615c
                                                0x047e6163
                                                0x047e6169
                                                0x047e616c
                                                0x047e6172
                                                0x047e6181
                                                0x047e6186
                                                0x047e6187
                                                0x047e618b
                                                0x047e6191
                                                0x047e6195
                                                0x047e61a3
                                                0x047e61bb
                                                0x047e61c0
                                                0x047e61c3
                                                0x047e61cc
                                                0x047e61d0
                                                0x047e61dc
                                                0x047e61de
                                                0x047e61e1
                                                0x047e61e4
                                                0x047e61e6
                                                0x047e61e8
                                                0x047e61e8
                                                0x047e61e8
                                                0x047e61e8
                                                0x047e61e6
                                                0x047e61ec
                                                0x047e61f3
                                                0x047e6203
                                                0x047e6209
                                                0x047e620a
                                                0x047e6216
                                                0x047e621d
                                                0x047e6227
                                                0x047e6241
                                                0x047e6246
                                                0x047e624c
                                                0x047e6257
                                                0x047e6259
                                                0x047e625c
                                                0x047e625e
                                                0x047e6260
                                                0x047e6260
                                                0x047e6260
                                                0x047e6260
                                                0x047e625e
                                                0x047e6264
                                                0x047e6267
                                                0x047e6269
                                                0x047e6315
                                                0x047e6315
                                                0x047e631b
                                                0x047e631e
                                                0x047e6324
                                                0x047e6327
                                                0x047e632f
                                                0x047e6330
                                                0x047e6333
                                                0x047e633a
                                                0x047e633c
                                                0x047e6335
                                                0x047e6335
                                                0x047e6335
                                                0x047e633f
                                                0x047e6342
                                                0x047e634c
                                                0x047e6352
                                                0x047e6355
                                                0x047e6355
                                                0x047e6359
                                                0x00000000
                                                0x047e626f
                                                0x047e6275
                                                0x047e6275
                                                0x047e6278
                                                0x047e627e
                                                0x047e627e
                                                0x047e6281
                                                0x047e6287
                                                0x047e628d
                                                0x047e6298
                                                0x047e629c
                                                0x047e62a2
                                                0x047e629e
                                                0x047e629e
                                                0x047e629e
                                                0x047e62a7
                                                0x047e62a7
                                                0x047e62aa
                                                0x047e62b0
                                                0x047e62f0
                                                0x047e62f0
                                                0x047e62f2
                                                0x047e62f8
                                                0x047e62fd
                                                0x047e62b2
                                                0x047e62b2
                                                0x047e62b2
                                                0x047e62b5
                                                0x047e62dd
                                                0x047e62e2
                                                0x047e62e5
                                                0x047e62b7
                                                0x047e62b8
                                                0x047e62bb
                                                0x047e62bd
                                                0x047e62c0
                                                0x047e62c4
                                                0x047e62cd
                                                0x047e62cd
                                                0x047e62c0
                                                0x047e62bb
                                                0x047e62b5
                                                0x047e6302
                                                0x047e6303
                                                0x047e6305
                                                0x047e6305
                                                0x047e6305
                                                0x047e630c
                                                0x047e630c
                                                0x00000000
                                                0x047e627e
                                                0x047e6269
                                                0x047e5eac
                                                0x047e5ebb
                                                0x047e5ebe
                                                0x047e5ecb
                                                0x047e5ecb
                                                0x047e5ece
                                                0x047e5ece
                                                0x047e5ed4
                                                0x047e5ed7
                                                0x047e5ed9
                                                0x047e5edb
                                                0x047e5edb
                                                0x047e5ee1
                                                0x047e5ee1
                                                0x047e5ee3
                                                0x047e5f20
                                                0x047e5f20
                                                0x047e5ee5
                                                0x047e5ee5
                                                0x047e5ee5
                                                0x047e5ee8
                                                0x047e5f11
                                                0x047e5f18
                                                0x047e5eea
                                                0x047e5eea
                                                0x047e5eed
                                                0x047e5ef2
                                                0x047e5ef8
                                                0x047e5efb
                                                0x047e5f0a
                                                0x047e5f0a
                                                0x047e5eed
                                                0x047e5ee8
                                                0x047e5f22
                                                0x047e5f28
                                                0x00000000
                                                0x00000000
                                                0x047e5f30
                                                0x047e5f31
                                                0x047e5f37
                                                0x047e5f3a
                                                0x047e5f3d
                                                0x047e5f44
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e5f46
                                                0x047e5f48
                                                0x047e5f4d
                                                0x00000000
                                                0x047e5f4d
                                                0x047e5dda
                                                0x047e5ddf
                                                0x00000000
                                                0x047e5ddf
                                                0x047e5dd8
                                                0x047e5da7
                                                0x047e5da9
                                                0x047e5dac
                                                0x047e5dae
                                                0x00000000
                                                0x047e5db4
                                                0x047e5db4
                                                0x00000000
                                                0x047e5db4
                                                0x047e5dae
                                                0x047e5d88
                                                0x047e5d8d
                                                0x047e6363
                                                0x047e6369
                                                0x047e636a
                                                0x047e6370
                                                0x047e6372
                                                0x047e637a
                                                0x047e637b
                                                0x047e637d
                                                0x00000000
                                                0x00000000
                                                0x047e637f
                                                0x047e6385
                                                0x00000000
                                                0x047e6385
                                                0x047e5d38
                                                0x047e5d3b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e5d3b
                                                0x047e5d27
                                                0x047e5d29
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e6360
                                                0x00000000
                                                0x047e6360
                                                0x047e5c10
                                                0x047e5c10
                                                0x047e63da
                                                0x047e63e5
                                                0x047e63e5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6118ce9ba1bcc61152dff9b9e11594dc5adfc7b40126d1d131f175c3a327d729
                                                • Instruction ID: bce475928b09768f82edb446e0e7a4daf5fd0d22121c7b44b9b8947354415b17
                                                • Opcode Fuzzy Hash: 6118ce9ba1bcc61152dff9b9e11594dc5adfc7b40126d1d131f175c3a327d729
                                                • Instruction Fuzzy Hash: 6D425E75900229CFDB24CF69C880BA9B7B1FF49304F5486AAD94DEB342E774A985CF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047EE824 Relevance: .5, Instructions: 493COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 50%
                                                			E047EE824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0x480d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L0473FAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E0473FA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0x480b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E04732280(E0475F3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														E0472FFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0x480b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return E0475B640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E0474F3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0x480b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0x480b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = E047EE7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(E047EE7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(E047EE7A8(_t38) == 0) {
									_t406 = 0;
								}
								E0473FA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = E047EE7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}






































































                                                0x047ee833
                                                0x047ee839
                                                0x047ee83e
                                                0x047ee841
                                                0x047ee848
                                                0x047ee84b
                                                0x047ee851
                                                0x047ee8b2
                                                0x047ee8b2
                                                0x047ee8b5
                                                0x047ee90b
                                                0x047ee911
                                                0x047ee913
                                                0x047ee913
                                                0x047ee91a
                                                0x047ee91d
                                                0x047ee922
                                                0x047ee924
                                                0x047ee924
                                                0x047ee924
                                                0x047ee92f
                                                0x047ee933
                                                0x047ee935
                                                0x047ee93a
                                                0x047ee940
                                                0x047ee948
                                                0x047ee950
                                                0x047ee955
                                                0x00000000
                                                0x00000000
                                                0x047ee957
                                                0x047ee95c
                                                0x047ee9cb
                                                0x047ee9d2
                                                0x047ee9d4
                                                0x047ee9f2
                                                0x047ee9f6
                                                0x047eea10
                                                0x047eea18
                                                0x047eea1a
                                                0x047eea1f
                                                0x047eea2c
                                                0x047eea2d
                                                0x047eea2e
                                                0x047eea32
                                                0x047eea3d
                                                0x047eea42
                                                0x047eea45
                                                0x047eea51
                                                0x047eea60
                                                0x047eea65
                                                0x047eea68
                                                0x047eea6a
                                                0x047eea6a
                                                0x047eea6a
                                                0x047eea6f
                                                0x047eea76
                                                0x047eea7c
                                                0x047eea7e
                                                0x047eea81
                                                0x047eea85
                                                0x047eea88
                                                0x047eea8c
                                                0x047eea8f
                                                0x047eea93
                                                0x047eea98
                                                0x00000000
                                                0x00000000
                                                0x047eea9a
                                                0x047eea9d
                                                0x047eeaa2
                                                0x047eeb0e
                                                0x047eeb15
                                                0x047eeb17
                                                0x047eeb33
                                                0x047eeb36
                                                0x047eeb39
                                                0x047eeb3f
                                                0x047eeb45
                                                0x047eeb4a
                                                0x047eeb52
                                                0x047eecb1
                                                0x047eecb9
                                                0x047eecbe
                                                0x047eecc3
                                                0x047eecc6
                                                0x047eeceb
                                                0x047eecee
                                                0x047eecf9
                                                0x047eecfe
                                                0x047eed00
                                                0x047eed05
                                                0x047eed07
                                                0x047eed0a
                                                0x047eed0c
                                                0x047eed0e
                                                0x047eed12
                                                0x047eed19
                                                0x047eed1e
                                                0x047eed24
                                                0x047eed2a
                                                0x047eed2a
                                                0x047eed2c
                                                0x047eed3e
                                                0x047eed3e
                                                0x047eeb5a
                                                0x047eeb62
                                                0x047eeb69
                                                0x00000000
                                                0x00000000
                                                0x047eeb6f
                                                0x047eeb75
                                                0x047eeb79
                                                0x047eeb79
                                                0x047eeb88
                                                0x047eeb8e
                                                0x047eeb90
                                                0x047eeb92
                                                0x047eeb97
                                                0x047eed3f
                                                0x047eed45
                                                0x00000000
                                                0x00000000
                                                0x047eed4b
                                                0x047eed4e
                                                0x00000000
                                                0x047eeb9d
                                                0x047eeb9d
                                                0x047eeb9d
                                                0x047eeba2
                                                0x047eebb5
                                                0x047eebbc
                                                0x047eebbe
                                                0x047eebbe
                                                0x047eebc3
                                                0x047eebc5
                                                0x047eebcb
                                                0x047eebd2
                                                0x047eebd5
                                                0x047eebdb
                                                0x047eebdf
                                                0x047eebe1
                                                0x047eebf0
                                                0x047eebf9
                                                0x047eec04
                                                0x047eec07
                                                0x047eec0a
                                                0x047eec82
                                                0x047eec85
                                                0x047eec8b
                                                0x047eec91
                                                0x047eec93
                                                0x047eec96
                                                0x047eec9b
                                                0x047eeca6
                                                0x047eecac
                                                0x047eecae
                                                0x047eecae
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047eec0c
                                                0x047eec0c
                                                0x047eec0c
                                                0x047eec0f
                                                0x047eec12
                                                0x047eec15
                                                0x047eec15
                                                0x047eec18
                                                0x047eec1e
                                                0x00000000
                                                0x00000000
                                                0x047eec22
                                                0x047eec28
                                                0x047eec4b
                                                0x047eec5b
                                                0x047eec5d
                                                0x047eec63
                                                0x047eec65
                                                0x047eec68
                                                0x047eec6b
                                                0x047eec6b
                                                0x047eec70
                                                0x047eec71
                                                0x047eec74
                                                0x047eec7d
                                                0x00000000
                                                0x047eebe3
                                                0x047eebe3
                                                0x047eebe6
                                                0x047eebe6
                                                0x047eebe7
                                                0x047eebe9
                                                0x047eebec
                                                0x00000000
                                                0x047eebe6
                                                0x047eebe1
                                                0x047eeba4
                                                0x047eeba9
                                                0x047eebb0
                                                0x047eebb3
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047eebab
                                                0x047eebab
                                                0x047eebab
                                                0x047eebac
                                                0x047eebac
                                                0x00000000
                                                0x047eebab
                                                0x047eeb97
                                                0x047eeb19
                                                0x047eeb1c
                                                0x047eeb21
                                                0x047eeb26
                                                0x047eeb2c
                                                0x047eeb2c
                                                0x00000000
                                                0x047eeb26
                                                0x047eead6
                                                0x047eead9
                                                0x047eeadc
                                                0x047eeadc
                                                0x047eeadc
                                                0x047eeade
                                                0x047eeae4
                                                0x00000000
                                                0x00000000
                                                0x047eeaee
                                                0x047eeaf7
                                                0x047eeaf9
                                                0x00000000
                                                0x00000000
                                                0x047eeb04
                                                0x047eeb12
                                                0x00000000
                                                0x047eeb12
                                                0x047eeb06
                                                0x00000000
                                                0x047eeb06
                                                0x047eeaf0
                                                0x047eeaf2
                                                0x047eeaf4
                                                0x00000000
                                                0x047eeaf4
                                                0x047eea6a
                                                0x047eea21
                                                0x00000000
                                                0x047eea21
                                                0x047ee9d6
                                                0x047ee9d6
                                                0x047ee9e0
                                                0x047ee9e2
                                                0x047ee9e2
                                                0x047ee9e8
                                                0x00000000
                                                0x047ee9e8
                                                0x047ee987
                                                0x047ee98f
                                                0x047ee992
                                                0x047ee995
                                                0x047ee995
                                                0x047ee998
                                                0x047ee998
                                                0x047ee99a
                                                0x047ee9a0
                                                0x00000000
                                                0x00000000
                                                0x047ee9a9
                                                0x047ee9b2
                                                0x047ee9b4
                                                0x00000000
                                                0x00000000
                                                0x047ee9ba
                                                0x047ee9c1
                                                0x047ee9cf
                                                0x00000000
                                                0x047ee9cf
                                                0x047ee9c3
                                                0x00000000
                                                0x047ee9c3
                                                0x047ee9ab
                                                0x047ee9ad
                                                0x047ee9af
                                                0x00000000
                                                0x047ee9af
                                                0x047ee924
                                                0x047ee8b7
                                                0x047ee8ba
                                                0x047ee902
                                                0x047ee908
                                                0x047ee90a
                                                0x00000000
                                                0x047ee90a
                                                0x047ee8bc
                                                0x047ee8bf
                                                0x047ee8f9
                                                0x047ee8ff
                                                0x047ee901
                                                0x00000000
                                                0x047ee901
                                                0x047ee8c1
                                                0x047ee8c4
                                                0x047ee8f0
                                                0x047ee8f6
                                                0x047ee8f8
                                                0x00000000
                                                0x047ee8f8
                                                0x047ee8c6
                                                0x047ee8c9
                                                0x047ee8e7
                                                0x047ee8ed
                                                0x047ee8ef
                                                0x00000000
                                                0x047ee8ef
                                                0x047ee8cb
                                                0x047ee8ce
                                                0x047ee8de
                                                0x047ee8e4
                                                0x047ee8e6
                                                0x00000000
                                                0x047ee8e6
                                                0x047ee8d3
                                                0x00000000
                                                0x047ee8d5
                                                0x047ee8db
                                                0x047ee8dd
                                                0x00000000
                                                0x047ee8dd
                                                0x047ee853
                                                0x047ee855
                                                0x047ee85b
                                                0x047ee85d
                                                0x047ee897
                                                0x047ee89c
                                                0x047ee8a2
                                                0x047ee8a6
                                                0x047ee8ab
                                                0x047ee8ad
                                                0x047ee8ad
                                                0x00000000
                                                0x047ee85d

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6d7bee21db713d7d7edb995cb945867b745218313cbc171b9f447fffeb63f135
                                                • Instruction ID: 83c30fac27c1d712ea2af9184e910d8e469bc3e28f8d97f73f1ddb06c0c6b012
                                                • Opcode Fuzzy Hash: 6d7bee21db713d7d7edb995cb945867b745218313cbc171b9f447fffeb63f135
                                                • Instruction Fuzzy Hash: C5029372F006159BCB18CFAAC89167EBBF6EB8C200B194A6DD456DB391D734F941CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04736E30 Relevance: .5, Instructions: 481COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 95%
                                                			E04736E30(signed short __ecx, signed short __edx, signed int _a4, intOrPtr* _a8, char* _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				signed short _v34;
				intOrPtr _v36;
				signed short _v38;
				signed short _v40;
				char _v41;
				signed int _v48;
				short _v50;
				signed int _v52;
				signed short _v54;
				signed int _v56;
				char _v57;
				signed int _v64;
				signed int _v68;
				signed short _v70;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed short _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				unsigned int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				char _v136;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t312;
				signed int _t313;
				char* _t315;
				unsigned int _t316;
				signed int _t317;
				short* _t319;
				void* _t320;
				signed int _t321;
				signed short _t327;
				signed int _t328;
				signed int _t335;
				signed short* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t349;
				signed short _t352;
				signed int _t357;
				signed int _t360;
				signed int _t363;
				void* _t365;
				signed int _t366;
				signed short* _t367;
				signed int _t369;
				signed int _t375;
				signed int _t379;
				signed int _t384;
				signed int _t386;
				void* _t387;
				signed short _t389;
				intOrPtr* _t392;
				signed int _t397;
				unsigned int _t399;
				signed int _t401;
				signed int _t402;
				signed int _t407;
				void* _t415;
				signed short _t417;
				unsigned int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				intOrPtr* _t433;
				signed int _t435;
				void* _t436;
				signed int _t437;
				signed int _t438;
				signed int _t440;
				signed short _t443;
				void* _t444;
				signed int _t445;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;

				_t425 = __edx;
				_push(0xfffffffe);
				_push(0x47efca8);
				_push(0x47617f0);
				_push( *[fs:0x0]);
				_t312 =  *0x480d360;
				_v12 = _v12 ^ _t312;
				_t313 = _t312 ^ _t453;
				_v32 = _t313;
				_push(_t313);
				 *[fs:0x0] =  &_v20;
				_v116 = __edx;
				_t443 = __ecx;
				_v88 = __ecx;
				_t386 = _a4;
				_t433 = _a8;
				_v112 = _t433;
				_t315 = _a12;
				_v64 = _t315;
				_t392 = _a16;
				_v108 = _t392;
				if(_t433 != 0) {
					 *_t433 = 0;
				}
				if(_t315 != 0) {
					 *_t315 = 0;
				}
				if(_t425 > 0xffff) {
					_v116 = 0xffff;
				}
				 *_t392 = 0;
				 *((intOrPtr*)(_t392 + 4)) = 0;
				_t316 =  *_t443 & 0x0000ffff;
				_v104 = _t316;
				_t435 = _t316 >> 1;
				_v120 = _t435;
				if(_t435 == 0) {
					L124:
					_t317 = 0;
					goto L60;
				} else {
					_t319 =  *((intOrPtr*)(_t443 + 4));
					if( *_t319 != 0) {
						_t397 = _t435;
						_t320 = _t319 + _t435 * 2;
						_t425 = _t320 - 2;
						while(_t397 != 0) {
							if( *_t425 == 0x20) {
								_t397 = _t397 - 1;
								_t425 = _t425 - 2;
								continue;
							}
							if(_t397 == 0) {
								goto L124;
							}
							_t321 =  *(_t320 - 2) & 0x0000ffff;
							if(_t321 == 0x5c || _t321 == 0x2f) {
								_v57 = 0;
							} else {
								_v57 = 1;
							}
							_t399 = _v116 >> 1;
							_v92 = _t399;
							_v128 = _t399;
							E0475FA60(_t386, 0, _v116);
							_v56 = 0;
							_v52 = 0;
							_v50 = _v92 + _v92;
							_v48 = _t386;
							_t327 = E047374C0(_t443);
							if(_t327 != 0) {
								_t389 = _t327 >> 0x10;
								_t328 = _t327 & 0x0000ffff;
								_v112 = _t328;
								_t437 = _v64;
								if(_t437 == 0) {
									L122:
									_t438 = _t328 + 8;
									_t401 = _v92;
									if(_t438 >= (_t401 + _t401 & 0x0000ffff)) {
										_t209 = _t438 + 2; // 0xddeeddf0
										_t402 = _t209;
										asm("sbb eax, eax");
										_t317 =  !0xffff & _t402;
									} else {
										E04749BC6( &_v52, 0x46f1080);
										_t425 =  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2;
										E04759377( &_v52,  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2, _v112);
										_t317 = _t438;
									}
									goto L60;
								}
								if(_t389 != 0) {
									_t425 = _t389;
									_t335 = E047946A7(_t443, _t389, _t437);
									if(_t335 < 0) {
										goto L124;
									}
									if( *_t437 != 0) {
										goto L124;
									}
									_t328 = _v112;
								}
								goto L122;
							} else {
								_t425 = _t443;
								_t336 =  *(_t425 + 4);
								_t407 =  *_t425 & 0x0000ffff;
								if(_t407 < 2) {
									L17:
									if(_t407 < 4 ||  *_t336 == 0 || _t336[1] != 0x3a) {
										_t337 = 5;
									} else {
										if(_t407 < 6) {
											L98:
											_t337 = 3;
											L23:
											 *_v108 = _t337;
											_t409 = 0;
											_v72 = 0;
											_v68 = 0;
											_v64 = 0;
											_v84 = 0;
											_v41 = 0;
											_t445 = 0;
											_v76 = 0;
											_v8 = 0;
											if(_t337 != 2) {
												_t338 = _t337 - 1;
												if(_t338 > 6) {
													L164:
													_t446 = 0;
													_v64 = 0;
													_t439 = _v92;
													goto L59;
												}
												switch( *((intOrPtr*)(_t338 * 4 +  &M0473749C))) {
													case 0:
														__ecx = 0;
														__eflags = 0;
														_v124 = 0;
														__esi = 2;
														while(1) {
															_v100 = __esi;
															__eflags = __esi - __edi;
															if(__esi >= __edi) {
																break;
															}
															__eax =  *(__edx + 4);
															__eax =  *( *(__edx + 4) + __esi * 2) & 0x0000ffff;
															__eflags = __eax - 0x5c;
															if(__eax == 0x5c) {
																L140:
																__ecx = __ecx + 1;
																_v124 = __ecx;
																__eflags = __ecx - 2;
																if(__ecx == 2) {
																	break;
																}
																L141:
																__esi = __esi + 1;
																continue;
															}
															__eflags = __eax - 0x2f;
															if(__eax != 0x2f) {
																goto L141;
															}
															goto L140;
														}
														__eax = __esi;
														_v80 = __esi;
														__eax =  *(__edx + 4);
														_v68 =  *(__edx + 4);
														__eax = __esi + __esi;
														_v72 = __ax;
														__eax =  *(__edx + 2) & 0x0000ffff;
														_v70 = __ax;
														_v76 = __esi;
														goto L80;
													case 1:
														goto L164;
													case 2:
														__eax = E047152A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
														} else {
															__ebx = __eax + 0xc;
														}
														 *(__ebx + 4) =  *( *(__ebx + 4)) & 0x0000ffff;
														__eax = L04722600( *( *(__ebx + 4)) & 0x0000ffff);
														__si = __ax;
														_v88 =  *(_v88 + 4);
														__ecx =  *( *(_v88 + 4)) & 0x0000ffff;
														__eax = L04722600( *( *(_v88 + 4)) & 0x0000ffff);
														_v54 = __ax;
														__eflags = __ax - __ax;
														if(__eflags != 0) {
															__cx = __ax;
															L04794735(__ecx, __edx, __eflags) = 0x3d;
															_v40 = __ax;
															__si = _v54;
															_v38 = __si;
															_v36 = 0x3a;
															 &_v40 =  &_v136;
															E0475BB40(__ecx,  &_v136,  &_v40) =  &_v52;
															__eax =  &_v136;
															__eax = E04742010(__ecx, 0,  &_v136,  &_v52);
															__eflags = __eax;
															if(__eax >= 0) {
																__ax = _v52;
																_v56 = __eax;
																__edx = __ax & 0x0000ffff;
																__ecx = __edx;
																__ecx = __edx >> 1;
																_v100 = __ecx;
																__eflags = __ecx - 3;
																if(__ecx <= 3) {
																	L155:
																	__ebx = _v48;
																	L156:
																	_v72 = __ax;
																	goto L119;
																}
																__eflags = __ecx - _v92;
																if(__ecx >= _v92) {
																	goto L155;
																}
																__esi = 0x5c;
																__ebx = _v48;
																 *(__ebx + __ecx * 2) = __si;
																__eax = __edx + 2;
																_v56 = __edx + 2;
																_v52 = __ax;
																goto L156;
															}
															__eflags = __eax - 0xc0000023;
															if(__eax != 0xc0000023) {
																__eax = 0;
																_v52 = __ax;
																_v40 = __si;
																_v38 = 0x5c003a;
																_v34 = __ax;
																__edx =  &_v40;
																__ecx =  &_v52;
																L04794658(__ecx,  &_v40) = 8;
																_v72 = __ax;
																__ebx = _v48;
																__ax = _v52;
																_v56 = 8;
																goto L119;
															}
															__ax = _v52;
															_v56 = __eax;
															__eax = __ax & 0x0000ffff;
															__eax = (__ax & 0x0000ffff) + 2;
															_v64 = __eax;
															__eflags = __eax - 0xffff;
															if(__eax <= 0xffff) {
																_v72 = __ax;
																__ebx = _v48;
																goto L119;
															}
															__esi = 0;
															_v64 = 0;
															__ebx = _v48;
															__edi = _v92;
															goto L58;
														} else {
															__eax =  *__ebx;
															_v72 =  *__ebx;
															__eax =  *(__ebx + 4);
															_v68 =  *(__ebx + 4);
															__edx =  &_v72;
															__ecx =  &_v52;
															__eax = E04749BC6(__ecx,  &_v72);
															__ebx = _v48;
															__eax = _v52 & 0x0000ffff;
															_v56 = _v52 & 0x0000ffff;
															L119:
															__eax = 3;
															_v80 = 3;
															__esi = 2;
															_v76 = 2;
															__edx = _v88;
															goto L25;
														}
													case 3:
														__eax = E047152A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
															__eflags = __ebx;
															__esi = _v76;
														} else {
															__ebx = __eax + 0xc;
														}
														__ecx = __ebx;
														__eax = L047183AE(__ebx);
														_v80 = __eax;
														__ecx =  *__ebx;
														_v72 =  *__ebx;
														__ecx =  *(__ebx + 4);
														_v68 = __ecx;
														__eflags = __eax - 3;
														if(__eax == 3) {
															__eax = 4;
															_v72 = __ax;
														} else {
															__ecx = __eax + __eax;
															_v72 = __cx;
														}
														goto L80;
													case 4:
														_t340 = E047152A5(0);
														_v84 = _t340;
														_v41 = 1;
														__eflags = _t340;
														if(_t340 == 0) {
															_t428 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
															_t445 = _v76;
														} else {
															_t428 = _t340 + 0xc;
															 *((intOrPtr*)(_v108 + 4)) =  *((intOrPtr*)(_t340 + 0x14));
														}
														_v72 =  *_t428;
														_v68 = _t428[2];
														_v80 = L047183AE(_t428);
														L80:
														E04749BC6( &_v52,  &_v72);
														_t386 = _v48;
														_v56 = _v52 & 0x0000ffff;
														_t425 = _v88;
														goto L25;
													case 5:
														__eax = 4;
														_v80 = 4;
														__esi = 4;
														_v76 = 4;
														__eflags = __edi - 4;
														if(__edi < 4) {
															__esi = __edi;
															_v76 = __esi;
														}
														__eax =  *0x46f1080;
														_v72 =  *0x46f1080;
														__eax =  *0x46f1084;
														_v68 =  *0x46f1084;
														__edx =  &_v72;
														__ecx =  &_v52;
														__eax = E04749BC6(__ecx,  &_v72);
														__eax = _v52 & 0x0000ffff;
														_v56 = __eax;
														__edx = _v88;
														__ebx = _v48;
														__eflags = __eax - 6;
														if(__eax >= 6) {
															__eax =  *(__edx + 4);
															__ax =  *((intOrPtr*)(__eax + 4));
															 *(__ebx + 4) =  *((intOrPtr*)(__eax + 4));
														}
														__eax = _v108;
														__eflags =  *_v108 - 7;
														if( *_v108 == 7) {
															_v57 = 0;
														}
														goto L25;
												}
											} else {
												_v80 = 3;
												L25:
												_t349 = _v104 + (_v72 & 0x0000ffff) - _t445 + _t445;
												_v104 = _t349;
												_t415 = _t349 + 2;
												if(_t415 > _v116) {
													if(_t435 <= 1) {
														if( *( *(_t425 + 4)) != 0x2e) {
															goto L72;
														}
														if(_t435 != 1) {
															asm("sbb esi, esi");
															_t446 =  !_t445 & _v104;
															_v64 = _t446;
															_t439 = _v92;
															L58:
															_t409 = _v84;
															L59:
															_v8 = 0xfffffffe;
															E0473746D(_t386, _t409, _t439, _t446);
															_t317 = _t446;
															L60:
															 *[fs:0x0] = _v20;
															_pop(_t436);
															_pop(_t444);
															_pop(_t387);
															return E0475B640(_t317, _t387, _v32 ^ _t453, _t425, _t436, _t444);
														}
														_t417 = _v72;
														if(_t417 != 8) {
															if(_v116 >= (_t417 & 0x0000ffff)) {
																_t352 = _v56;
																_t418 = _t352 & 0x0000ffff;
																_v104 = _t418;
																_t419 = _t418 >> 1;
																_v100 = _t419;
																if(_t419 != 0) {
																	if( *((short*)(_t386 + _t419 * 2 - 2)) == 0x5c) {
																		_t352 = _v104 + 0xfffffffe;
																		_v56 = _t352;
																		_v52 = _t352;
																	}
																}
																L27:
																_t420 = 0;
																_v100 = 0;
																L28:
																L28:
																if(_t420 < (_t352 & 0x0000ffff) >> 1) {
																	goto L69;
																} else {
																	_t422 = (_v56 & 0x0000ffff) >> 1;
																	_v96 = _t422;
																}
																while(_t445 < _t435) {
																	_t363 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																	if(_t363 == 0x5c) {
																		L44:
																		if(_t422 == 0) {
																			L46:
																			 *(_t386 + _t422 * 2) = 0x5c;
																			_t422 = _t422 + 1;
																			_v96 = _t422;
																			L43:
																			_t445 = _t445 + 1;
																			_v76 = _t445;
																			continue;
																		}
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			goto L43;
																		}
																		goto L46;
																	}
																	_t365 = _t363 - 0x2e;
																	if(_t365 == 0) {
																		_t126 = _t445 + 1; // 0x2
																		_t366 = _t126;
																		_v104 = _t366;
																		if(_t366 == _t435) {
																			goto L43;
																		}
																		_t367 =  *(_t425 + 4);
																		_t440 =  *(_t367 + 2 + _t445 * 2) & 0x0000ffff;
																		_v108 = _t440;
																		_t435 = _v120;
																		if(_t440 != 0x5c) {
																			if(_v108 == 0x2f) {
																				goto L83;
																			}
																			if(_v108 != 0x2e) {
																				L35:
																				while(_t445 < _t435) {
																					_t369 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																					if(_t369 == 0x5c || _t369 == 0x2f) {
																						if(_t445 < _t435) {
																							if(_t422 >= 2) {
																								if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x2e) {
																									if( *((short*)(_t386 + _t422 * 2 - 4)) != 0x2e) {
																										_t422 = _t422 - 1;
																										_v96 = _t422;
																									}
																								}
																							}
																						}
																						break;
																					} else {
																						 *(_t386 + _t422 * 2) = _t369;
																						_t422 = _t422 + 1;
																						_v96 = _t422;
																						_t445 = _t445 + 1;
																						_v76 = _t445;
																						continue;
																					}
																				}
																				_t445 = _t445 - 1;
																				_v76 = _t445;
																				goto L43;
																			}
																			_t155 = _t445 + 2; // 0x3
																			_t425 = _v88;
																			if(_t155 == _t435) {
																				while(1) {
																					L103:
																					if(_t422 < _v80) {
																						break;
																					}
																					 *(_t386 + _t422 * 2) = 0;
																					_t425 = _v88;
																					if( *(_t386 + _t422 * 2) != 0x5c) {
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																						continue;
																					} else {
																						goto L105;
																					}
																					while(1) {
																						L105:
																						if(_t422 < _v80) {
																							goto L180;
																						}
																						 *(_t386 + _t422 * 2) = 0;
																						_t435 = _v120;
																						if( *(_t386 + _t422 * 2) == 0x5c) {
																							if(_t422 < _v80) {
																								goto L180;
																							}
																							L110:
																							_t445 = _t445 + 1;
																							_v76 = _t445;
																							goto L43;
																						}
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																					}
																					break;
																				}
																				L180:
																				_t422 = _t422 + 1;
																				_v96 = _t422;
																				goto L110;
																			}
																			_t375 =  *(_t367 + 4 + _t445 * 2) & 0x0000ffff;
																			if(_t375 != 0x5c) {
																				if(_t375 != 0x2f) {
																					goto L35;
																				}
																			}
																			goto L103;
																		}
																		L83:
																		_t445 = _v104;
																		_v76 = _t445;
																		goto L43;
																	}
																	if(_t365 == 1) {
																		goto L44;
																	} else {
																		goto L35;
																	}
																}
																_t449 = _v80;
																if(_v57 != 0) {
																	if(_t422 > _t449) {
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			_t422 = _t422 - 1;
																			_v96 = _t422;
																		}
																	}
																}
																_t439 = _v92;
																if(_t422 >= _v92) {
																	L52:
																	if(_t422 == 0) {
																		L56:
																		_t425 = _t422 + _t422;
																		_v52 = _t425;
																		if(_v112 != 0) {
																			_t357 = _t422;
																			while(1) {
																				_v100 = _t357;
																				if(_t357 == 0) {
																					break;
																				}
																				if( *((short*)(_t386 + _t357 * 2 - 2)) == 0x5c) {
																					break;
																				}
																				_t357 = _t357 - 1;
																			}
																			if(_t357 >= _t422) {
																				L113:
																				 *_v112 = 0;
																				goto L57;
																			}
																			if(_t357 < _t449) {
																				goto L113;
																			}
																			 *_v112 = _t386 + _t357 * 2;
																		}
																		L57:
																		_t446 = _t425 & 0x0000ffff;
																		_v64 = _t446;
																		goto L58;
																	}
																	_t422 = _t422 - 1;
																	_v96 = _t422;
																	_t360 =  *(_t386 + _t422 * 2) & 0x0000ffff;
																	if(_t360 == 0x20) {
																		goto L51;
																	}
																	if(_t360 == 0x2e) {
																		goto L51;
																	}
																	_t422 = _t422 + 1;
																	_v96 = _t422;
																	goto L56;
																} else {
																	L51:
																	 *(_t386 + _t422 * 2) = 0;
																	goto L52;
																}
																L69:
																if( *((short*)(_t386 + _t420 * 2)) == 0x2f) {
																	 *((short*)(_t386 + _t420 * 2)) = 0x5c;
																}
																_t420 = _t420 + 1;
																_v100 = _t420;
																_t352 = _v56;
																goto L28;
															}
															_t446 = _t417 & 0x0000ffff;
															_v64 = _t446;
															_t439 = _v92;
															goto L58;
														}
														if(_v116 > 8) {
															goto L26;
														}
														_t446 = 0xa;
														_v64 = 0xa;
														_t439 = _v92;
														goto L58;
													}
													L72:
													if(_t415 > 0xffff) {
														_t446 = 0;
													}
													_v64 = _t446;
													_t439 = _v92;
													goto L58;
												}
												L26:
												_t352 = _v56;
												goto L27;
											}
										}
										_t379 = _t336[2] & 0x0000ffff;
										if(_t379 != 0x5c) {
											if(_t379 == 0x2f) {
												goto L22;
											}
											goto L98;
										}
										L22:
										_t337 = 2;
									}
									goto L23;
								}
								_t450 =  *_t336 & 0x0000ffff;
								if(_t450 == 0x5c || _t450 == 0x2f) {
									if(_t407 < 4) {
										L132:
										_t337 = 4;
										goto L23;
									}
									_t451 = _t336[1] & 0x0000ffff;
									if(_t451 != 0x5c) {
										if(_t451 == 0x2f) {
											goto L87;
										}
										goto L132;
									}
									L87:
									if(_t407 < 6) {
										L135:
										_t337 = 1;
										goto L23;
									}
									_t452 = _t336[2] & 0x0000ffff;
									if(_t452 != 0x2e) {
										if(_t452 == 0x3f) {
											goto L89;
										}
										goto L135;
									}
									L89:
									if(_t407 < 8) {
										L134:
										_t337 = ((0 | _t407 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
										goto L23;
									}
									_t384 = _t336[3] & 0x0000ffff;
									if(_t384 != 0x5c) {
										if(_t384 == 0x2f) {
											goto L91;
										}
										goto L134;
									}
									L91:
									_t337 = 6;
									goto L23;
								} else {
									goto L17;
								}
							}
						}
					}
					goto L124;
				}
			}

































































































                                                0x04736e30
                                                0x04736e35
                                                0x04736e37
                                                0x04736e3c
                                                0x04736e47
                                                0x04736e4b
                                                0x04736e50
                                                0x04736e53
                                                0x04736e55
                                                0x04736e5b
                                                0x04736e5f
                                                0x04736e65
                                                0x04736e68
                                                0x04736e6a
                                                0x04736e6d
                                                0x04736e70
                                                0x04736e73
                                                0x04736e76
                                                0x04736e79
                                                0x04736e7c
                                                0x04736e7f
                                                0x04736e84
                                                0x0473710f
                                                0x0473710f
                                                0x04736e8c
                                                0x04736e8e
                                                0x04736e8e
                                                0x04736e97
                                                0x0477f5d3
                                                0x0477f5d3
                                                0x04736e9d
                                                0x04736ea3
                                                0x04736eaa
                                                0x04736ead
                                                0x04736eb2
                                                0x04736eb4
                                                0x04736eb7
                                                0x04737466
                                                0x04737466
                                                0x00000000
                                                0x04736ebd
                                                0x04736ebd
                                                0x04736ec4
                                                0x04736eca
                                                0x04736ecc
                                                0x04736ecf
                                                0x04736ed2
                                                0x04736ede
                                                0x0477f5df
                                                0x0477f5e0
                                                0x00000000
                                                0x0477f5e0
                                                0x04736ee6
                                                0x00000000
                                                0x00000000
                                                0x04736eec
                                                0x04736ef3
                                                0x04737181
                                                0x04736f02
                                                0x04736f02
                                                0x04736f02
                                                0x04736f0b
                                                0x04736f0d
                                                0x04736f10
                                                0x04736f17
                                                0x04736f21
                                                0x04736f24
                                                0x04736f2d
                                                0x04736f31
                                                0x04736f36
                                                0x04736f3d
                                                0x04737413
                                                0x04737416
                                                0x04737419
                                                0x0473741c
                                                0x04737421
                                                0x0473742b
                                                0x0473742b
                                                0x0473742e
                                                0x04737439
                                                0x0477f60b
                                                0x0477f60b
                                                0x0477f615
                                                0x0477f619
                                                0x0473743f
                                                0x04737447
                                                0x04737454
                                                0x0473745a
                                                0x0473745f
                                                0x0473745f
                                                0x00000000
                                                0x04737439
                                                0x04737425
                                                0x0477f5e9
                                                0x0477f5ed
                                                0x0477f5f4
                                                0x00000000
                                                0x00000000
                                                0x0477f5fd
                                                0x00000000
                                                0x00000000
                                                0x0477f603
                                                0x0477f603
                                                0x00000000
                                                0x04736f43
                                                0x04736f43
                                                0x04736f45
                                                0x04736f48
                                                0x04736f4e
                                                0x04736f65
                                                0x04736f68
                                                0x0473721f
                                                0x04736f83
                                                0x04736f86
                                                0x047372dc
                                                0x047372dc
                                                0x04736f9e
                                                0x04736fa1
                                                0x04736fa3
                                                0x04736fa5
                                                0x04736fa8
                                                0x04736fab
                                                0x04736fae
                                                0x04736fb1
                                                0x04736fb4
                                                0x04736fb6
                                                0x04736fb9
                                                0x04736fbf
                                                0x0473718a
                                                0x0473718e
                                                0x0477f831
                                                0x0477f831
                                                0x0477f833
                                                0x0477f836
                                                0x00000000
                                                0x0477f836
                                                0x04737194
                                                0x00000000
                                                0x0477f658
                                                0x0477f658
                                                0x0477f65a
                                                0x0477f65d
                                                0x0477f662
                                                0x0477f662
                                                0x0477f665
                                                0x0477f667
                                                0x00000000
                                                0x00000000
                                                0x0477f669
                                                0x0477f66c
                                                0x0477f670
                                                0x0477f673
                                                0x0477f67a
                                                0x0477f67a
                                                0x0477f67b
                                                0x0477f67e
                                                0x0477f681
                                                0x00000000
                                                0x00000000
                                                0x0477f683
                                                0x0477f683
                                                0x00000000
                                                0x0477f683
                                                0x0477f675
                                                0x0477f678
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477f678
                                                0x0477f686
                                                0x0477f688
                                                0x0477f68b
                                                0x0477f68e
                                                0x0477f691
                                                0x0477f694
                                                0x0477f698
                                                0x0477f69c
                                                0x0477f6a0
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04737397
                                                0x0473739c
                                                0x0473739f
                                                0x047373a3
                                                0x047373a5
                                                0x0477f6bb
                                                0x0477f6c1
                                                0x0477f6c4
                                                0x047373ab
                                                0x047373ab
                                                0x047373ab
                                                0x047373b1
                                                0x047373b5
                                                0x047373ba
                                                0x047373c0
                                                0x047373c3
                                                0x047373c7
                                                0x047373cc
                                                0x047373d0
                                                0x047373d3
                                                0x0477f6cc
                                                0x0477f6d4
                                                0x0477f6d9
                                                0x0477f6dd
                                                0x0477f6e1
                                                0x0477f6e5
                                                0x0477f6f0
                                                0x0477f6fc
                                                0x0477f700
                                                0x0477f709
                                                0x0477f70e
                                                0x0477f710
                                                0x0477f784
                                                0x0477f788
                                                0x0477f78b
                                                0x0477f78e
                                                0x0477f790
                                                0x0477f792
                                                0x0477f795
                                                0x0477f798
                                                0x0477f7b7
                                                0x0477f7b7
                                                0x0477f7ba
                                                0x0477f7ba
                                                0x00000000
                                                0x0477f7ba
                                                0x0477f79a
                                                0x0477f79d
                                                0x00000000
                                                0x00000000
                                                0x0477f79f
                                                0x0477f7a4
                                                0x0477f7a7
                                                0x0477f7ab
                                                0x0477f7ae
                                                0x0477f7b1
                                                0x00000000
                                                0x0477f7b1
                                                0x0477f712
                                                0x0477f717
                                                0x0477f74c
                                                0x0477f74e
                                                0x0477f752
                                                0x0477f756
                                                0x0477f75d
                                                0x0477f761
                                                0x0477f764
                                                0x0477f76c
                                                0x0477f771
                                                0x0477f775
                                                0x0477f778
                                                0x0477f77c
                                                0x00000000
                                                0x0477f77c
                                                0x0477f719
                                                0x0477f71d
                                                0x0477f720
                                                0x0477f723
                                                0x0477f726
                                                0x0477f729
                                                0x0477f72e
                                                0x0477f740
                                                0x0477f744
                                                0x00000000
                                                0x0477f744
                                                0x0477f730
                                                0x0477f732
                                                0x0477f735
                                                0x0477f738
                                                0x00000000
                                                0x047373d9
                                                0x047373d9
                                                0x047373db
                                                0x047373de
                                                0x047373e1
                                                0x047373e4
                                                0x047373e7
                                                0x047373ea
                                                0x047373ef
                                                0x047373f2
                                                0x047373f6
                                                0x047373f9
                                                0x047373f9
                                                0x047373fe
                                                0x04737401
                                                0x04737406
                                                0x04737409
                                                0x00000000
                                                0x04737409
                                                0x00000000
                                                0x0477f7c5
                                                0x0477f7ca
                                                0x0477f7cd
                                                0x0477f7d1
                                                0x0477f7d3
                                                0x0477f7da
                                                0x0477f7e0
                                                0x0477f7e3
                                                0x0477f7e3
                                                0x0477f7e6
                                                0x0477f7d5
                                                0x0477f7d5
                                                0x0477f7d5
                                                0x0477f7e9
                                                0x0477f7eb
                                                0x0477f7f0
                                                0x0477f7f3
                                                0x0477f7f5
                                                0x0477f7f8
                                                0x0477f7fb
                                                0x0477f7fe
                                                0x0477f801
                                                0x0477f80f
                                                0x0477f814
                                                0x0477f803
                                                0x0477f803
                                                0x0477f806
                                                0x0477f806
                                                0x00000000
                                                0x00000000
                                                0x0473719d
                                                0x047371a2
                                                0x047371a5
                                                0x047371a9
                                                0x047371ab
                                                0x0477f826
                                                0x0477f829
                                                0x047371b1
                                                0x047371b1
                                                0x047371ba
                                                0x047371ba
                                                0x047371bf
                                                0x047371c5
                                                0x047371cf
                                                0x047371d2
                                                0x047371d8
                                                0x047371dd
                                                0x047371e4
                                                0x047371e7
                                                0x00000000
                                                0x00000000
                                                0x04737275
                                                0x0473727a
                                                0x0473727d
                                                0x0473727f
                                                0x04737282
                                                0x04737284
                                                0x0477f6a8
                                                0x0477f6aa
                                                0x0477f6aa
                                                0x0473728a
                                                0x0473728f
                                                0x04737292
                                                0x04737297
                                                0x0473729a
                                                0x0473729d
                                                0x047372a0
                                                0x047372a5
                                                0x047372a9
                                                0x047372ac
                                                0x047372af
                                                0x047372b2
                                                0x047372b5
                                                0x047372b7
                                                0x047372ba
                                                0x047372be
                                                0x047372be
                                                0x047372c2
                                                0x047372c5
                                                0x047372c8
                                                0x0477f6b2
                                                0x0477f6b2
                                                0x00000000
                                                0x00000000
                                                0x04736fc5
                                                0x04736fc5
                                                0x04736fcc
                                                0x04736fd8
                                                0x04736fda
                                                0x04736fdd
                                                0x04736fe3
                                                0x04737162
                                                0x0477f845
                                                0x00000000
                                                0x00000000
                                                0x0477f84e
                                                0x0477f8c4
                                                0x0477f8c8
                                                0x0477f8cb
                                                0x0477f8ce
                                                0x047370e0
                                                0x047370e0
                                                0x047370e3
                                                0x047370e3
                                                0x047370ea
                                                0x047370ef
                                                0x047370f1
                                                0x047370f4
                                                0x047370fc
                                                0x047370fd
                                                0x047370fe
                                                0x0473710c
                                                0x0473710c
                                                0x0477f850
                                                0x0477f858
                                                0x0477f87a
                                                0x0477f88a
                                                0x0477f88d
                                                0x0477f890
                                                0x0477f893
                                                0x0477f895
                                                0x0477f898
                                                0x0477f8a4
                                                0x0477f8ad
                                                0x0477f8b0
                                                0x0477f8b3
                                                0x0477f8b3
                                                0x0477f8a4
                                                0x04736fec
                                                0x04736fec
                                                0x04736fee
                                                0x00000000
                                                0x04736ff1
                                                0x04736ff8
                                                0x00000000
                                                0x04736ffe
                                                0x04737004
                                                0x04737006
                                                0x04737006
                                                0x04737010
                                                0x04737017
                                                0x0473701e
                                                0x04737072
                                                0x04737074
                                                0x0473707e
                                                0x04737083
                                                0x04737087
                                                0x04737088
                                                0x0473706c
                                                0x0473706c
                                                0x0473706d
                                                0x00000000
                                                0x0473706d
                                                0x0473707c
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473707c
                                                0x04737020
                                                0x04737023
                                                0x047371ef
                                                0x047371ef
                                                0x047371f2
                                                0x047371f7
                                                0x00000000
                                                0x00000000
                                                0x047371fd
                                                0x04737200
                                                0x04737205
                                                0x0473720b
                                                0x0473720e
                                                0x047372eb
                                                0x00000000
                                                0x00000000
                                                0x047372f6
                                                0x00000000
                                                0x04737030
                                                0x04737037
                                                0x0473703e
                                                0x04737055
                                                0x0473705a
                                                0x04737062
                                                0x0477f908
                                                0x0477f90e
                                                0x0477f90f
                                                0x0477f90f
                                                0x0477f908
                                                0x04737062
                                                0x0473705a
                                                0x00000000
                                                0x04737045
                                                0x04737045
                                                0x04737049
                                                0x0473704a
                                                0x0473704d
                                                0x0473704e
                                                0x00000000
                                                0x0473704e
                                                0x0473703e
                                                0x04737068
                                                0x04737069
                                                0x00000000
                                                0x04737069
                                                0x047372fc
                                                0x04737301
                                                0x04737304
                                                0x04737314
                                                0x04737314
                                                0x04737319
                                                0x00000000
                                                0x00000000
                                                0x04737325
                                                0x0473732d
                                                0x04737330
                                                0x04737356
                                                0x04737357
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04737332
                                                0x04737332
                                                0x04737337
                                                0x00000000
                                                0x00000000
                                                0x04737343
                                                0x0473734b
                                                0x0473734e
                                                0x04737361
                                                0x00000000
                                                0x00000000
                                                0x04737367
                                                0x04737367
                                                0x04737368
                                                0x00000000
                                                0x04737368
                                                0x04737350
                                                0x04737351
                                                0x04737351
                                                0x00000000
                                                0x04737332
                                                0x0477f8f9
                                                0x0477f8f9
                                                0x0477f8fa
                                                0x00000000
                                                0x0477f8fa
                                                0x04737306
                                                0x0473730e
                                                0x0477f8ee
                                                0x00000000
                                                0x00000000
                                                0x0477f8f4
                                                0x00000000
                                                0x0473730e
                                                0x04737214
                                                0x04737214
                                                0x04737217
                                                0x00000000
                                                0x04737217
                                                0x0473702c
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473702c
                                                0x0473708d
                                                0x04737094
                                                0x04737098
                                                0x047370a0
                                                0x0473738c
                                                0x0473738d
                                                0x0473738d
                                                0x047370a0
                                                0x04737098
                                                0x047370a6
                                                0x047370ab
                                                0x047370b3
                                                0x047370b5
                                                0x047370cd
                                                0x047370cd
                                                0x047370d0
                                                0x047370d8
                                                0x0473711a
                                                0x0473711c
                                                0x0473711c
                                                0x04737121
                                                0x00000000
                                                0x00000000
                                                0x04737129
                                                0x00000000
                                                0x00000000
                                                0x0473712b
                                                0x0473712b
                                                0x04737130
                                                0x0473737e
                                                0x04737381
                                                0x00000000
                                                0x04737381
                                                0x04737138
                                                0x00000000
                                                0x00000000
                                                0x04737144
                                                0x04737144
                                                0x047370da
                                                0x047370da
                                                0x047370dd
                                                0x00000000
                                                0x047370dd
                                                0x047370b7
                                                0x047370b8
                                                0x047370bb
                                                0x047370c2
                                                0x00000000
                                                0x00000000
                                                0x047370c7
                                                0x00000000
                                                0x00000000
                                                0x047370c9
                                                0x047370ca
                                                0x00000000
                                                0x047370ad
                                                0x047370ad
                                                0x047370af
                                                0x00000000
                                                0x047370af
                                                0x04737148
                                                0x0473714d
                                                0x0477f8e2
                                                0x0477f8e2
                                                0x04737153
                                                0x04737154
                                                0x04737157
                                                0x00000000
                                                0x04737157
                                                0x0477f87c
                                                0x0477f87f
                                                0x0477f882
                                                0x00000000
                                                0x0477f882
                                                0x0477f85e
                                                0x00000000
                                                0x00000000
                                                0x0477f864
                                                0x0477f869
                                                0x0477f86c
                                                0x00000000
                                                0x0477f86c
                                                0x04737168
                                                0x04737170
                                                0x0477f8d6
                                                0x0477f8d6
                                                0x04737176
                                                0x04737179
                                                0x00000000
                                                0x04737179
                                                0x04736fe9
                                                0x04736fe9
                                                0x00000000
                                                0x04736fe9
                                                0x04736fbf
                                                0x04736f8c
                                                0x04736f93
                                                0x047372d6
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047372d6
                                                0x04736f99
                                                0x04736f99
                                                0x04736f99
                                                0x00000000
                                                0x04736f68
                                                0x04736f50
                                                0x04736f56
                                                0x0473722c
                                                0x0477f629
                                                0x0477f629
                                                0x00000000
                                                0x0477f629
                                                0x04737232
                                                0x04737239
                                                0x0477f623
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477f623
                                                0x0473723f
                                                0x04737242
                                                0x0477f64e
                                                0x0477f64e
                                                0x00000000
                                                0x0477f64e
                                                0x04737248
                                                0x0473724f
                                                0x04737373
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04737379
                                                0x04737255
                                                0x04737258
                                                0x0477f63c
                                                0x0477f648
                                                0x00000000
                                                0x0477f648
                                                0x0473725e
                                                0x04737265
                                                0x0477f636
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477f636
                                                0x0473726b
                                                0x0473726b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04736f56
                                                0x04736f3d
                                                0x04736ed2
                                                0x00000000
                                                0x04736ec4

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 510fe09fa63f8362e01a5e5f24f3f1a35c5deaed12366de4ae68865ac4adc48b
                                                • Instruction ID: b4c23de3d2e382ede71ae1cfa6b7863dcb7fe1bcf197ffcf955d6d2f716ae7fe
                                                • Opcode Fuzzy Hash: 510fe09fa63f8362e01a5e5f24f3f1a35c5deaed12366de4ae68865ac4adc48b
                                                • Instruction Fuzzy Hash: 70027FB1E04259DBCF2CCF99C5846ADB7B1EF45702F65842AE815AB352E770B881CB80
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047EDFCE Relevance: .5, Instructions: 458COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 68%
                                                			E047EDFCE(intOrPtr __ecx, signed int __edx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed char _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t173;
				signed int _t175;
				unsigned int _t177;
				intOrPtr _t178;
				signed int _t201;
				unsigned int _t223;
				unsigned int _t240;
				signed int _t258;
				intOrPtr _t269;
				signed int _t270;
				signed char _t271;
				signed char _t273;
				signed int _t274;
				intOrPtr* _t281;
				signed int* _t284;
				signed char _t292;
				signed int _t293;
				signed char _t300;
				signed char _t305;
				intOrPtr _t314;
				signed int _t315;
				signed int _t319;
				signed int _t323;
				intOrPtr _t326;
				signed char _t328;
				signed int _t334;
				signed char _t335;
				void* _t365;
				signed int _t368;
				signed int* _t373;
				signed int _t377;
				signed int _t378;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				unsigned int _t384;
				void* _t385;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				void* _t390;
				signed int _t393;
				signed int _t406;
				signed int _t407;

				_t367 = __edx;
				_v8 =  *0x480d360 ^ _t407;
				_t269 = __ecx;
				_v44 = __ecx;
				if(__ecx == 0) {
					L80:
					_t270 = 0;
					L81:
					return E0475B640(_t270, _t270, _v8 ^ _t407, _t367, _t383, _t392);
				}
				_t383 = _a4;
				if(_t383 == 0 || __edx == 0) {
					goto L80;
				} else {
					_v56 = _t383;
					_t393 = 0x4cb2f;
					_t384 = _t383 << 2;
					_v52 = __edx;
					if(_t384 < 8) {
						L7:
						_t385 = _t384 - 1;
						if(_t385 == 0) {
							L20:
							_t392 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							L21:
							_t15 = _t269 + 0x18; // 0x4808680
							_v48 = _t15;
							L0473FAD0(_t15);
							_t17 = _t269 + 0xc; // 0x4808674
							_t367 = _t17;
							_t383 = 0;
							_v20 = _t367;
							_t271 = 0;
							while(1) {
								L22:
								_t19 = _t367 + 4; // 0x0
								_t173 =  *_t19;
								_v12 = _v12 | 0xffffffff;
								_v12 = _v12 << (_t173 & 0x0000001f);
								_t300 = _t392 & _v12;
								_v16 = _t300;
								_v16 = _v16 >> 0x18;
								_v28 = _t300;
								_v28 = _v28 >> 0x10;
								_v24 = _t300;
								_v24 = _v24 >> 8;
								_v32 = _t300;
								if(_t271 != 0) {
									goto L25;
								}
								_t240 = _t173 >> 5;
								_v36 = _t240;
								if(_t240 == 0) {
									_t270 = _t383;
									L34:
									if(_t270 == 0) {
										L38:
										_t272 = _v48;
										E0473FA00(_v48, _t300, _t383, _v48);
										_t367 =  &_v56;
										_t175 = E047EE62A(_v44,  &_v56, _t392);
										_v36 = _t175;
										if(_t175 != 0) {
											E04732280(_t175, _t272);
											_t273 = _t383;
											do {
												_t368 = _v20;
												_v12 = _v12 | 0xffffffff;
												_t177 =  *(_t368 + 4);
												_v12 = _v12 << (_t177 & 0x0000001f);
												_t305 = _v12 & _t392;
												_v24 = _t305;
												_v24 = _v24 >> 0x18;
												_v28 = _t305;
												_v28 = _v28 >> 0x10;
												_v16 = _t305;
												_v16 = _v16 >> 8;
												_v40 = _t305;
												if(_t273 != 0) {
													while(1) {
														L44:
														_t273 =  *_t273;
														if((_t273 & 0x00000001) != 0) {
															break;
														}
														if(_t305 == ( *(_t273 + 4) & _v12)) {
															L48:
															if(_t273 == 0) {
																L55:
																_t178 = _v44;
																_t274 =  *(_t368 + 4);
																_v16 =  *((intOrPtr*)(_t178 + 0x28));
																_v32 =  *(_t178 + 0x20);
																_t181 = _t274 >> 5;
																_v24 =  *((intOrPtr*)(_t178 + 0x24));
																if( *_t368 < (_t274 >> 5) + (_t274 >> 5)) {
																	L76:
																	_t383 = _v36;
																	_t153 = (_t274 >> 5) - 1; // 0xffffffdf
																	_t367 = _t153 & (((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000018) + ((((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000010 & 0x000000ff) + ((((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4)) >> 0x00000008 & 0x000000ff) + (((_t274 & 0x0000001f | 0xffffffff) << (_t274 & 0x0000001f) &  *(_t383 + 4) & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																	_t281 = _v20;
																	_t314 =  *((intOrPtr*)(_t281 + 8));
																	 *_t383 =  *(_t314 + _t367 * 4);
																	 *(_t314 + _t367 * 4) = _t383;
																	 *_t281 =  *_t281 + 1;
																	E0472FFB0(_t281, _t383, _v48);
																	goto L39;
																}
																_t315 = 2;
																if(E0474F3D5( &_v40, _t181 * _t315, _t181 * _t315 >> 0x20) < 0) {
																	goto L76;
																}
																_t392 = _v40;
																if(_t392 < 4) {
																	_t392 = 4;
																}
																 *0x480b1e0(_t392 << 2, _v16);
																_t373 =  *_v32();
																_v12 = _t373;
																if(_t373 == 0) {
																	_t274 =  *(_v20 + 4);
																	if(_t274 >= 0x20) {
																		goto L76;
																	}
																	L78:
																	_t270 = _t383;
																	L79:
																	E0472FFB0(_t270, _t383, _v48);
																	_t367 = _v36;
																	E047EE5B6(_v44, _v36);
																	goto L81;
																} else {
																	_t107 = _t392 - 1; // 0x3
																	_t319 = _t107;
																	if((_t392 & _t319) == 0) {
																		L64:
																		if(_t392 > 0x4000000) {
																			_t392 = 0x4000000;
																		}
																		_t284 = _t373;
																		_t201 = _v20 | 0x00000001;
																		asm("sbb ecx, ecx");
																		_t323 =  !(_v12 + (_t392 << 2)) & _t392 << 0x00000002 >> 0x00000002;
																		if(_t323 <= 0) {
																			L69:
																			_t377 = _v20;
																			_v40 = (_t201 | 0xffffffff) << ( *(_t377 + 4) & 0x0000001f);
																			if(( *(_t377 + 4) & 0xffffffe0) <= 0) {
																				L74:
																				_t326 =  *((intOrPtr*)(_t377 + 8));
																				_t274 =  *(_t377 + 4) & 0x0000001f | _t392 << 0x00000005;
																				 *((intOrPtr*)(_t377 + 8)) = _v12;
																				 *(_t377 + 4) = _t274;
																				if(_t326 != 0) {
																					 *0x480b1e0(_t326, _v16);
																					 *_v24();
																					_t274 =  *(_v20 + 4);
																				}
																				goto L76;
																			} else {
																				goto L70;
																			}
																			do {
																				L70:
																				_t378 =  *((intOrPtr*)(_t377 + 8));
																				_v28 = _t378;
																				while(1) {
																					_t328 =  *(_t378 + _t383 * 4);
																					_v32 = _t328;
																					if((_t328 & 0x00000001) != 0) {
																						goto L73;
																					}
																					 *(_t378 + _t383 * 4) =  *_t328;
																					_t381 = _v12;
																					_t132 = _t392 - 1; // -1
																					_t334 = _t132 & (( *(_t328 + 4) & _v40) >> 0x00000018) + ((( *(_t328 + 4) & _v40) >> 0x00000010 & 0x000000ff) + ((( *(_t328 + 4) & _v40) >> 0x00000008 & 0x000000ff) + (( *(_t328 + 4) & _v40 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																					_t292 = _v32;
																					 *_t292 =  *(_t381 + _t334 * 4);
																					 *(_t381 + _t334 * 4) = _t292;
																					_t378 = _v28;
																				}
																				L73:
																				_t377 = _v20;
																				_t383 = _t383 + 1;
																			} while (_t383 <  *(_t377 + 4) >> 5);
																			goto L74;
																		} else {
																			_t382 = _t383;
																			do {
																				_t382 = _t382 + 1;
																				 *_t284 = _t201;
																				_t284 =  &(_t284[1]);
																			} while (_t382 < _t323);
																			goto L69;
																		}
																	}
																	_t335 = _t319 | 0xffffffff;
																	if(_t392 == 0) {
																		L63:
																		_t392 = 1 << _t335;
																		goto L64;
																	} else {
																		goto L62;
																	}
																	do {
																		L62:
																		_t335 = _t335 + 1;
																		_t392 = _t392 >> 1;
																	} while (_t392 != 0);
																	goto L63;
																}
															}
															goto L49;
														}
													}
													_t273 = _t383;
													goto L48;
												}
												_t223 = _t177 >> 5;
												_v32 = _t223;
												if(_t223 == 0) {
													_t273 = _t383;
													L51:
													if(_t273 == 0) {
														goto L55;
													}
													_t88 = _t273 + 8; // 0x8
													if(E047EE7A8(_t88) != 0) {
														goto L79;
													}
													goto L78;
												}
												_t273 =  *((intOrPtr*)(_t368 + 8)) + (_v32 - 0x00000001 & (_v24 & 0x000000ff) + 0x164b2f3f + (((_t305 & 0x000000ff) * 0x00000025 + (_v16 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
												_t305 = _v40;
												goto L44;
												L49:
											} while (E047EEE71(_t273,  &_v56) == 0);
											_t368 = _v20;
											goto L51;
										}
										L39:
										_t270 = _t383;
										goto L81;
									}
									_t50 = _t270 + 8; // 0x8
									_t345 = _t50;
									if(E047EE7A8(_t50) == 0) {
										_t270 = _t383;
									}
									E0473FA00(_t270, _t345, _t383, _v48);
									goto L81;
								}
								_t40 = _t367 + 8; // 0x0
								_t271 =  *_t40 + (_v36 - 0x00000001 & (_v16 & 0x000000ff) + 0x164b2f3f + (((_t300 & 0x000000ff) * 0x00000025 + (_v24 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
								_t300 = _v32;
								L25:
								_t367 = _v12;
								while(1) {
									_t271 =  *_t271;
									if((_t271 & 0x00000001) != 0) {
										break;
									}
									if(_t300 == ( *(_t271 + 4) & _t367)) {
										L30:
										if(_t270 == 0) {
											goto L38;
										}
										if(E047EEE71(_t270,  &_v56) != 0) {
											goto L34;
										}
										_t367 = _v20;
										goto L22;
									}
								}
								_t270 = _t383;
								goto L30;
							}
						}
						_t386 = _t385 - 1;
						if(_t386 == 0) {
							L19:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L20;
						}
						_t387 = _t386 - 1;
						if(_t387 == 0) {
							L18:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L19;
						}
						_t388 = _t387 - 1;
						if(_t388 == 0) {
							L17:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L18;
						}
						_t389 = _t388 - 1;
						if(_t389 == 0) {
							L16:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L17;
						}
						_t390 = _t389 - 1;
						if(_t390 == 0) {
							L15:
							_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
							_t367 = _t367 + 1;
							goto L16;
						}
						if(_t390 != 1) {
							goto L21;
						}
						_t393 = _t393 * 0x25 + ( *_t367 & 0x000000ff);
						_t367 = _t367 + 1;
						goto L15;
					}
					_t258 = _t384 >> 3;
					_v36 = _t258;
					_t293 = _t258;
					_t384 = _t384 + _t258 * 0xfffffff8;
					do {
						_t365 = (((((( *(_t367 + 1) & 0x000000ff) * 0x25 + ( *(_t367 + 2) & 0x000000ff)) * 0x25 + ( *(_t367 + 3) & 0x000000ff)) * 0x25 + ( *(_t367 + 4) & 0x000000ff)) * 0x25 + ( *(_t367 + 5) & 0x000000ff)) * 0x25 + ( *(_t367 + 6) & 0x000000ff)) * 0x25 + ( *_t367 & 0x000000ff) * 0x1a617d0d;
						_t406 =  *(_t367 + 7) & 0x000000ff;
						_t367 = _t367 + 8;
						_t393 = _t406 + _t365 - _t393 * 0x2fe8ed1f;
						_t293 = _t293 - 1;
					} while (_t293 != 0);
					_t269 = _v44;
					goto L7;
				}
			}
































































                                                0x047edfce
                                                0x047edfdd
                                                0x047edfe1
                                                0x047edfe3
                                                0x047edfea
                                                0x047ee49c
                                                0x047ee49c
                                                0x047ee49e
                                                0x047ee4b0
                                                0x047ee4b0
                                                0x047edff0
                                                0x047edff5
                                                0x00000000
                                                0x047ee003
                                                0x047ee003
                                                0x047ee006
                                                0x047ee00b
                                                0x047ee00e
                                                0x047ee014
                                                0x047ee07d
                                                0x047ee07d
                                                0x047ee080
                                                0x047ee0d6
                                                0x047ee0dc
                                                0x047ee0de
                                                0x047ee0de
                                                0x047ee0e2
                                                0x047ee0e5
                                                0x047ee0ea
                                                0x047ee0ea
                                                0x047ee0ed
                                                0x047ee0ef
                                                0x047ee0f2
                                                0x047ee0f4
                                                0x047ee0f4
                                                0x047ee0f4
                                                0x047ee0f4
                                                0x047ee0f9
                                                0x047ee100
                                                0x047ee105
                                                0x047ee108
                                                0x047ee10b
                                                0x047ee10f
                                                0x047ee112
                                                0x047ee116
                                                0x047ee119
                                                0x047ee11d
                                                0x047ee122
                                                0x00000000
                                                0x00000000
                                                0x047ee124
                                                0x047ee127
                                                0x047ee12c
                                                0x047ee197
                                                0x047ee199
                                                0x047ee19b
                                                0x047ee1b8
                                                0x047ee1b8
                                                0x047ee1bc
                                                0x047ee1c4
                                                0x047ee1c8
                                                0x047ee1cd
                                                0x047ee1d2
                                                0x047ee1dc
                                                0x047ee1e1
                                                0x047ee1e3
                                                0x047ee1e3
                                                0x047ee1e6
                                                0x047ee1ea
                                                0x047ee1f2
                                                0x047ee1f8
                                                0x047ee1fa
                                                0x047ee1fd
                                                0x047ee201
                                                0x047ee204
                                                0x047ee208
                                                0x047ee20b
                                                0x047ee20f
                                                0x047ee214
                                                0x047ee258
                                                0x047ee258
                                                0x047ee258
                                                0x047ee25d
                                                0x00000000
                                                0x00000000
                                                0x047ee267
                                                0x047ee26d
                                                0x047ee26f
                                                0x047ee2a3
                                                0x047ee2a3
                                                0x047ee2a6
                                                0x047ee2ac
                                                0x047ee2b5
                                                0x047ee2ba
                                                0x047ee2bd
                                                0x047ee2c5
                                                0x047ee418
                                                0x047ee418
                                                0x047ee451
                                                0x047ee45e
                                                0x047ee460
                                                0x047ee463
                                                0x047ee469
                                                0x047ee46b
                                                0x047ee46e
                                                0x047ee470
                                                0x00000000
                                                0x047ee470
                                                0x047ee2cd
                                                0x047ee2dc
                                                0x00000000
                                                0x00000000
                                                0x047ee2e2
                                                0x047ee2e8
                                                0x047ee2ec
                                                0x047ee2ec
                                                0x047ee2fb
                                                0x047ee303
                                                0x047ee305
                                                0x047ee30a
                                                0x047ee47d
                                                0x047ee483
                                                0x00000000
                                                0x00000000
                                                0x047ee485
                                                0x047ee485
                                                0x047ee487
                                                0x047ee48a
                                                0x047ee48f
                                                0x047ee495
                                                0x00000000
                                                0x047ee310
                                                0x047ee310
                                                0x047ee310
                                                0x047ee315
                                                0x047ee328
                                                0x047ee32f
                                                0x047ee331
                                                0x047ee331
                                                0x047ee336
                                                0x047ee340
                                                0x047ee34b
                                                0x047ee34f
                                                0x047ee351
                                                0x047ee35f
                                                0x047ee35f
                                                0x047ee374
                                                0x047ee377
                                                0x047ee3e6
                                                0x047ee3e9
                                                0x047ee3f5
                                                0x047ee3f7
                                                0x047ee3fa
                                                0x047ee3ff
                                                0x047ee40a
                                                0x047ee410
                                                0x047ee415
                                                0x047ee415
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047ee379
                                                0x047ee379
                                                0x047ee379
                                                0x047ee37c
                                                0x047ee37f
                                                0x047ee37f
                                                0x047ee382
                                                0x047ee388
                                                0x00000000
                                                0x00000000
                                                0x047ee38c
                                                0x047ee3b6
                                                0x047ee3c1
                                                0x047ee3c6
                                                0x047ee3c8
                                                0x047ee3ce
                                                0x047ee3d0
                                                0x047ee3d3
                                                0x047ee3d3
                                                0x047ee3d8
                                                0x047ee3d8
                                                0x047ee3db
                                                0x047ee3e2
                                                0x00000000
                                                0x047ee353
                                                0x047ee353
                                                0x047ee355
                                                0x047ee355
                                                0x047ee356
                                                0x047ee358
                                                0x047ee35b
                                                0x00000000
                                                0x047ee355
                                                0x047ee351
                                                0x047ee317
                                                0x047ee31c
                                                0x047ee323
                                                0x047ee326
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047ee31e
                                                0x047ee31e
                                                0x047ee31e
                                                0x047ee31f
                                                0x047ee31f
                                                0x00000000
                                                0x047ee31e
                                                0x047ee30a
                                                0x00000000
                                                0x047ee26f
                                                0x047ee269
                                                0x047ee26b
                                                0x00000000
                                                0x047ee26b
                                                0x047ee216
                                                0x047ee219
                                                0x047ee21e
                                                0x047ee29f
                                                0x047ee286
                                                0x047ee288
                                                0x00000000
                                                0x00000000
                                                0x047ee28a
                                                0x047ee294
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047ee29a
                                                0x047ee252
                                                0x047ee255
                                                0x00000000
                                                0x047ee271
                                                0x047ee27b
                                                0x047ee283
                                                0x00000000
                                                0x047ee283
                                                0x047ee1d4
                                                0x047ee1d4
                                                0x00000000
                                                0x047ee1d4
                                                0x047ee19d
                                                0x047ee19d
                                                0x047ee1a7
                                                0x047ee1a9
                                                0x047ee1a9
                                                0x047ee1ae
                                                0x00000000
                                                0x047ee1ae
                                                0x047ee15d
                                                0x047ee160
                                                0x047ee163
                                                0x047ee166
                                                0x047ee166
                                                0x047ee169
                                                0x047ee169
                                                0x047ee16e
                                                0x00000000
                                                0x00000000
                                                0x047ee177
                                                0x047ee17d
                                                0x047ee17f
                                                0x00000000
                                                0x00000000
                                                0x047ee18d
                                                0x00000000
                                                0x00000000
                                                0x047ee18f
                                                0x00000000
                                                0x047ee18f
                                                0x047ee179
                                                0x047ee17b
                                                0x00000000
                                                0x047ee17b
                                                0x047ee0f4
                                                0x047ee082
                                                0x047ee085
                                                0x047ee0cd
                                                0x047ee0d3
                                                0x047ee0d5
                                                0x00000000
                                                0x047ee0d5
                                                0x047ee087
                                                0x047ee08a
                                                0x047ee0c4
                                                0x047ee0ca
                                                0x047ee0cc
                                                0x00000000
                                                0x047ee0cc
                                                0x047ee08c
                                                0x047ee08f
                                                0x047ee0bb
                                                0x047ee0c1
                                                0x047ee0c3
                                                0x00000000
                                                0x047ee0c3
                                                0x047ee091
                                                0x047ee094
                                                0x047ee0b2
                                                0x047ee0b8
                                                0x047ee0ba
                                                0x00000000
                                                0x047ee0ba
                                                0x047ee096
                                                0x047ee099
                                                0x047ee0a9
                                                0x047ee0af
                                                0x047ee0b1
                                                0x00000000
                                                0x047ee0b1
                                                0x047ee09e
                                                0x00000000
                                                0x00000000
                                                0x047ee0a6
                                                0x047ee0a8
                                                0x00000000
                                                0x047ee0a8
                                                0x047ee018
                                                0x047ee01b
                                                0x047ee01e
                                                0x047ee023
                                                0x047ee025
                                                0x047ee062
                                                0x047ee06a
                                                0x047ee06e
                                                0x047ee073
                                                0x047ee075
                                                0x047ee075
                                                0x047ee07a
                                                0x00000000
                                                0x047ee07a

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8aeafed3dee4132bc1a61d8eab52938c4b8253bd6e2e1ce264a5bd4fec419c0d
                                                • Instruction ID: 254898ef3bc238709f000b048d03028fcf4fcb68dab3490f92a99c2c5ea7631d
                                                • Opcode Fuzzy Hash: 8aeafed3dee4132bc1a61d8eab52938c4b8253bd6e2e1ce264a5bd4fec419c0d
                                                • Instruction Fuzzy Hash: 8BF19372F002168BCB18CEAAC9D15BDFBF5EB4D200B198769D856EB391D734E941CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04734120 Relevance: .4, Instructions: 444COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 92%
                                                			E04734120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x480d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0474F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04736E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04734620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04736E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M047345F8))) {
												case 0:
													_v568 = 0x46f1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x46f11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04734620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0475F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0475F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E047152A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0472EB70(1, 0x48079a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0472AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E047595D0();
																			L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0475B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04753D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0475B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}















































































                                                0x04734128
                                                0x04734135
                                                0x0473413c
                                                0x04734141
                                                0x04734145
                                                0x04734147
                                                0x0473414e
                                                0x04734151
                                                0x04734159
                                                0x0473415c
                                                0x04734160
                                                0x04734164
                                                0x04734168
                                                0x0473416c
                                                0x0473417f
                                                0x04734181
                                                0x0473446a
                                                0x0473446a
                                                0x0473418c
                                                0x04734195
                                                0x04734199
                                                0x04734432
                                                0x04734439
                                                0x0473443d
                                                0x04734442
                                                0x04734447
                                                0x00000000
                                                0x0473419f
                                                0x047341a3
                                                0x047341b1
                                                0x047341b9
                                                0x047341bd
                                                0x047345db
                                                0x047345db
                                                0x00000000
                                                0x047341c3
                                                0x047341c3
                                                0x047341ce
                                                0x047341d4
                                                0x0477e138
                                                0x0477e13e
                                                0x0477e169
                                                0x0477e16d
                                                0x0477e19e
                                                0x0477e16f
                                                0x0477e16f
                                                0x0477e175
                                                0x0477e179
                                                0x0477e18f
                                                0x0477e193
                                                0x00000000
                                                0x0477e199
                                                0x00000000
                                                0x0477e199
                                                0x0477e193
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047341da
                                                0x047341da
                                                0x047341df
                                                0x047341e4
                                                0x047341ec
                                                0x04734203
                                                0x04734207
                                                0x0477e1fd
                                                0x04734222
                                                0x04734226
                                                0x0477e1f3
                                                0x0477e1f3
                                                0x0473422c
                                                0x0473422c
                                                0x04734233
                                                0x0477e1ed
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04734239
                                                0x04734239
                                                0x04734239
                                                0x04734239
                                                0x04734233
                                                0x04734226
                                                0x047341ee
                                                0x047341ee
                                                0x047341f4
                                                0x04734575
                                                0x0477e1b1
                                                0x0477e1b1
                                                0x00000000
                                                0x0473457b
                                                0x0473457b
                                                0x04734582
                                                0x0477e1ab
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04734588
                                                0x04734588
                                                0x0473458c
                                                0x0477e1c4
                                                0x0477e1c4
                                                0x00000000
                                                0x04734592
                                                0x04734592
                                                0x04734599
                                                0x0477e1be
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473459f
                                                0x0473459f
                                                0x047345a3
                                                0x0477e1d7
                                                0x0477e1e4
                                                0x00000000
                                                0x047345a9
                                                0x047345a9
                                                0x047345b0
                                                0x0477e1d1
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047345b6
                                                0x047345b6
                                                0x047345b6
                                                0x00000000
                                                0x047345b6
                                                0x047345b0
                                                0x047345a3
                                                0x04734599
                                                0x0473458c
                                                0x04734582
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047341f4
                                                0x0473423e
                                                0x04734241
                                                0x047345c0
                                                0x047345c4
                                                0x00000000
                                                0x047345ca
                                                0x047345ca
                                                0x00000000
                                                0x0477e207
                                                0x0477e20f
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047345d1
                                                0x00000000
                                                0x00000000
                                                0x047345ca
                                                0x00000000
                                                0x04734247
                                                0x04734247
                                                0x04734247
                                                0x04734249
                                                0x04734249
                                                0x04734249
                                                0x04734251
                                                0x04734251
                                                0x04734257
                                                0x0473425f
                                                0x0473426e
                                                0x04734270
                                                0x0473427a
                                                0x0477e219
                                                0x0477e219
                                                0x04734280
                                                0x04734282
                                                0x04734456
                                                0x047345ea
                                                0x00000000
                                                0x047345f0
                                                0x0477e223
                                                0x00000000
                                                0x0477e223
                                                0x0473445c
                                                0x0473445c
                                                0x00000000
                                                0x0473445c
                                                0x00000000
                                                0x04734288
                                                0x0473428c
                                                0x0477e298
                                                0x04734292
                                                0x04734292
                                                0x0473429e
                                                0x047342a3
                                                0x047342a7
                                                0x047342ac
                                                0x0477e22d
                                                0x047342b2
                                                0x047342b2
                                                0x047342b9
                                                0x047342bc
                                                0x047342c2
                                                0x047342ca
                                                0x047342cd
                                                0x047342cd
                                                0x047342d4
                                                0x0473433f
                                                0x0473433f
                                                0x047342d6
                                                0x047342d6
                                                0x047342d9
                                                0x047342dd
                                                0x047342eb
                                                0x0477e23a
                                                0x047342f1
                                                0x04734305
                                                0x0473430d
                                                0x04734315
                                                0x04734318
                                                0x0473431f
                                                0x04734322
                                                0x0473432e
                                                0x0473433b
                                                0x0473433b
                                                0x00000000
                                                0x0473432e
                                                0x047342eb
                                                0x0473434c
                                                0x0473434e
                                                0x04734352
                                                0x04734359
                                                0x0473435e
                                                0x04734361
                                                0x0473436e
                                                0x0473438a
                                                0x0473438e
                                                0x04734396
                                                0x0473439e
                                                0x047343a1
                                                0x047343ad
                                                0x047343bb
                                                0x047343bb
                                                0x047343ad
                                                0x0473436e
                                                0x047343bf
                                                0x047343c5
                                                0x04734463
                                                0x04734463
                                                0x047343ce
                                                0x047343d5
                                                0x047343d9
                                                0x047343df
                                                0x04734475
                                                0x04734479
                                                0x04734491
                                                0x04734491
                                                0x04734479
                                                0x047343e5
                                                0x047343eb
                                                0x047343f4
                                                0x047343f6
                                                0x047343f9
                                                0x047343fc
                                                0x047343ff
                                                0x047344e8
                                                0x047344ed
                                                0x047344f3
                                                0x0477e247
                                                0x00000000
                                                0x047344f9
                                                0x04734504
                                                0x04734508
                                                0x0473450f
                                                0x0477e269
                                                0x00000000
                                                0x04734515
                                                0x04734519
                                                0x04734531
                                                0x04734534
                                                0x04734537
                                                0x0473453e
                                                0x04734541
                                                0x0473454a
                                                0x0477e255
                                                0x0477e255
                                                0x0477e25b
                                                0x0477e25e
                                                0x0477e261
                                                0x0477e261
                                                0x04734555
                                                0x04734559
                                                0x0473455d
                                                0x0477e26d
                                                0x0477e270
                                                0x0477e274
                                                0x0477e27a
                                                0x0477e27d
                                                0x0477e28e
                                                0x0477e28e
                                                0x04734563
                                                0x04734563
                                                0x04734569
                                                0x04734569
                                                0x00000000
                                                0x0473455d
                                                0x0473450f
                                                0x00000000
                                                0x047344f3
                                                0x047343ff
                                                0x04734405
                                                0x04734405
                                                0x04734405
                                                0x047342ac
                                                0x0473428c
                                                0x04734282
                                                0x04734407
                                                0x0473440d
                                                0x0477e2af
                                                0x0477e2af
                                                0x04734413
                                                0x04734413
                                                0x00000000
                                                0x047341d4
                                                0x00000000
                                                0x047341c3
                                                0x047341bd
                                                0x04734415
                                                0x04734415
                                                0x04734416
                                                0x04734417
                                                0x04734429
                                                0x0473416e
                                                0x0473416e
                                                0x04734175
                                                0x04734498
                                                0x0473449f
                                                0x0477e12d
                                                0x00000000
                                                0x0477e133
                                                0x00000000
                                                0x0477e133
                                                0x047344a5
                                                0x047344a5
                                                0x047344aa
                                                0x00000000
                                                0x047344bb
                                                0x047344ca
                                                0x047344d6
                                                0x047344d7
                                                0x047344d8
                                                0x047344e3
                                                0x047344e3
                                                0x047344aa
                                                0x0473417b
                                                0x0473417b
                                                0x0473417b
                                                0x00000000
                                                0x0473417b
                                                0x04734175
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 48a2d05fd8846d4527f89c8c75283d8e3271e53f1d4d2ffdab2ce6cf2c432c8c
                                                • Instruction ID: 3a484d94a3e9cb13625d9411b41c990f7ca2f6003497e34d4669bc83264cdb05
                                                • Opcode Fuzzy Hash: 48a2d05fd8846d4527f89c8c75283d8e3271e53f1d4d2ffdab2ce6cf2c432c8c
                                                • Instruction Fuzzy Hash: DCF18F716083118BCB28CF19C584A3AB7E1FF88759F54496EF886DB351E734E881CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047420A0 Relevance: .4, Instructions: 420COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 92%
                                                			E047420A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4808714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E04742EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E04742EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E047158EC(_t240);
									_t221 =  *0x4805cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4805cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E04754A2C(0x4806e40, 0x4754b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E04737D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x46f5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0474F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0474F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E04797016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L04732400(_t267 + 0x20);
															}
															L04732400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E04742397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E04732280(_t134, 0x4808608);
									__eflags =  *0x4806e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0472FFB0(_t198, _t241, 0x4808608);
										__eflags = _t253;
										if(_t253 != 0) {
											L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4806e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4808608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E04746B90(_t210,  &_v64);
										_t262 =  *0x4808608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0474E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E047597C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E0475006A(0x4808608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4808608);
												E0475B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4806904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4806e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E0472FFB0(_t198, _t240, 0x4808608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E047500C2(0x4808608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}











































































                                                0x047420a0
                                                0x047420a8
                                                0x047420ad
                                                0x047420b3
                                                0x047420b8
                                                0x047420c2
                                                0x047420c7
                                                0x047420cb
                                                0x047420d2
                                                0x04742263
                                                0x04742266
                                                0x04785836
                                                0x04785836
                                                0x00000000
                                                0x0474226c
                                                0x0474226c
                                                0x04742270
                                                0x04742274
                                                0x047420e2
                                                0x047420e2
                                                0x047420e6
                                                0x047420ee
                                                0x047857dc
                                                0x047857de
                                                0x047857ec
                                                0x047857ec
                                                0x047857f1
                                                0x047857f3
                                                0x047857f8
                                                0x00000000
                                                0x047857f8
                                                0x047857e0
                                                0x047857e4
                                                0x047857ea
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047857ea
                                                0x047420f4
                                                0x047420f4
                                                0x047420f8
                                                0x047420f8
                                                0x047420fc
                                                0x04742100
                                                0x04742106
                                                0x04742201
                                                0x04742206
                                                0x0474220b
                                                0x0474220e
                                                0x047422a9
                                                0x047422ac
                                                0x00000000
                                                0x00000000
                                                0x047422b2
                                                0x047422b5
                                                0x04785801
                                                0x04785806
                                                0x00000000
                                                0x00000000
                                                0x04785810
                                                0x04785815
                                                0x04785818
                                                0x00000000
                                                0x00000000
                                                0x0478581e
                                                0x047422bb
                                                0x047422bb
                                                0x04742218
                                                0x04742218
                                                0x0474221c
                                                0x04742220
                                                0x04742222
                                                0x047422c2
                                                0x047422c4
                                                0x047422dc
                                                0x047422dc
                                                0x047422e1
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047422e7
                                                0x047422c8
                                                0x047422cd
                                                0x047422d3
                                                0x047422d6
                                                0x04785823
                                                0x04785825
                                                0x04785827
                                                0x00000000
                                                0x00000000
                                                0x0478582d
                                                0x00000000
                                                0x0478582d
                                                0x00000000
                                                0x04742228
                                                0x04742228
                                                0x00000000
                                                0x04742228
                                                0x04742222
                                                0x04742214
                                                0x04742214
                                                0x00000000
                                                0x04742114
                                                0x04742114
                                                0x04742114
                                                0x0474211a
                                                0x0474211c
                                                0x04742348
                                                0x0474234d
                                                0x04785840
                                                0x04785845
                                                0x04785848
                                                0x0478584e
                                                0x0478584e
                                                0x04785848
                                                0x04742353
                                                0x04742355
                                                0x04742388
                                                0x04742388
                                                0x04742368
                                                0x0474236a
                                                0x0474236c
                                                0x0474238f
                                                0x00000000
                                                0x0474236e
                                                0x0474236e
                                                0x0474218e
                                                0x0474218e
                                                0x04742191
                                                0x04742195
                                                0x04785a03
                                                0x04785a06
                                                0x04785a0c
                                                0x04785a0f
                                                0x04785a11
                                                0x04785a13
                                                0x04785a13
                                                0x04785a19
                                                0x04785a1f
                                                0x00000000
                                                0x0474219b
                                                0x0474219b
                                                0x047421a0
                                                0x04742282
                                                0x04742284
                                                0x04742284
                                                0x04742284
                                                0x04742284
                                                0x047421a6
                                                0x047421a9
                                                0x047421ac
                                                0x047421ae
                                                0x047421b3
                                                0x0474228b
                                                0x04742290
                                                0x04742379
                                                0x04742296
                                                0x04742298
                                                0x04742298
                                                0x04742290
                                                0x047421b9
                                                0x047421be
                                                0x047422a2
                                                0x047422a2
                                                0x047421c4
                                                0x047421c8
                                                0x047421cc
                                                0x047421d0
                                                0x047421d4
                                                0x047421de
                                                0x047421e3
                                                0x04785a29
                                                0x04785a2c
                                                0x00000000
                                                0x00000000
                                                0x04785a3b
                                                0x00000000
                                                0x047421e9
                                                0x047421e9
                                                0x047421e9
                                                0x047421ee
                                                0x047421f1
                                                0x04785a45
                                                0x04785a4b
                                                0x04785a52
                                                0x04785a58
                                                0x04785a5d
                                                0x04785a5f
                                                0x04785a71
                                                0x04785a61
                                                0x04785a6a
                                                0x04785a6a
                                                0x04785a76
                                                0x04785a79
                                                0x04785a7f
                                                0x04785a83
                                                0x04785a85
                                                0x04785a87
                                                0x04785a87
                                                0x04785a8c
                                                0x04785a91
                                                0x04785a97
                                                0x04785a9f
                                                0x04785aa0
                                                0x04785aa1
                                                0x04785aa6
                                                0x04785aab
                                                0x04785ab1
                                                0x04785ab3
                                                0x04785ab9
                                                0x04785aca
                                                0x04785ad4
                                                0x04785ad4
                                                0x04785ade
                                                0x04785ade
                                                0x04785aab
                                                0x04785a79
                                                0x04785a52
                                                0x047421f7
                                                0x047421f9
                                                0x047421fe
                                                0x047421fe
                                                0x047421e3
                                                0x04742195
                                                0x0474236c
                                                0x04742122
                                                0x04742122
                                                0x04742124
                                                0x04742231
                                                0x04742236
                                                0x04742236
                                                0x04742238
                                                0x04742238
                                                0x04742240
                                                0x04742242
                                                0x04742244
                                                0x047859fc
                                                0x0474218c
                                                0x0474218c
                                                0x00000000
                                                0x0474218c
                                                0x0474224a
                                                0x0474224f
                                                0x04742256
                                                0x04742304
                                                0x04742309
                                                0x0474230f
                                                0x0474231e
                                                0x0474231e
                                                0x0474231e
                                                0x04742320
                                                0x04742325
                                                0x0474232a
                                                0x0474232c
                                                0x0474233e
                                                0x0474233e
                                                0x00000000
                                                0x0474232c
                                                0x04742311
                                                0x04742317
                                                0x0474231a
                                                0x0474231c
                                                0x04742380
                                                0x04742380
                                                0x04742380
                                                0x04742384
                                                0x00000000
                                                0x00000000
                                                0x04742386
                                                0x00000000
                                                0x0474231c
                                                0x0474225c
                                                0x0474225c
                                                0x00000000
                                                0x0474225c
                                                0x0474212a
                                                0x04742134
                                                0x04742138
                                                0x0474213d
                                                0x04785858
                                                0x04785863
                                                0x04785863
                                                0x04785867
                                                0x0478586a
                                                0x00000000
                                                0x00000000
                                                0x0478586c
                                                0x0478586c
                                                0x04785871
                                                0x04785875
                                                0x04785877
                                                0x04785997
                                                0x0478599c
                                                0x047859a1
                                                0x047859a7
                                                0x047859a7
                                                0x00000000
                                                0x047859a7
                                                0x0478587d
                                                0x00000000
                                                0x0478588b
                                                0x0478588b
                                                0x04785890
                                                0x04785892
                                                0x04785894
                                                0x04785899
                                                0x0478589b
                                                0x047858a0
                                                0x047858a0
                                                0x047858aa
                                                0x047858b2
                                                0x047858b6
                                                0x047858be
                                                0x047858c6
                                                0x047858c9
                                                0x0478590d
                                                0x04785917
                                                0x0478591a
                                                0x0478591c
                                                0x04785920
                                                0x04785928
                                                0x0478592a
                                                0x0478592c
                                                0x0478592e
                                                0x0478592e
                                                0x047858cb
                                                0x047858cd
                                                0x047858d8
                                                0x047858e0
                                                0x047858f4
                                                0x047858fe
                                                0x047858fe
                                                0x0478593a
                                                0x0478593e
                                                0x04785940
                                                0x04785942
                                                0x00000000
                                                0x04785944
                                                0x04785944
                                                0x04785949
                                                0x0478594e
                                                0x0478594e
                                                0x04785953
                                                0x0478595b
                                                0x04785976
                                                0x04785976
                                                0x0478597a
                                                0x0478597f
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04785981
                                                0x04785981
                                                0x04785981
                                                0x04785983
                                                0x04785988
                                                0x0478598d
                                                0x04785991
                                                0x04785991
                                                0x00000000
                                                0x0478595d
                                                0x0478595d
                                                0x04785963
                                                0x04785965
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04785967
                                                0x04785967
                                                0x0478596b
                                                0x0478596d
                                                0x00000000
                                                0x00000000
                                                0x0478596f
                                                0x04785971
                                                0x04785971
                                                0x04785974
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04785974
                                                0x00000000
                                                0x04785967
                                                0x0478595b
                                                0x04785942
                                                0x04785863
                                                0x04742143
                                                0x04742143
                                                0x04742149
                                                0x0474214f
                                                0x047422f1
                                                0x047422f6
                                                0x00000000
                                                0x04742173
                                                0x04742173
                                                0x0474217d
                                                0x04742181
                                                0x04742186
                                                0x047859ae
                                                0x047859b2
                                                0x047859b5
                                                0x047859b7
                                                0x047859ba
                                                0x047859cd
                                                0x047859d1
                                                0x047859d5
                                                0x047859d9
                                                0x047859db
                                                0x00000000
                                                0x00000000
                                                0x047859dd
                                                0x047859dd
                                                0x047859e1
                                                0x047859e4
                                                0x047859e7
                                                0x047859ee
                                                0x047859ee
                                                0x047859f3
                                                0x047859f3
                                                0x00000000
                                                0x04742186
                                                0x0474214f
                                                0x04742106
                                                0x04742266
                                                0x047420d8
                                                0x047420da
                                                0x047420e0
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f29131fd62adf730f01b5424642a00cb8c7b60f39904c9584a1c3193fdfa2d47
                                                • Instruction ID: 5595821791f2fd581a78c51c8c4842ca0cd8514724183c7be2269b5afb1dd87b
                                                • Opcode Fuzzy Hash: f29131fd62adf730f01b5424642a00cb8c7b60f39904c9584a1c3193fdfa2d47
                                                • Instruction Fuzzy Hash: 7FF1CF31608341AFE725DF29C84473A7BE1ABC53A4F05899DF9959B382E734F851CB82
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472B090 Relevance: .4, Instructions: 405COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 99%
                                                			E0472B090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t5 = _t161 + 4; // 0x4
				_t117 =  *_t5 & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t14 = _t161 + 4; // 0x4
						_t177 =  *_t14;
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t19 = _t161 + 4; // 0x4
						_t165 =  *_t19 & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x8
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t40 = _t174 + 4; // 0x4
							_t117 =  *_t178;
							_t165 =  *_t40 & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}








































                                                0x0472b095
                                                0x0472b09b
                                                0x0472b09f
                                                0x0472b0a5
                                                0x0472b0a7
                                                0x0472b0aa
                                                0x0472b0ad
                                                0x0472b0b1
                                                0x0472b3f8
                                                0x0472b3fa
                                                0x0472b3ff
                                                0x0472b419
                                                0x0472b41b
                                                0x0472b41b
                                                0x0472b401
                                                0x00000000
                                                0x0472b0b7
                                                0x0472b0b9
                                                0x0472b0bc
                                                0x0472b0c0
                                                0x0472b0c2
                                                0x0472b0c2
                                                0x0472b0c4
                                                0x0472b0c8
                                                0x0472b0cf
                                                0x0472b0d1
                                                0x0472b0d1
                                                0x0472b0da
                                                0x0472b0dd
                                                0x0472b0df
                                                0x0472b0df
                                                0x0472b0e4
                                                0x0472b0e9
                                                0x0472b3e2
                                                0x0472b3e5
                                                0x0472b3eb
                                                0x0477a676
                                                0x0477a67b
                                                0x0477a67d
                                                0x0472b3f1
                                                0x0472b3f1
                                                0x0472b3f1
                                                0x0472b0ef
                                                0x0472b0ef
                                                0x0472b0ef
                                                0x0472b0e9
                                                0x0472b0f6
                                                0x0472b28d
                                                0x0472b28e
                                                0x0472b293
                                                0x0472b0fc
                                                0x0472b0fc
                                                0x0472b101
                                                0x0472b104
                                                0x0472b107
                                                0x0472b10c
                                                0x0477a687
                                                0x0477a68d
                                                0x0477a68d
                                                0x0477a687
                                                0x0472b112
                                                0x0472b116
                                                0x0477a696
                                                0x0477a69c
                                                0x0477a69c
                                                0x0477a696
                                                0x0472b120
                                                0x0472b121
                                                0x0472b124
                                                0x0472b127
                                                0x0472b12a
                                                0x0472b12d
                                                0x0472b132
                                                0x0477a6a5
                                                0x00000000
                                                0x00000000
                                                0x0477a6ab
                                                0x00000000
                                                0x0472b138
                                                0x0472b138
                                                0x0472b13a
                                                0x0472b193
                                                0x0472b197
                                                0x0472b19d
                                                0x0472b29c
                                                0x0472b29f
                                                0x0472b2a2
                                                0x0472b2a7
                                                0x0477a6d2
                                                0x0477a6d8
                                                0x0477a6d8
                                                0x0477a6d2
                                                0x0472b2af
                                                0x0472b420
                                                0x0472b422
                                                0x0472b423
                                                0x00000000
                                                0x0472b2b5
                                                0x0472b2b5
                                                0x0472b2ba
                                                0x0477a6e1
                                                0x0477a6e7
                                                0x0477a6e7
                                                0x0477a6e1
                                                0x0472b2c2
                                                0x00000000
                                                0x0472b2c8
                                                0x0472b2cb
                                                0x0472b2d0
                                                0x0477a6f0
                                                0x0477a6f6
                                                0x0477a6f6
                                                0x0477a6f0
                                                0x0472b2d8
                                                0x00000000
                                                0x0472b2de
                                                0x0472b2de
                                                0x0472b2de
                                                0x0472b2e1
                                                0x0472b2e6
                                                0x0472b2eb
                                                0x0477a6ff
                                                0x0477a705
                                                0x0477a705
                                                0x0477a6ff
                                                0x0472b2f3
                                                0x00000000
                                                0x0472b2f9
                                                0x0472b2fb
                                                0x0472b2fd
                                                0x0472b301
                                                0x0472b303
                                                0x0472b303
                                                0x0472b308
                                                0x0472b30b
                                                0x0472b310
                                                0x0472b312
                                                0x0472b312
                                                0x0472b31c
                                                0x0472b322
                                                0x0472b327
                                                0x0477a70e
                                                0x0472b335
                                                0x0472b337
                                                0x0477a71d
                                                0x0477a723
                                                0x0477a723
                                                0x0477a71d
                                                0x0472b340
                                                0x0472b345
                                                0x0472b349
                                                0x0477a72a
                                                0x0477a72a
                                                0x0472b352
                                                0x0472b357
                                                0x0472b359
                                                0x0472b359
                                                0x0472b365
                                                0x0472b367
                                                0x0472b36c
                                                0x00000000
                                                0x0472b36c
                                                0x0477a714
                                                0x0477a714
                                                0x0472b32f
                                                0x0472b3b8
                                                0x0472b3bd
                                                0x0472b3c4
                                                0x0472b425
                                                0x0472b427
                                                0x0472b429
                                                0x0472b429
                                                0x0472b427
                                                0x0472b3c8
                                                0x00000000
                                                0x00000000
                                                0x0472b3ce
                                                0x0472b42f
                                                0x0472b3d0
                                                0x0472b3d0
                                                0x0472b3d0
                                                0x0472b3d7
                                                0x0472b3da
                                                0x0472b3da
                                                0x00000000
                                                0x0472b32f
                                                0x0472b2f3
                                                0x0472b2d8
                                                0x0472b2c2
                                                0x0472b2af
                                                0x0472b1a3
                                                0x0472b1a9
                                                0x0472b1af
                                                0x0472b1b2
                                                0x0472b1b5
                                                0x0472b1b8
                                                0x0477a733
                                                0x0477a739
                                                0x0477a739
                                                0x0477a733
                                                0x0472b1c0
                                                0x00000000
                                                0x0472b1c6
                                                0x0472b1c8
                                                0x0472b1cb
                                                0x0472b1ce
                                                0x0472b1d3
                                                0x0477a742
                                                0x0477a748
                                                0x0477a748
                                                0x0477a742
                                                0x0472b1db
                                                0x00000000
                                                0x0472b1e1
                                                0x0472b1e1
                                                0x0472b1e6
                                                0x0472b1e9
                                                0x0472b1ee
                                                0x0477a751
                                                0x0472b409
                                                0x0472b409
                                                0x0472b40e
                                                0x00000000
                                                0x00000000
                                                0x0472b410
                                                0x0472b22d
                                                0x0472b22f
                                                0x0477a790
                                                0x0477a796
                                                0x0477a796
                                                0x0477a790
                                                0x0472b23d
                                                0x0472b243
                                                0x0472b248
                                                0x0477a79f
                                                0x00000000
                                                0x00000000
                                                0x0477a7a5
                                                0x00000000
                                                0x0472b24e
                                                0x0472b24e
                                                0x0472b250
                                                0x0472b374
                                                0x0472b379
                                                0x0472b37e
                                                0x0477a7ae
                                                0x0477a7b4
                                                0x0477a7b4
                                                0x0477a7ae
                                                0x0472b386
                                                0x00000000
                                                0x0472b38c
                                                0x0472b38e
                                                0x0477a7bd
                                                0x0472b394
                                                0x0472b394
                                                0x0472b394
                                                0x0472b39b
                                                0x0472b39e
                                                0x00000000
                                                0x0472b39e
                                                0x0472b386
                                                0x0472b256
                                                0x0472b258
                                                0x0477a7c6
                                                0x0477a7cc
                                                0x0477a7cc
                                                0x0477a7c6
                                                0x0472b261
                                                0x0472b266
                                                0x0472b26a
                                                0x0477a7d3
                                                0x0477a7d3
                                                0x0472b273
                                                0x0472b278
                                                0x0472b27a
                                                0x0472b27a
                                                0x0472b281
                                                0x0472b283
                                                0x0472b285
                                                0x0472b287
                                                0x0472b289
                                                0x00000000
                                                0x0472b289
                                                0x0472b248
                                                0x0477a757
                                                0x0477a757
                                                0x0472b1f6
                                                0x00000000
                                                0x00000000
                                                0x0472b1fc
                                                0x0472b201
                                                0x0477a760
                                                0x0477a766
                                                0x0477a766
                                                0x0477a760
                                                0x0472b209
                                                0x0472b3a8
                                                0x0477a76f
                                                0x0472b3ae
                                                0x0472b3ae
                                                0x0472b3ae
                                                0x0472b3b0
                                                0x00000000
                                                0x0472b20f
                                                0x0472b20f
                                                0x0472b213
                                                0x0477a778
                                                0x0477a77e
                                                0x0477a77e
                                                0x0477a778
                                                0x0472b21b
                                                0x00000000
                                                0x0472b221
                                                0x0472b223
                                                0x0477a787
                                                0x0472b229
                                                0x0472b229
                                                0x0472b229
                                                0x0472b22b
                                                0x00000000
                                                0x0472b22b
                                                0x0472b21b
                                                0x0472b209
                                                0x0472b1db
                                                0x0472b142
                                                0x0472b142
                                                0x0472b146
                                                0x0472b148
                                                0x0472b14c
                                                0x0472b14f
                                                0x0472b154
                                                0x0472b15b
                                                0x0477a6b4
                                                0x00000000
                                                0x00000000
                                                0x0477a6ba
                                                0x0477a6ba
                                                0x0472b163
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472b163
                                                0x0472b13a
                                                0x0472b169
                                                0x0472b16b
                                                0x0472b16e
                                                0x0472b171
                                                0x0472b175
                                                0x0472b178
                                                0x0477a6c3
                                                0x0477a6c9
                                                0x0477a6c9
                                                0x0477a6c3
                                                0x0472b180
                                                0x0472b184
                                                0x00000000
                                                0x0472b104
                                                0x0472b0f6

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
                                                • Instruction ID: 14a2fc09e3bb89fdda3b087aa6706ac1cca66442bef3330c5a45233e4ddf5570
                                                • Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
                                                • Instruction Fuzzy Hash: 64D1E031B147268BDF25CE2ACBC036AB7E5AF85354B288568DC65CB346E731F841D790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04710D20 Relevance: .4, Instructions: 372COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 99%
                                                			E04710D20(signed short* _a4, signed char _a8, unsigned int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				unsigned int _v100;
				signed int _t159;
				unsigned int _t160;
				signed int _t162;
				unsigned int _t163;
				signed int _t180;
				signed int _t192;
				signed int _t193;
				unsigned int _t194;
				signed char _t196;
				signed int _t197;
				signed char _t198;
				signed char _t199;
				unsigned int _t200;
				unsigned int _t202;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t209;
				signed int _t210;
				signed int _t211;
				unsigned int _t212;
				signed char _t213;
				signed short* _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				unsigned int _t218;
				signed int _t220;
				signed int _t221;
				signed short _t223;
				signed char _t224;
				signed int _t229;
				signed int _t231;
				unsigned int _t233;
				unsigned int _t237;
				signed int _t238;
				unsigned int _t239;
				signed int _t240;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				void* _t261;

				_t213 = _a8;
				_t159 = 0;
				_v60 = 0;
				_t237 = _t213 >> 1;
				_t210 = 0;
				_t257 = 0;
				_v56 = 0;
				_v52 = 0;
				_v44 = 0;
				_v48 = 0;
				_v92 = 0;
				_v88 = 0;
				_v76 = 0;
				_v72 = 0;
				_v64 = 0;
				_v68 = 0;
				_v24 = 0;
				_v80 = 0;
				_v84 = 0;
				_v28 = 0;
				_v32 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v100 = _t237;
				if(_t237 > 0x100) {
					_t254 = 0x100;
					_v36 = 0x100;
					L2:
					_t261 = _t213 - 2;
					if(_t261 == 0) {
						_t214 = _a4;
						_t160 =  *_t214 & 0x0000ffff;
						__eflags = _t160;
						if(_t160 == 0) {
							L108:
							_t159 = 0;
							L8:
							_t238 = 0;
							_v96 = 0;
							if(_t254 == 0) {
								L30:
								_v24 = _t159 - 1;
								goto L31;
							} else {
								goto L11;
								L13:
								_t224 = _t223 >> 8;
								_v40 = _t224;
								_t256 = _t224 & 0x000000ff;
								_t196 = _a4[_t238];
								_v5 = _t196;
								_t197 = _t196 & 0x000000ff;
								if(_t197 == 0xd) {
									__eflags = _t257 - 0xa;
									if(_t257 == 0xa) {
										_v12 = _v12 + 1;
									}
								} else {
									if(_t197 == 0xa) {
										__eflags = _t257 - 0xd;
										if(_t257 == 0xd) {
											_v12 = _v12 + 1;
										}
									}
								}
								_v24 = (0 | _t256 == 0x00000000) + _v24 + (0 | _t197 == 0x00000000);
								if(_t256 > _t257) {
									_t229 = _t256;
								} else {
									_t229 = _t257;
								}
								if(_t257 >= _t256) {
									_t257 = _t256;
								}
								_v28 = _v28 + _t229 - _t257;
								_t231 = _t197;
								if(_t197 <= _t210) {
									_t231 = _t210;
								}
								if(_t210 >= _t197) {
									_t210 = _t197;
								}
								_v32 = _v32 + _t231 - _t210;
								_t238 = _v96 + 1;
								_t210 = _t197;
								_t257 = _t256;
								_v96 = _t238;
								if(_t238 < _v36) {
									_t214 = _a4;
									L11:
									_t223 = _t214[_t238] & 0x0000ffff;
									_t193 = _t223 & 0x0000ffff;
									if(_t193 >= 0x900 || _t193 < 0x21) {
										goto L58;
									} else {
										goto L13;
									}
								}
								_t198 = _v5;
								if(_t198 == 0xd) {
									_t199 = _v40;
									__eflags = _t199 - 0xa;
									if(_t199 != 0xa) {
										L27:
										_t233 = _v12;
										L28:
										if(_t199 != 0) {
											__eflags = _t199 - 0x1a;
											if(_t199 == 0x1a) {
												_v12 = _t233 + 1;
											}
											L31:
											_t162 = _a8;
											if(_t162 > 0x200) {
												_t255 = 0x200;
											} else {
												_t255 = _t162;
											}
											_t215 =  *0x4806d59; // 0x0
											if(_t215 != 0) {
												_t239 = 0;
												__eflags = _t255;
												if(_t255 == 0) {
													goto L34;
												} else {
													goto L119;
												}
												do {
													L119:
													_t192 =  *(_a4 + _t239) & 0x000000ff;
													__eflags =  *((short*)(0x4806920 + _t192 * 2));
													_t163 = _v20;
													if( *((short*)(0x4806920 + _t192 * 2)) != 0) {
														_t163 = _t163 + 1;
														_t239 = _t239 + 1;
														__eflags = _t239;
														_v20 = _t163;
													}
													_t239 = _t239 + 1;
													__eflags = _t239 - _t255;
												} while (_t239 < _t255);
												goto L35;
											} else {
												L34:
												_t163 = 0;
												L35:
												_t240 = _v32;
												_t211 = _v28;
												if(_t240 < 0x7f) {
													__eflags = _t211;
													if(_t211 != 0) {
														L37:
														if(_t240 == 0) {
															_v16 = 0x10;
														}
														L38:
														_t258 = _a12;
														if(_t215 != 0) {
															__eflags = _t163;
															if(_t163 == 0) {
																goto L39;
															}
															__eflags = _t258;
															if(_t258 == 0) {
																goto L39;
															}
															__eflags =  *_t258 & 0x00000400;
															if(( *_t258 & 0x00000400) == 0) {
																goto L39;
															}
															_t218 = _v100;
															__eflags = _t218 - 0x100;
															if(_t218 > 0x100) {
																_t218 = 0x100;
															}
															_t220 = (_t218 >> 1) - 1;
															__eflags = _v20 - 0xaaaaaaab * _t220 >> 0x20 >> 1;
															if(_v20 >= 0xaaaaaaab * _t220 >> 0x20 >> 1) {
																_t221 = _t220 + _t220;
																__eflags = _v20 - 0xaaaaaaab * _t221 >> 0x20 >> 1;
																asm("sbb ecx, ecx");
																_t216 =  ~_t221 + 1;
																__eflags = _t216;
															} else {
																_t216 = 3;
															}
															_v16 = _v16 | 0x00000400;
															_t240 = _v32;
															L40:
															if(_t211 * _t216 < _t240) {
																_v16 = _v16 | 0x00000002;
															}
															_t217 = _v16;
															if(_t240 * _t216 < _t211) {
																_t217 = _t217 | 0x00000020;
															}
															if(_v44 + _v48 + _v52 + _v56 + _v60 != 0) {
																_t217 = _t217 | 0x00000004;
															}
															if(_v64 + _v68 + _v72 + _v76 != 0) {
																_t217 = _t217 | 0x00000040;
															}
															if(_v80 + _v84 + _v88 + _v92 == 0) {
																_t212 = _v12;
																__eflags = _t212;
																if(_t212 == 0) {
																	goto L48;
																}
																__eflags = _t212 - 0xcccccccd * _t255 >> 0x20 >> 5;
																if(_t212 >= 0xcccccccd * _t255 >> 0x20 >> 5) {
																	goto L47;
																}
																goto L48;
															} else {
																L47:
																_t217 = _t217 | 0x00000100;
																L48:
																if((_a8 & 0x00000001) != 0) {
																	_t217 = _t217 | 0x00000200;
																}
																if(_v24 != 0) {
																	_t217 = _t217 | 0x00001000;
																}
																_t180 =  *_a4 & 0x0000ffff;
																if(_t180 != 0xfeff) {
																	__eflags = _t180 - 0xfffe;
																	if(_t180 == 0xfffe) {
																		_t217 = _t217 | 0x00000080;
																	}
																} else {
																	_t217 = _t217 | 0x00000008;
																}
																if(_t258 != 0) {
																	 *_t258 =  *_t258 & _t217;
																	_t217 =  *_t258;
																}
																if((_t217 & 0x00000b08) != 8) {
																	__eflags = _t217 & 0x000000f0;
																	if((_t217 & 0x000000f0) != 0) {
																		L84:
																		return 0;
																	}
																	__eflags = _t217 & 0x00000f00;
																	if((_t217 & 0x00000f00) == 0) {
																		__eflags = _t217 & 0x0000f00f;
																		if((_t217 & 0x0000f00f) == 0) {
																			goto L84;
																		}
																		goto L56;
																	}
																	goto L84;
																} else {
																	L56:
																	return 1;
																}
															}
														}
														L39:
														_t216 = 3;
														goto L40;
													}
													_v16 = 1;
													goto L38;
												}
												if(_t211 == 0) {
													goto L38;
												}
												goto L37;
											}
										} else {
											_t159 = _v24;
											goto L30;
										}
									}
									L104:
									_t233 = _v12 + 1;
									_v12 = _t233;
									goto L28;
								}
								_t199 = _v40;
								if(_t198 != 0xa || _t199 != 0xd) {
									goto L27;
								} else {
									goto L104;
								}
								L58:
								__eflags = _t193 - 0x3001;
								if(_t193 < 0x3001) {
									L60:
									__eflags = _t193 - 0xd00;
									if(__eflags > 0) {
										__eflags = _t193 - 0x3000;
										if(__eflags > 0) {
											_t194 = _t193 - 0xfeff;
											__eflags = _t194;
											if(_t194 != 0) {
												_t200 = _t194 - 0xff;
												__eflags = _t200;
												if(_t200 == 0) {
													_v88 = _v88 + 1;
												} else {
													__eflags = _t200 == 1;
													if(_t200 == 1) {
														_v92 = _v92 + 1;
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v48 = _v48 + 1;
											} else {
												_t202 = _t193 - 0x2000;
												__eflags = _t202;
												if(_t202 == 0) {
													_v68 = _v68 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v76 = _v76 + 1;
										goto L13;
									}
									__eflags = _t193 - 0x20;
									if(__eflags > 0) {
										_t204 = _t193 - 0x900;
										__eflags = _t204;
										if(_t204 == 0) {
											_v64 = _v64 + 1;
										} else {
											_t205 = _t204 - 0x100;
											__eflags = _t205;
											if(_t205 == 0) {
												_v72 = _v72 + 1;
											} else {
												__eflags = _t205 == 0xd;
												if(_t205 == 0xd) {
													_v84 = _v84 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v44 = _v44 + 1;
										goto L13;
									}
									__eflags = _t193 - 0xd;
									if(_t193 > 0xd) {
										goto L13;
									}
									_t84 = _t193 + 0x4711174; // 0x4040400
									switch( *((intOrPtr*)(( *_t84 & 0x000000ff) * 4 +  &M04711160))) {
										case 0:
											_v80 = _v80 + 1;
											goto L13;
										case 1:
											_v52 = _v52 + 1;
											goto L13;
										case 2:
											_v56 = _v56 + 1;
											goto L13;
										case 3:
											_v60 = _v60 + 1;
											goto L13;
										case 4:
											goto L13;
									}
								}
								__eflags = _t193 - 0xfeff;
								if(_t193 < 0xfeff) {
									goto L13;
								}
								goto L60;
							}
						}
						__eflags = _t160 >> 8;
						if(_t160 >> 8 == 0) {
							L101:
							_t209 = _a12;
							__eflags = _t209;
							if(_t209 != 0) {
								 *_t209 = 5;
							}
							goto L84;
						}
						goto L108;
					}
					if(_t261 <= 0 || _t237 > 0x100) {
						_t214 = _a4;
					} else {
						_t214 = _a4;
						if((_t213 & 0x00000001) == 0 && ( *(_t214 + _t254 * 2 - 2) & 0x0000ff00) == 0) {
							_t254 = _t254 - 1;
							_v36 = _t254;
						}
					}
					goto L8;
				}
				_t254 = _t237;
				_v36 = _t254;
				if(_t254 == 0) {
					goto L101;
				}
				goto L2;
			}






































































                                                0x04710d2b
                                                0x04710d2e
                                                0x04710d32
                                                0x04710d39
                                                0x04710d3b
                                                0x04710d3d
                                                0x04710d3f
                                                0x04710d46
                                                0x04710d4d
                                                0x04710d54
                                                0x04710d5b
                                                0x04710d62
                                                0x04710d69
                                                0x04710d70
                                                0x04710d77
                                                0x04710d7e
                                                0x04710d85
                                                0x04710d88
                                                0x04710d8b
                                                0x04710d8e
                                                0x04710d91
                                                0x04710d94
                                                0x04710d97
                                                0x04710d9a
                                                0x04710d9d
                                                0x04710da6
                                                0x047110e9
                                                0x047110ee
                                                0x04710db9
                                                0x04710db9
                                                0x04710dbc
                                                0x0476e9c7
                                                0x0476e9ca
                                                0x0476e9cd
                                                0x0476e9d0
                                                0x0476e9dd
                                                0x0476e9dd
                                                0x04710dec
                                                0x04710dec
                                                0x04710dee
                                                0x04710df3
                                                0x04710ebf
                                                0x04710ec0
                                                0x00000000
                                                0x04710df9
                                                0x04710df9
                                                0x04710e1e
                                                0x04710e21
                                                0x04710e24
                                                0x04710e27
                                                0x04710e2a
                                                0x04710e2d
                                                0x04710e30
                                                0x04710e36
                                                0x04711040
                                                0x04711043
                                                0x04711049
                                                0x04711049
                                                0x04710e3c
                                                0x04710e3f
                                                0x04711007
                                                0x0471100a
                                                0x04711010
                                                0x04711010
                                                0x0471100a
                                                0x04710e3f
                                                0x04710e58
                                                0x04710e5d
                                                0x04711000
                                                0x04710e63
                                                0x04710e63
                                                0x04710e63
                                                0x04710e67
                                                0x04710e69
                                                0x04710e69
                                                0x04710e6d
                                                0x04710e70
                                                0x04710e74
                                                0x04710e76
                                                0x04710e76
                                                0x04710e7a
                                                0x04710e7c
                                                0x04710e7c
                                                0x04710e83
                                                0x04710e86
                                                0x04710e87
                                                0x04710e89
                                                0x04710e8b
                                                0x04710e91
                                                0x04710e00
                                                0x04710e03
                                                0x04710e03
                                                0x04710e07
                                                0x04710e0f
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710e0f
                                                0x04710e97
                                                0x04710e9c
                                                0x0471113e
                                                0x04711141
                                                0x04711143
                                                0x04710eb1
                                                0x04710eb1
                                                0x04710eb4
                                                0x04710eb6
                                                0x04711110
                                                0x04711112
                                                0x0476ea25
                                                0x0476ea25
                                                0x04710ec3
                                                0x04710ec3
                                                0x04710ecb
                                                0x047110fe
                                                0x04710ed1
                                                0x04710ed1
                                                0x04710ed1
                                                0x04710ed3
                                                0x04710edb
                                                0x0476ea2d
                                                0x0476ea2f
                                                0x0476ea31
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0476ea37
                                                0x0476ea37
                                                0x0476ea3a
                                                0x0476ea3e
                                                0x0476ea47
                                                0x0476ea4a
                                                0x0476ea4c
                                                0x0476ea4d
                                                0x0476ea4d
                                                0x0476ea4e
                                                0x0476ea4e
                                                0x0476ea51
                                                0x0476ea52
                                                0x0476ea52
                                                0x00000000
                                                0x04710ee1
                                                0x04710ee1
                                                0x04710ee1
                                                0x04710ee3
                                                0x04710ee3
                                                0x04710ee6
                                                0x04710eec
                                                0x0476ea5b
                                                0x0476ea5d
                                                0x04710ef6
                                                0x04710ef8
                                                0x0476ea6f
                                                0x0476ea6f
                                                0x04710efe
                                                0x04710efe
                                                0x04710f03
                                                0x0476ea7b
                                                0x0476ea7d
                                                0x00000000
                                                0x00000000
                                                0x0476ea83
                                                0x0476ea85
                                                0x00000000
                                                0x00000000
                                                0x0476ea8b
                                                0x0476ea91
                                                0x00000000
                                                0x00000000
                                                0x0476ea97
                                                0x0476ea9a
                                                0x0476eaa0
                                                0x0476eaa2
                                                0x0476eaa2
                                                0x0476eaae
                                                0x0476eab3
                                                0x0476eab6
                                                0x0476eabf
                                                0x0476eaca
                                                0x0476eacd
                                                0x0476ead1
                                                0x0476ead1
                                                0x0476eab8
                                                0x0476eab8
                                                0x0476eab8
                                                0x0476ead2
                                                0x0476ead9
                                                0x04710f0e
                                                0x04710f15
                                                0x04710f17
                                                0x04710f17
                                                0x04710f1e
                                                0x04710f23
                                                0x0476eae1
                                                0x0476eae1
                                                0x04710f38
                                                0x04710f3a
                                                0x04710f3a
                                                0x04710f49
                                                0x04711108
                                                0x04711108
                                                0x04710f5b
                                                0x047110c7
                                                0x047110ca
                                                0x047110cc
                                                0x00000000
                                                0x00000000
                                                0x047110dc
                                                0x047110de
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710f61
                                                0x04710f61
                                                0x04710f61
                                                0x04710f67
                                                0x04710f6b
                                                0x0471111d
                                                0x0471111d
                                                0x04710f75
                                                0x04710f77
                                                0x04710f77
                                                0x04710f85
                                                0x04710f8b
                                                0x047110b9
                                                0x047110bc
                                                0x0476eae9
                                                0x0476eae9
                                                0x04710f91
                                                0x04710f91
                                                0x04710f91
                                                0x04710f96
                                                0x04710f98
                                                0x04710f9a
                                                0x04710f9a
                                                0x04710fa6
                                                0x0471107c
                                                0x0471107f
                                                0x0471108d
                                                0x00000000
                                                0x0471108d
                                                0x04711081
                                                0x04711087
                                                0x0476eaf4
                                                0x0476eafa
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0476eb00
                                                0x00000000
                                                0x04710fac
                                                0x04710fac
                                                0x00000000
                                                0x04710fac
                                                0x04710fa6
                                                0x04710f5b
                                                0x04710f09
                                                0x04710f09
                                                0x00000000
                                                0x04710f09
                                                0x0476ea63
                                                0x00000000
                                                0x0476ea63
                                                0x04710ef4
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710ef4
                                                0x04710ebc
                                                0x04710ebc
                                                0x00000000
                                                0x04710ebc
                                                0x04710eb6
                                                0x04711149
                                                0x0471114c
                                                0x0471114d
                                                0x00000000
                                                0x0471114d
                                                0x04710ea4
                                                0x04710ea7
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710fb7
                                                0x04710fb7
                                                0x04710fbc
                                                0x04710fc9
                                                0x04710fc9
                                                0x04710fce
                                                0x04711020
                                                0x04711025
                                                0x04711094
                                                0x04711094
                                                0x04711099
                                                0x0476ea04
                                                0x0476ea04
                                                0x0476ea09
                                                0x0476ea1c
                                                0x0476ea0b
                                                0x0476ea0b
                                                0x0476ea0e
                                                0x0476ea14
                                                0x0476ea14
                                                0x0476ea0e
                                                0x0476ea09
                                                0x04711027
                                                0x04711027
                                                0x04711155
                                                0x0471102d
                                                0x0471102d
                                                0x0471102d
                                                0x04711032
                                                0x0476e9fc
                                                0x0476e9fc
                                                0x04711032
                                                0x04711027
                                                0x00000000
                                                0x04711025
                                                0x04710fd0
                                                0x0476e9f4
                                                0x00000000
                                                0x0476e9f4
                                                0x04710fd6
                                                0x04710fd9
                                                0x04711059
                                                0x04711059
                                                0x0471105e
                                                0x0476e9ec
                                                0x04711064
                                                0x04711064
                                                0x04711064
                                                0x04711069
                                                0x047110ac
                                                0x0471106b
                                                0x0471106b
                                                0x0471106e
                                                0x04711074
                                                0x04711074
                                                0x0471106e
                                                0x04711069
                                                0x00000000
                                                0x0471105e
                                                0x04710fdb
                                                0x047110a4
                                                0x00000000
                                                0x047110a4
                                                0x04710fe1
                                                0x04710fe4
                                                0x00000000
                                                0x00000000
                                                0x04710fea
                                                0x04710ff1
                                                0x00000000
                                                0x04710ff8
                                                0x00000000
                                                0x00000000
                                                0x0476e9e4
                                                0x00000000
                                                0x00000000
                                                0x04711018
                                                0x00000000
                                                0x00000000
                                                0x04711051
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710ff1
                                                0x04710fbe
                                                0x04710fc3
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04710fc3
                                                0x04710df3
                                                0x0476e9d5
                                                0x0476e9d7
                                                0x04711128
                                                0x04711128
                                                0x0471112b
                                                0x0471112d
                                                0x04711133
                                                0x04711133
                                                0x00000000
                                                0x0471112d
                                                0x00000000
                                                0x0476e9d7
                                                0x04710dc2
                                                0x047110f6
                                                0x04710dd4
                                                0x04710dd7
                                                0x04710dda
                                                0x04710de8
                                                0x04710de9
                                                0x04710de9
                                                0x04710dda
                                                0x00000000
                                                0x04710dc2
                                                0x04710dac
                                                0x04710dae
                                                0x04710db3
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: ab396f49bd8fa9359cb39a9d00f3fd712073c9b01c7730e43e6b9f3266991be0
                                                • Instruction ID: a7df877ed1e25584614f0d20a8056771a0928589cf77d6f3fb83b73550b5140c
                                                • Opcode Fuzzy Hash: ab396f49bd8fa9359cb39a9d00f3fd712073c9b01c7730e43e6b9f3266991be0
                                                • Instruction Fuzzy Hash: C4D1D631E042998BDF28CE6EC5953BDB7B2FB44300F148429D942ABBA5E774B9C5CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472D5E0 Relevance: .4, Instructions: 353COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 87%
                                                			E0472D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x480d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04726600(0x48052d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4807b9c; // 0x0
							_t281 = L04734620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0475F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4807b90; // 0x775e0000
								if(_t384 == 0) {
									_t353 =  *0x4807b8c; // 0x2ac2b60
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E04732280(_t200, 0x48084d8);
									_t277 =  *0x48085f4; // 0x2ac3050
									_t351 =  *0x48085f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x2ac2fe8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0472FFB0(_t287, _t353, 0x48084d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0476CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04726600(0x48052d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04727926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x480b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E0479E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4808472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x480b218; // 0x0
														asm("ror edi, cl");
														 *0x480b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04732280(_t250, 0x48084d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04753898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0472FFB0(_t293, _t353, 0x48084d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E047537F5(_t353, 0);
																}
																E04750413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04749B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E047402D6(_t174);
																}
																L047377F0( *0x4807b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0474C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0472EC7F(_t353);
										L047419B8(_t287, 0, _t353, 0);
										_t200 = E0471F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0475B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x480b2f8; // 0x990000
									if((_t206 |  *0x480b2fc) == 0 || ( *0x480b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x480b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E047C6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E047C6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0472E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0472EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04759730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0472E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04728F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04753C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}








































































































                                                0x0472d5f2
                                                0x0472d5f5
                                                0x0472d5f5
                                                0x0472d5fd
                                                0x0472d600
                                                0x0472d60a
                                                0x0472d60d
                                                0x0472d617
                                                0x0472d61d
                                                0x0472d627
                                                0x0472d62e
                                                0x0472d911
                                                0x0472d913
                                                0x00000000
                                                0x0472d919
                                                0x0472d919
                                                0x0472d919
                                                0x0472d634
                                                0x0472d634
                                                0x0472d634
                                                0x0472d634
                                                0x0472d640
                                                0x0472d8bf
                                                0x00000000
                                                0x0472d646
                                                0x0472d646
                                                0x0472d64d
                                                0x0472d652
                                                0x0477b2fc
                                                0x0477b2fc
                                                0x0477b302
                                                0x0477b33b
                                                0x0477b341
                                                0x00000000
                                                0x0477b304
                                                0x0477b304
                                                0x0477b319
                                                0x0477b31e
                                                0x0477b324
                                                0x0477b326
                                                0x0477b332
                                                0x0477b347
                                                0x0477b34c
                                                0x0477b351
                                                0x0477b35a
                                                0x00000000
                                                0x0477b328
                                                0x0477b328
                                                0x00000000
                                                0x0477b328
                                                0x0477b326
                                                0x0472d658
                                                0x0472d658
                                                0x0472d65b
                                                0x0472d665
                                                0x00000000
                                                0x0472d66b
                                                0x0472d66b
                                                0x0472d66b
                                                0x0472d66b
                                                0x0472d66d
                                                0x0472d672
                                                0x0472d67a
                                                0x00000000
                                                0x00000000
                                                0x0472d680
                                                0x0472d686
                                                0x0472d8ce
                                                0x0472d8d4
                                                0x0472d8dd
                                                0x0472d8e0
                                                0x0472d68c
                                                0x0472d691
                                                0x0472d69d
                                                0x0472d6a2
                                                0x0472d6a7
                                                0x0472d6b0
                                                0x0472d6b5
                                                0x0472d6e0
                                                0x0472d6b7
                                                0x0472d6b7
                                                0x0472d6b9
                                                0x0472d6b9
                                                0x0472d6bb
                                                0x0472d6bd
                                                0x0472d6ce
                                                0x0472d6d0
                                                0x0472d6d2
                                                0x0477b363
                                                0x0477b365
                                                0x00000000
                                                0x0477b36b
                                                0x00000000
                                                0x0477b36b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472d6bf
                                                0x0472d6bf
                                                0x0472d6e5
                                                0x0472d6e7
                                                0x0472d6e9
                                                0x0472d6ec
                                                0x0472d6ec
                                                0x0472d6ef
                                                0x0472d6f5
                                                0x0472d6f9
                                                0x0472d6fb
                                                0x0472d6fd
                                                0x0472d701
                                                0x0472d703
                                                0x0472d70a
                                                0x0472d70a
                                                0x0472d701
                                                0x0472d710
                                                0x0472d710
                                                0x0472d6c1
                                                0x0472d6c1
                                                0x0472d6c6
                                                0x0477b36d
                                                0x0477b36f
                                                0x00000000
                                                0x0477b375
                                                0x0477b375
                                                0x0477b375
                                                0x00000000
                                                0x0477b375
                                                0x00000000
                                                0x0472d6cc
                                                0x0472d6d8
                                                0x0472d6d8
                                                0x0472d6d8
                                                0x00000000
                                                0x0472d6c6
                                                0x0472d6bf
                                                0x00000000
                                                0x0472d6da
                                                0x0472d6da
                                                0x0472d716
                                                0x0472d71b
                                                0x0472d720
                                                0x0472d726
                                                0x0472d726
                                                0x0472d72d
                                                0x00000000
                                                0x0472d733
                                                0x0472d739
                                                0x0472d742
                                                0x0472d750
                                                0x0472d758
                                                0x0472d764
                                                0x0472d776
                                                0x0472d77a
                                                0x0472d783
                                                0x0472d928
                                                0x0472d92c
                                                0x0472d93d
                                                0x0472d944
                                                0x0472d94f
                                                0x0472d954
                                                0x0472d956
                                                0x0472d95f
                                                0x0472d961
                                                0x0472d973
                                                0x0472d973
                                                0x0472d956
                                                0x0472d944
                                                0x0472d92c
                                                0x0472d78b
                                                0x0477b394
                                                0x0472d791
                                                0x0472d798
                                                0x0477b3a3
                                                0x0477b3bb
                                                0x0477b3bb
                                                0x0472d7a5
                                                0x0472d866
                                                0x0472d870
                                                0x0472d884
                                                0x0472d892
                                                0x0472d898
                                                0x0472d89e
                                                0x0472d8a0
                                                0x0472d8a6
                                                0x0472d8ac
                                                0x0472d8ae
                                                0x0472d8b4
                                                0x0472d8b4
                                                0x0472d8ae
                                                0x0472d7a5
                                                0x0472d78b
                                                0x0472d7b1
                                                0x0477b3c5
                                                0x0477b3c5
                                                0x0472d7c3
                                                0x0472d7ca
                                                0x0472d7e5
                                                0x0472d7eb
                                                0x0472d8eb
                                                0x0472d8ed
                                                0x00000000
                                                0x0472d8f3
                                                0x0472d8f3
                                                0x0472d8f3
                                                0x00000000
                                                0x0472d8ed
                                                0x0472d7cc
                                                0x0472d7cc
                                                0x0472d7d2
                                                0x00000000
                                                0x0472d7d4
                                                0x0472d7d4
                                                0x0472d7d7
                                                0x0472d7df
                                                0x0477b3d4
                                                0x0477b3d9
                                                0x0477b3dc
                                                0x0477b3dc
                                                0x0477b3df
                                                0x0477b3e2
                                                0x0477b468
                                                0x0477b46d
                                                0x0477b46f
                                                0x0477b46f
                                                0x0477b475
                                                0x0472d8f8
                                                0x0472d8f9
                                                0x0472d8fd
                                                0x0477b3e8
                                                0x0477b3e8
                                                0x0477b3eb
                                                0x0477b3ed
                                                0x00000000
                                                0x0477b3ef
                                                0x0477b3ef
                                                0x0477b3f1
                                                0x0477b3f4
                                                0x0477b3fe
                                                0x0477b404
                                                0x0477b409
                                                0x0477b40e
                                                0x0477b410
                                                0x0477b410
                                                0x0477b414
                                                0x0477b414
                                                0x0477b41b
                                                0x0477b420
                                                0x0477b423
                                                0x0477b425
                                                0x0477b427
                                                0x0477b42a
                                                0x0477b42d
                                                0x0477b42d
                                                0x0477b42a
                                                0x0477b432
                                                0x0477b436
                                                0x0477b438
                                                0x0477b43b
                                                0x0477b43b
                                                0x0477b449
                                                0x0477b44e
                                                0x0477b454
                                                0x0477b458
                                                0x0477b458
                                                0x0477b45d
                                                0x00000000
                                                0x0477b45d
                                                0x0477b3ed
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472d7df
                                                0x0472d7d2
                                                0x0472d7ca
                                                0x0477b37c
                                                0x0477b37e
                                                0x0477b385
                                                0x0477b38a
                                                0x00000000
                                                0x0477b38a
                                                0x0472d742
                                                0x0472d7f1
                                                0x0472d7f8
                                                0x0477b49b
                                                0x0477b49b
                                                0x0472d800
                                                0x0472d837
                                                0x0472d843
                                                0x0472d845
                                                0x0472d847
                                                0x0472d84a
                                                0x0472d84b
                                                0x0472d84e
                                                0x0472d857
                                                0x0472d802
                                                0x0472d802
                                                0x0472d80d
                                                0x00000000
                                                0x0472d818
                                                0x0472d818
                                                0x0472d824
                                                0x0472d831
                                                0x0477b4a5
                                                0x0477b4ab
                                                0x0477b4b3
                                                0x0477b4b8
                                                0x0477b4bb
                                                0x00000000
                                                0x0477b4c1
                                                0x0477b4c1
                                                0x0477b4c8
                                                0x00000000
                                                0x0477b4ce
                                                0x0477b4d4
                                                0x0477b4e1
                                                0x0477b4e3
                                                0x0477b4e5
                                                0x00000000
                                                0x0477b4eb
                                                0x0477b4f0
                                                0x0477b4f2
                                                0x0472dac9
                                                0x0472dacc
                                                0x0472dacf
                                                0x0472dad1
                                                0x0472dd78
                                                0x0472dd78
                                                0x0472dcf2
                                                0x00000000
                                                0x0472dad7
                                                0x0472dad9
                                                0x0472dadb
                                                0x00000000
                                                0x00000000
                                                0x0472dae1
                                                0x0472dae1
                                                0x0472dae4
                                                0x0472dae6
                                                0x0477b4f9
                                                0x0477b4f9
                                                0x0477b500
                                                0x0472daec
                                                0x0472daec
                                                0x0472daf5
                                                0x0472daf8
                                                0x0472dafb
                                                0x0472db03
                                                0x0472db11
                                                0x0472db16
                                                0x0472db19
                                                0x0472db1b
                                                0x0477b52c
                                                0x0477b531
                                                0x0477b534
                                                0x0472db21
                                                0x0472db21
                                                0x0472db24
                                                0x0472dcd9
                                                0x0472dce2
                                                0x0472dce5
                                                0x0472dd6a
                                                0x0472dd6d
                                                0x00000000
                                                0x0472dd73
                                                0x0477b51a
                                                0x0477b51c
                                                0x0477b51f
                                                0x0477b524
                                                0x00000000
                                                0x0477b524
                                                0x0472dce7
                                                0x0472dce7
                                                0x0472dce7
                                                0x00000000
                                                0x0472dce7
                                                0x00000000
                                                0x0472db2a
                                                0x0472db2c
                                                0x0472db31
                                                0x0472db33
                                                0x0472db36
                                                0x0472db39
                                                0x0472db3b
                                                0x0472db66
                                                0x0472db66
                                                0x0472db3d
                                                0x0472db3d
                                                0x0472db3e
                                                0x0472db46
                                                0x0472db47
                                                0x0472db49
                                                0x0472db4c
                                                0x0472db53
                                                0x0472db55
                                                0x0472db58
                                                0x0472db5a
                                                0x0477b50a
                                                0x0477b50f
                                                0x0477b512
                                                0x0472db60
                                                0x0472db60
                                                0x0472db63
                                                0x0472db63
                                                0x00000000
                                                0x0472db63
                                                0x0472db5a
                                                0x0472db3b
                                                0x0472db24
                                                0x0472db69
                                                0x0472db69
                                                0x0472db6c
                                                0x0472db6f
                                                0x0472db74
                                                0x0477b557
                                                0x0477b557
                                                0x0477b55e
                                                0x0472db7a
                                                0x0472db7c
                                                0x0472db7f
                                                0x0472db82
                                                0x0472db85
                                                0x00000000
                                                0x0472db8b
                                                0x0472db8b
                                                0x0472db8d
                                                0x0472db9b
                                                0x0472db9b
                                                0x0472db9d
                                                0x0472dba0
                                                0x0472dba2
                                                0x0472dba4
                                                0x0472dba7
                                                0x0472dba9
                                                0x0472dbae
                                                0x0472dbae
                                                0x0472dbb1
                                                0x0472dbb4
                                                0x0472dbb4
                                                0x0472dbb7
                                                0x0472dbba
                                                0x0472dcd2
                                                0x0472dcd4
                                                0x00000000
                                                0x0472dbc0
                                                0x0472dbc0
                                                0x0472dbd2
                                                0x0472dbd7
                                                0x0472dbda
                                                0x0472dbdd
                                                0x0472dbdf
                                                0x00000000
                                                0x0472dbe5
                                                0x0472dbe5
                                                0x0472dbee
                                                0x0472dbf1
                                                0x0477b541
                                                0x0477b544
                                                0x00000000
                                                0x0477b546
                                                0x0477b546
                                                0x00000000
                                                0x0477b546
                                                0x0472dbf7
                                                0x0472dbf7
                                                0x0472dbfd
                                                0x0472dbfd
                                                0x0472dbff
                                                0x0472dc0b
                                                0x0472dc15
                                                0x0472dc1b
                                                0x0472dc1d
                                                0x0472dc21
                                                0x0472dc21
                                                0x0472dc23
                                                0x0472dc23
                                                0x0472dc26
                                                0x0472dc29
                                                0x0472dc2b
                                                0x00000000
                                                0x00000000
                                                0x0472dc31
                                                0x0472dc34
                                                0x0472dc36
                                                0x0472dcbf
                                                0x0472dcbf
                                                0x0472dcc2
                                                0x00000000
                                                0x0472dc3c
                                                0x0472dc41
                                                0x0472dc43
                                                0x00000000
                                                0x0472dc45
                                                0x0472dc45
                                                0x0472dc47
                                                0x00000000
                                                0x0472dc4d
                                                0x0472dc4d
                                                0x0472dc50
                                                0x0472dc52
                                                0x0472dc55
                                                0x0472dcfa
                                                0x0472dcfe
                                                0x0472dd08
                                                0x0472dd0a
                                                0x0472dd0c
                                                0x00000000
                                                0x0472dd12
                                                0x0472dd15
                                                0x0472dd2d
                                                0x0472dd2f
                                                0x0472dd32
                                                0x0472dd35
                                                0x00000000
                                                0x0472dd35
                                                0x0472dc5b
                                                0x0472dc5b
                                                0x0472dc5e
                                                0x0472dc61
                                                0x0472dc64
                                                0x0472dc67
                                                0x0472dc67
                                                0x0472dc6a
                                                0x0472dc6c
                                                0x0472dc8e
                                                0x0472dc8e
                                                0x0472dc91
                                                0x0472dc93
                                                0x0472dcce
                                                0x0472dcce
                                                0x0472dc95
                                                0x0472dc9c
                                                0x0472dc6e
                                                0x0472dc72
                                                0x0472dc75
                                                0x0472dc77
                                                0x0472dc79
                                                0x0477b551
                                                0x0477b551
                                                0x00000000
                                                0x0472dc7f
                                                0x0472dc7f
                                                0x0472dc81
                                                0x00000000
                                                0x0472dc83
                                                0x0472dc86
                                                0x0472dc88
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472dc88
                                                0x0472dc81
                                                0x0472dc79
                                                0x0472dc6c
                                                0x0472dc55
                                                0x0472dc47
                                                0x0472dc43
                                                0x00000000
                                                0x0472dc36
                                                0x0472dc23
                                                0x00000000
                                                0x0472dbff
                                                0x0472dbf1
                                                0x0472dbdf
                                                0x0472db8f
                                                0x0472db92
                                                0x0472db95
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472db95
                                                0x0472db8d
                                                0x0472db85
                                                0x0472db74
                                                0x0472dc9f
                                                0x0472dca2
                                                0x0472dcb0
                                                0x0472dcb0
                                                0x0472dad1
                                                0x0477b4e5
                                                0x0477b4c8
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0472d831
                                                0x0472d80d
                                                0x00000000
                                                0x0472d800
                                                0x0477b47f
                                                0x0477b485
                                                0x00000000
                                                0x0477b485
                                                0x0472d665
                                                0x0472d652
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4786a62b5a0361b374c1adde8bdeff67e3a026d2068a91fa4e1389d697354b0e
                                                • Instruction ID: a42754cef9570231b10f1b5329ea87795892c2971c888e3b3812b724b33cfbf3
                                                • Opcode Fuzzy Hash: 4786a62b5a0361b374c1adde8bdeff67e3a026d2068a91fa4e1389d697354b0e
                                                • Instruction Fuzzy Hash: 70E1AD30A013698FEB34DF25CA94BA9B7B6FF45308F0441A9D9099B390D778BD81CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472849B Relevance: .3, Instructions: 290COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 92%
                                                			E0472849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x47ef9c0);
				E0476D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4807b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0472CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04732280( *[fs:0x30], 0x4808550);
						_t139 =  *0x4807b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0474F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0472FFB0(_t193, _t235, 0x4808550);
								L5:
								return E0476D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04711C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4807b9c; // 0x0
							_t235 = L04734620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4807b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0474A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0472FFB0(_t193, _t235, 0x4808550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L047377F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L047377F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4807b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4807b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E047537C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4807b9c; // 0x0
									_t214 = L04734620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E047537F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4807b10 =  *0x4807b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4807b04 =  *0x4807b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L047377F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L047377F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4807b08 =  *0x4807b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E047557C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0475F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L047377F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0474A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L047377F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E047596C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

































                                                0x0472849b
                                                0x0472849b
                                                0x0472849b
                                                0x0472849b
                                                0x0472849d
                                                0x047284a2
                                                0x047284a7
                                                0x047284b1
                                                0x047284d8
                                                0x00000000
                                                0x047284b3
                                                0x047284c4
                                                0x047284c9
                                                0x047284cd
                                                0x047284cf
                                                0x047284cf
                                                0x047284d6
                                                0x047284e6
                                                0x047284e9
                                                0x047284ec
                                                0x047284ef
                                                0x047284f2
                                                0x047284f4
                                                0x047284fc
                                                0x04728501
                                                0x04728506
                                                0x04728509
                                                0x047286e0
                                                0x047286e5
                                                0x047286e8
                                                0x047286ed
                                                0x047286f0
                                                0x047286f2
                                                0x04779afd
                                                0x04779b02
                                                0x047284da
                                                0x047284df
                                                0x047284df
                                                0x047286fa
                                                0x047286fd
                                                0x047286fe
                                                0x04728701
                                                0x04728706
                                                0x04728709
                                                0x0472870b
                                                0x00000000
                                                0x00000000
                                                0x04728711
                                                0x04728725
                                                0x04728727
                                                0x0472872a
                                                0x0472872c
                                                0x04779af0
                                                0x04779af5
                                                0x04728732
                                                0x04728732
                                                0x04728732
                                                0x04728735
                                                0x04728737
                                                0x04728515
                                                0x04728515
                                                0x04728518
                                                0x0472851d
                                                0x04728523
                                                0x04728527
                                                0x0472852b
                                                0x04728537
                                                0x04728539
                                                0x0472853c
                                                0x0472853e
                                                0x0472868c
                                                0x04728691
                                                0x04728699
                                                0x0472869b
                                                0x04728744
                                                0x04728748
                                                0x047286a1
                                                0x047286a1
                                                0x047286a1
                                                0x047286a4
                                                0x047286a8
                                                0x04779bdf
                                                0x04779bdf
                                                0x047286ae
                                                0x047286b0
                                                0x00000000
                                                0x047286b6
                                                0x00000000
                                                0x04779be9
                                                0x047286b0
                                                0x04728544
                                                0x0472854a
                                                0x0472854d
                                                0x04728551
                                                0x0472876e
                                                0x04728778
                                                0x0472877b
                                                0x04728780
                                                0x04728557
                                                0x04728557
                                                0x0472855d
                                                0x0472855d
                                                0x0472856b
                                                0x0472856e
                                                0x04728570
                                                0x04728573
                                                0x04728576
                                                0x04728576
                                                0x04728579
                                                0x0472857b
                                                0x00000000
                                                0x00000000
                                                0x04728581
                                                0x047285a0
                                                0x047285a2
                                                0x047285a5
                                                0x047285a7
                                                0x04779b1b
                                                0x04779b1b
                                                0x0472862e
                                                0x0472862e
                                                0x04728631
                                                0x04728631
                                                0x04728634
                                                0x04728636
                                                0x04728669
                                                0x04728669
                                                0x0472866b
                                                0x04779bbf
                                                0x04779bc4
                                                0x04779bc8
                                                0x04779bce
                                                0x04779bce
                                                0x04728671
                                                0x04728671
                                                0x04728674
                                                0x04728676
                                                0x04779bae
                                                0x04779bae
                                                0x04728676
                                                0x0472867c
                                                0x0472867e
                                                0x04728688
                                                0x04728688
                                                0x00000000
                                                0x0472867e
                                                0x04728638
                                                0x04728638
                                                0x0472863b
                                                0x0472863e
                                                0x0472863f
                                                0x04728642
                                                0x04728645
                                                0x04728648
                                                0x0472864d
                                                0x04779b69
                                                0x04779b6e
                                                0x04779b7b
                                                0x04779b81
                                                0x04779b85
                                                0x04779b89
                                                0x04779ba7
                                                0x04779b8b
                                                0x04779b91
                                                0x04779b9a
                                                0x04779b9f
                                                0x04779b9f
                                                0x04728788
                                                0x0472878d
                                                0x04728763
                                                0x04728763
                                                0x04728766
                                                0x00000000
                                                0x04728766
                                                0x04779b70
                                                0x00000000
                                                0x04779b70
                                                0x04728656
                                                0x0472865a
                                                0x0472865c
                                                0x04728752
                                                0x04728756
                                                0x00000000
                                                0x00000000
                                                0x0472875e
                                                0x00000000
                                                0x0472875e
                                                0x04728662
                                                0x04728662
                                                0x04728662
                                                0x04728666
                                                0x00000000
                                                0x04728666
                                                0x047285b7
                                                0x047285b9
                                                0x047285bc
                                                0x047285bf
                                                0x047285cc
                                                0x047285d1
                                                0x047285d4
                                                0x047285db
                                                0x047285de
                                                0x047285e0
                                                0x04779b5f
                                                0x00000000
                                                0x04779b5f
                                                0x047285e6
                                                0x047285ea
                                                0x047286c3
                                                0x047286c5
                                                0x047286c8
                                                0x047286ca
                                                0x04779b16
                                                0x00000000
                                                0x04779b16
                                                0x047286d6
                                                0x047285f6
                                                0x047285f6
                                                0x047285f9
                                                0x04728602
                                                0x04728606
                                                0x0472860a
                                                0x0472860b
                                                0x0472860e
                                                0x04728611
                                                0x00000000
                                                0x04728611
                                                0x047285f3
                                                0x00000000
                                                0x047285f3
                                                0x04728619
                                                0x0472861e
                                                0x0472861e
                                                0x04728621
                                                0x04728622
                                                0x04728623
                                                0x04728625
                                                0x0472862c
                                                0x00000000
                                                0x0472873d
                                                0x00000000
                                                0x0472873d
                                                0x04728737
                                                0x0472850f
                                                0x04728512
                                                0x00000000
                                                0x04728512
                                                0x00000000
                                                0x047284d6

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: adf5446ab1186b49615b09b17e506f8beb3a2942ca15972a45653c551e68d8b4
                                                • Instruction ID: 0d98c87c269428b7e449eb3308777912f669981435ae838f57bb4aadd73ef32a
                                                • Opcode Fuzzy Hash: adf5446ab1186b49615b09b17e506f8beb3a2942ca15972a45653c551e68d8b4
                                                • Instruction Fuzzy Hash: 27B16EB0E01219DFEB14DFD9CA84AADBBB9FF48304F114629E505AB351E771B941CB81
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474513A Relevance: .3, Instructions: 258COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 67%
                                                			E0474513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x480d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0475D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04732280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04734620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0475F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0472FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x480b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0475B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}































































                                                0x04745142
                                                0x0474514c
                                                0x04745150
                                                0x04745157
                                                0x04745159
                                                0x0474515e
                                                0x04745165
                                                0x04745169
                                                0x0474516c
                                                0x04745172
                                                0x04745176
                                                0x0474517a
                                                0x0474517a
                                                0x0474517a
                                                0x0474517f
                                                0x04786d8b
                                                0x04786d8e
                                                0x04786d91
                                                0x04786d95
                                                0x04786d98
                                                0x04786d9c
                                                0x04786da0
                                                0x04786da3
                                                0x04786da7
                                                0x04786e26
                                                0x04786e26
                                                0x04786e2a
                                                0x047451f9
                                                0x047451f9
                                                0x047451fe
                                                0x04786e33
                                                0x04786e33
                                                0x04786e39
                                                0x04786e3d
                                                0x04786e46
                                                0x04786e50
                                                0x00000000
                                                0x00000000
                                                0x04786e52
                                                0x04786e53
                                                0x04786e56
                                                0x04786e5d
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04786e5f
                                                0x04786e67
                                                0x04786e77
                                                0x04786e7f
                                                0x04786e80
                                                0x04786e88
                                                0x04786e90
                                                0x04786e9f
                                                0x04786ea5
                                                0x04786ea9
                                                0x04786eb1
                                                0x04786ebf
                                                0x00000000
                                                0x00000000
                                                0x04786ecf
                                                0x04786ed3
                                                0x00000000
                                                0x00000000
                                                0x04786edb
                                                0x04786ede
                                                0x04786ee1
                                                0x04786ee8
                                                0x04786eeb
                                                0x04786eed
                                                0x04786ef0
                                                0x04786ef4
                                                0x04786ef8
                                                0x04786efc
                                                0x00000000
                                                0x00000000
                                                0x04786f0d
                                                0x04786f11
                                                0x04786f32
                                                0x04786f37
                                                0x04786f3b
                                                0x04786f3e
                                                0x04786f41
                                                0x04786f46
                                                0x00000000
                                                0x00000000
                                                0x04786f4c
                                                0x04786f50
                                                0x04786f50
                                                0x04786f54
                                                0x04786f62
                                                0x04786f65
                                                0x04786f6d
                                                0x04786f7b
                                                0x04786f7b
                                                0x04786f93
                                                0x04786f98
                                                0x04786fa0
                                                0x04786fa6
                                                0x04786fb3
                                                0x04786fb6
                                                0x04786fbf
                                                0x04786fc1
                                                0x04786fd5
                                                0x04786fda
                                                0x04786fda
                                                0x04786fdd
                                                0x04786fe2
                                                0x04786fe7
                                                0x04786feb
                                                0x04786fef
                                                0x04786ff3
                                                0x0474520c
                                                0x0474520c
                                                0x0474520f
                                                0x04745215
                                                0x04745234
                                                0x0474523a
                                                0x0474523a
                                                0x04745244
                                                0x04745245
                                                0x04745246
                                                0x04745251
                                                0x04745251
                                                0x04786f13
                                                0x04786f17
                                                0x04786f17
                                                0x04786f18
                                                0x04786f1b
                                                0x04786f1f
                                                0x04786f23
                                                0x00000000
                                                0x04786f28
                                                0x04745204
                                                0x04745204
                                                0x04745208
                                                0x00000000
                                                0x04745208
                                                0x04745185
                                                0x04745188
                                                0x0474518a
                                                0x0474518e
                                                0x04745195
                                                0x04786db1
                                                0x04786db5
                                                0x04786db9
                                                0x0474519b
                                                0x0474519b
                                                0x0474519e
                                                0x047451a7
                                                0x047451a9
                                                0x047451a9
                                                0x047451b5
                                                0x047451b8
                                                0x047451bb
                                                0x047451be
                                                0x047451c1
                                                0x047451c5
                                                0x047451c9
                                                0x047451cd
                                                0x047451cd
                                                0x047451d8
                                                0x047451dc
                                                0x047451e0
                                                0x04786dcc
                                                0x04786dd0
                                                0x04786dd5
                                                0x04786ddd
                                                0x04786de1
                                                0x04786de1
                                                0x04786de5
                                                0x04786deb
                                                0x04786df1
                                                0x04786df7
                                                0x04786dfd
                                                0x04786e01
                                                0x04786e05
                                                0x04786e09
                                                0x04786e0d
                                                0x04786e11
                                                0x04786e11
                                                0x047451eb
                                                0x04786e1a
                                                0x04786e1f
                                                0x04786e21
                                                0x04786e23
                                                0x00000000
                                                0x047451f1
                                                0x047451f1
                                                0x00000000
                                                0x047451f1

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e8fb91c91525b7b1299e75059815dc5edb5e0455c338edec7119072e80a04539
                                                • Instruction ID: ba5f8b10d70f8efe3729d038dcfae039a89b1700b92fb19205f1e0ff8f449d24
                                                • Opcode Fuzzy Hash: e8fb91c91525b7b1299e75059815dc5edb5e0455c338edec7119072e80a04539
                                                • Instruction Fuzzy Hash: 83C112B56083809FD354CF28C580A6AFBF1BF88708F14896EF9998B352D771E945CB52
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047403E2 Relevance: .3, Instructions: 254COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 74%
                                                			E047403E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x480d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04740548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0475B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0472B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4807c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04737D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04737D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E04797016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04759830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E047969A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4807c04 != 0) {
						_t118 = _v12;
						_t120 = E0479A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4807bd8;
						if( *0x4807bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E047595D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E047599A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E04793540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0471B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0475AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4808474 - 3;
										if( *0x4808474 != 3) {
											 *0x48079dc =  *0x48079dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04737D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04737D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E04797016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4808708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4807b00; // 0x0
							asm("ror esi, cl");
							 *0x480b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E047595D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04727F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}








































                                                0x047403f1
                                                0x047403f7
                                                0x047403f9
                                                0x047403fb
                                                0x047403fd
                                                0x04740400
                                                0x0474040a
                                                0x04784c7a
                                                0x04740537
                                                0x04740547
                                                0x04740410
                                                0x04740410
                                                0x04740414
                                                0x04740417
                                                0x0474041a
                                                0x04740421
                                                0x04740424
                                                0x0474042b
                                                0x0474043b
                                                0x0474043e
                                                0x0474043f
                                                0x0474043f
                                                0x04740446
                                                0x04740449
                                                0x0474044c
                                                0x0474044f
                                                0x04740459
                                                0x04784c8d
                                                0x0474045f
                                                0x0474045f
                                                0x0474045f
                                                0x04740467
                                                0x04784c97
                                                0x04784c9d
                                                0x04784ca4
                                                0x04784caa
                                                0x04784caf
                                                0x04784cb1
                                                0x04784cc3
                                                0x04784cb3
                                                0x04784cbc
                                                0x04784cbc
                                                0x04784cc8
                                                0x04784ccb
                                                0x04784cd7
                                                0x04784cda
                                                0x04784cdf
                                                0x04784cdf
                                                0x04784ccb
                                                0x04784ca4
                                                0x0474046d
                                                0x0474046f
                                                0x0474046f
                                                0x04740471
                                                0x04740476
                                                0x0474047a
                                                0x0474047b
                                                0x04740483
                                                0x04740489
                                                0x0474048d
                                                0x00000000
                                                0x00000000
                                                0x04784ce9
                                                0x04784cef
                                                0x04784d22
                                                0x04784d22
                                                0x00000000
                                                0x04784d22
                                                0x04784cf1
                                                0x04784cf7
                                                0x00000000
                                                0x00000000
                                                0x04784cf9
                                                0x04784cff
                                                0x00000000
                                                0x00000000
                                                0x04784d05
                                                0x04784d07
                                                0x00000000
                                                0x00000000
                                                0x04784d0d
                                                0x04784d0f
                                                0x04784d14
                                                0x04784d16
                                                0x00000000
                                                0x00000000
                                                0x04784d1c
                                                0x04784d1c
                                                0x04740499
                                                0x04740535
                                                0x04740535
                                                0x00000000
                                                0x04740535
                                                0x047404a6
                                                0x04784d2c
                                                0x04784d37
                                                0x04784d39
                                                0x04784d3b
                                                0x00000000
                                                0x00000000
                                                0x04784d41
                                                0x04784d48
                                                0x04740527
                                                0x0474052b
                                                0x0474052d
                                                0x04740530
                                                0x04740530
                                                0x00000000
                                                0x0474052b
                                                0x04784d4e
                                                0x047404ac
                                                0x047404ac
                                                0x047404af
                                                0x047404b2
                                                0x047404b7
                                                0x047404b9
                                                0x047404bb
                                                0x047404bd
                                                0x047404bf
                                                0x047404c5
                                                0x047404c9
                                                0x04784d53
                                                0x04784d59
                                                0x04784db9
                                                0x04784dba
                                                0x04784dbf
                                                0x04784dc2
                                                0x04784dc4
                                                0x04784dc7
                                                0x04784dce
                                                0x00000000
                                                0x04784dce
                                                0x04784d5b
                                                0x04784d61
                                                0x00000000
                                                0x00000000
                                                0x04784d63
                                                0x04784d69
                                                0x00000000
                                                0x00000000
                                                0x04784d6b
                                                0x04784d6e
                                                0x04784d74
                                                0x04784d76
                                                0x04784d7c
                                                0x04784d7e
                                                0x04784d84
                                                0x04784d89
                                                0x04784d8c
                                                0x04784d8d
                                                0x04784d92
                                                0x04784d95
                                                0x04784d96
                                                0x04784d98
                                                0x04784d9a
                                                0x04784d9f
                                                0x04784da4
                                                0x04784da6
                                                0x04784da8
                                                0x04784daf
                                                0x04784db1
                                                0x04784db1
                                                0x04784daf
                                                0x04784da6
                                                0x04784d84
                                                0x04784d7c
                                                0x00000000
                                                0x04784d74
                                                0x047404d6
                                                0x04784de1
                                                0x047404dc
                                                0x047404dc
                                                0x047404dc
                                                0x047404e4
                                                0x04784deb
                                                0x04784df1
                                                0x04784df8
                                                0x04784dfe
                                                0x04784e03
                                                0x04784e05
                                                0x04784e17
                                                0x04784e07
                                                0x04784e10
                                                0x04784e10
                                                0x04784e1c
                                                0x04784e1f
                                                0x04784e35
                                                0x04784e35
                                                0x04784e1f
                                                0x04784df8
                                                0x047404f1
                                                0x047404fa
                                                0x04784e3f
                                                0x04784e47
                                                0x04784e5b
                                                0x04784e61
                                                0x04784e67
                                                0x04784e69
                                                0x04784e71
                                                0x04784e73
                                                0x04740500
                                                0x04740500
                                                0x04740500
                                                0x047404fa
                                                0x04740508
                                                0x0474051d
                                                0x0474051d
                                                0x0474051f
                                                0x04740524
                                                0x00000000
                                                0x04740524
                                                0x04740515
                                                0x04740517
                                                0x04784e7a
                                                0x04784e7c
                                                0x00000000
                                                0x00000000
                                                0x04784e85
                                                0x00000000
                                                0x04784e85
                                                0x00000000
                                                0x04740517

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b834b11b239e5089507770bc6984d924b81ff6d23110268042b574a56df04142
                                                • Instruction ID: 311287bcba3c00763ab3be5a1b840924082b2869a1f942446da423186c40df18
                                                • Opcode Fuzzy Hash: b834b11b239e5089507770bc6984d924b81ff6d23110268042b574a56df04142
                                                • Instruction Fuzzy Hash: 5B911971E40255AFEB31AB69C848BBD77A4EB42724F050265EA10AB3D1E7B4BD40C7D1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474EBB0 Relevance: .2, Instructions: 250COMMONLIBRARYCODECrypto
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0474EBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = E0474ED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}































                                                0x0474ebb8
                                                0x0474ebbf
                                                0x0474ebc1
                                                0x0474ebc6
                                                0x00000000
                                                0x0478b6d6
                                                0x0474ebcd
                                                0x0474ebd2
                                                0x0474ec95
                                                0x0478b6e0
                                                0x0474ec9b
                                                0x0474eca1
                                                0x0474eca1
                                                0x0474ec89
                                                0x00000000
                                                0x0474ec89
                                                0x0474ebd8
                                                0x0474ebdd
                                                0x0478b6ea
                                                0x00000000
                                                0x0474ebe3
                                                0x0474ebe5
                                                0x0474ebe7
                                                0x0474ebef
                                                0x0474ebf2
                                                0x00000000
                                                0x0474ebf5
                                                0x00000000
                                                0x0474ebf5
                                                0x0474ebf5
                                                0x0474ebf7
                                                0x0478b6f6
                                                0x0474ec7c
                                                0x0474ec7c
                                                0x0474ec7f
                                                0x0474ec82
                                                0x0474ec87
                                                0x00000000
                                                0x0474ec87
                                                0x0474ec1a
                                                0x0474ec1a
                                                0x0474ec25
                                                0x0478b725
                                                0x0478b72c
                                                0x0478b72c
                                                0x0474ec2d
                                                0x0474ec31
                                                0x0478b73c
                                                0x0478b744
                                                0x0478b748
                                                0x0478b748
                                                0x0478b749
                                                0x0478b749
                                                0x0478b74a
                                                0x0478b74a
                                                0x0474ec3e
                                                0x0478b860
                                                0x00000000
                                                0x0474ec44
                                                0x0474ec47
                                                0x0478b750
                                                0x0478b758
                                                0x0478b767
                                                0x0478b775
                                                0x0478b77c
                                                0x0478b77f
                                                0x0478b769
                                                0x0478b76c
                                                0x0478b76c
                                                0x0478b781
                                                0x0478b788
                                                0x0478b78b
                                                0x0478b75a
                                                0x0478b75d
                                                0x0478b75d
                                                0x0478b78d
                                                0x0478b792
                                                0x0478b793
                                                0x0478b793
                                                0x0474ec54
                                                0x0474ec56
                                                0x0474ec57
                                                0x0474ec59
                                                0x0474ec5e
                                                0x0474ecaa
                                                0x0474ed16
                                                0x0474ed16
                                                0x0474ecac
                                                0x0474ecaf
                                                0x0474ecb4
                                                0x0474ecb6
                                                0x0474ecb6
                                                0x0474ecb9
                                                0x0474ecbf
                                                0x0478b7c1
                                                0x0478b7c8
                                                0x0478b7d3
                                                0x0478b7db
                                                0x0478b7ec
                                                0x0478b858
                                                0x00000000
                                                0x0478b858
                                                0x0478b7ee
                                                0x0478b7f1
                                                0x0478b7f4
                                                0x0478b7ff
                                                0x0478b850
                                                0x00000000
                                                0x0478b850
                                                0x0478b80a
                                                0x0478b813
                                                0x0478b81c
                                                0x0478b81d
                                                0x0478b822
                                                0x0478b825
                                                0x0478b828
                                                0x0478b831
                                                0x0478b832
                                                0x0478b837
                                                0x0478b840
                                                0x0478b842
                                                0x0478b845
                                                0x0478b848
                                                0x00000000
                                                0x0478b848
                                                0x0478b7df
                                                0x00000000
                                                0x0478b7df
                                                0x0478b7cc
                                                0x00000000
                                                0x0478b7cc
                                                0x0474ecc5
                                                0x0474ecc7
                                                0x0474eccb
                                                0x0478b79b
                                                0x0478b79e
                                                0x0478b7a4
                                                0x00000000
                                                0x00000000
                                                0x0478b7a6
                                                0x0478b7a8
                                                0x0478b7a8
                                                0x0474ecd3
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474ecd5
                                                0x0474ecd5
                                                0x0474ecd5
                                                0x0474ecd8
                                                0x0474ecda
                                                0x0474ece4
                                                0x00000000
                                                0x00000000
                                                0x0474ecea
                                                0x0474eced
                                                0x0474ecf0
                                                0x0474ecf2
                                                0x0474ecfb
                                                0x0474ecfe
                                                0x0474ed01
                                                0x0474ed06
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474ed06
                                                0x0478b7ae
                                                0x0478b7b1
                                                0x0478b7b7
                                                0x00000000
                                                0x00000000
                                                0x0478b7b9
                                                0x0478b7bb
                                                0x0474ed08
                                                0x0474ed08
                                                0x0474ed0c
                                                0x0474ed0c
                                                0x00000000
                                                0x0474ec60
                                                0x0474ec62
                                                0x0474ed0f
                                                0x0474ed0f
                                                0x00000000
                                                0x0474ed0f
                                                0x0474ec68
                                                0x0474ec6c
                                                0x0474ec6f
                                                0x0474ec75
                                                0x0474ec0d
                                                0x0474ec0d
                                                0x0474ec18
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474ec18
                                                0x0474ec77
                                                0x0474ec79
                                                0x0474ec79
                                                0x00000000
                                                0x0474ec68
                                                0x0474ec5e
                                                0x0474ec3e
                                                0x0474ebfd
                                                0x0474ec02
                                                0x0478b701
                                                0x0478b70c
                                                0x0478b71b
                                                0x0478b71d
                                                0x0478b71d
                                                0x00000000
                                                0x0478b70c
                                                0x0474ec08
                                                0x0474ec0a
                                                0x00000000
                                                0x0474ec0a
                                                0x0474ebf5
                                                0x0474ebf5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
                                                • Instruction ID: 5de46f3d3438ecf61645fac157e201f5779573da549a0cec51c8b475fb609090
                                                • Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
                                                • Instruction Fuzzy Hash: E3814931B84356CBEB215E69C8C027DBB55FF92324B28467FE8428F341D325B84AE791
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E25DD Relevance: .2, Instructions: 232COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 98%
                                                			E047E25DD(intOrPtr __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, signed int _a12, char* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				void* __ebx;
				void* __edi;
				signed int _t74;
				signed int _t77;
				signed int _t80;
				signed int _t82;
				signed int _t102;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				intOrPtr _t135;
				void* _t154;
				signed int _t160;
				signed int _t168;
				unsigned int _t175;
				signed int _t185;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				unsigned int _t200;
				unsigned int _t201;
				signed char _t202;
				signed int _t204;
				signed int _t210;
				intOrPtr _t211;
				signed int _t212;

				_t133 = _a4;
				_v24 = __edx;
				_v16 = __ecx;
				E047E2E3F(__ecx, __edx, __eflags, _t133);
				_t204 = _a8;
				_t187 = 0x10;
				_t210 = (( *_t133 ^  *0x4806110 ^ _t133) >> 0x00000001 & 0x00007fff) - _t204;
				if(_t210 != 0 && ( *(_v16 + 0x38) & 0x00000001) != 0) {
					_t185 = (_t133 + _t204 * 0x00000008 + 0x00000fff & 0xfffff000) - _t133 + _t204 * 8 >> 3;
					_t132 = _t185 << 3;
					if(_t132 >= _t187) {
						if(__eflags != 0) {
							__eflags = _t132 - 0x20;
							if(_t132 < 0x20) {
								_t204 = _t204 + 1;
								_t210 = _t210 - 1;
								__eflags = _t210;
							}
						}
					} else {
						_t204 = _t204 + _t185;
						_t210 = _t210 - _t185;
					}
				}
				if(_t210 << 3 < _t187) {
					_t204 = _t204 + _t210;
				}
				_t74 =  *0x4806110; // 0x4eb9a8c4
				asm("sbb edx, edx");
				_t189 =  !_t187 & _t210;
				_t211 = _v24;
				_v20 = _t189;
				 *_t133 = ( !_t74 ^  *_t133 ^ _t133) & 0x7fffffff ^  !_t74 ^ _t133;
				_t152 = _t133 - _t211;
				_t77 = _t133 - _t211 >> 0xc;
				_v28 = _t77;
				_t80 = (_t77 ^  *0x4806110 ^ _t133) & 0x000000ff;
				_v32 = _t80;
				 *(_t133 + 4) = _t80;
				_t82 = _t204 << 3;
				if(_t189 != 0) {
					_t82 = _t82 + 0x10;
				}
				_t190 = _t189 | 0xffffffff;
				_t154 = 0x3f;
				_v12 = E0475D340(_t82 + _t152 - 0x00000001 >> 0x0000000c | 0xffffffff, _t154 - (_t82 + _t152 - 1 >> 0xc), _t190);
				_v8 = _t190;
				_t191 = _t190 | 0xffffffff;
				_v12 = _v12 & E0475D0F0(_t86 | 0xffffffff, _v28, _t191);
				_v8 = _v8 & _t191;
				_t193 = _v12 & ( *(_t211 + 8) ^ _v12);
				_t212 = _v20;
				_t160 = _v8 & ( *(_t211 + 0xc) ^ _v8);
				_v12 = _t193;
				_v8 = _t160;
				if((_t193 | _t160) != 0) {
					 *(_t133 + 4) = _v32 | 0x00000200;
					_t117 = _a12 & 0x00000001;
					_v32 = _t117;
					if(_t117 == 0) {
						E0472FFB0(_t133, _t204, _v16);
						_t193 = _v12;
					}
					_t212 = _v20;
					_t200 =  !_v8;
					_t121 = _t200 & 0x000000ff;
					_t201 = _t200 >> 8;
					_t44 = _t121 + 0x46fac00; // 0x6070708
					_t122 = _t201 & 0x000000ff;
					_t202 = _t201 >> 8;
					_t175 = _t202 >> 8;
					_t45 = _t122 + 0x46fac00; // 0x6070708
					_t123 = _t202 & 0x000000ff;
					_t47 = _t175 + 0x46fac00; // 0x6060706
					_t48 = _t123 + 0x46fac00; // 0x6070708
					_t142 = _v16;
					if(E047E2FBD(_v16, _v24, _v12, _v8, ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff) + ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff), 1) < 0) {
						_t212 = _t212 + _t204;
						_t204 = 0;
					}
					if(_v32 == 0) {
						E04732280(_t125, _t142);
					}
					_t133 = _a4;
					 *_a16 = 0xff;
					 *(_t133 + 4) =  *(_t133 + 4) & 0xfffffdff;
				}
				 *_t133 =  *_t133 ^ (_t204 + _t204 ^  *_t133 ^  *0x4806110 ^ _t133) & 0x0000fffe;
				if(_t212 != 0) {
					_t194 = _t133 + _t204 * 8;
					_t134 =  *0x4806110; // 0x4eb9a8c4
					if(_t204 == 0) {
						_t102 = ( *_t194 ^ _t134 ^ _t194) & 0x7fff0000;
						__eflags = _t102;
					} else {
						_t102 = _t204 << 0x10;
					}
					_t135 = _v24;
					 *_t194 = ((_t212 & 0x00007fff | 0xc0000000) + (_t212 & 0x00007fff | 0xc0000000) | _t102) ^ _t134 ^ _t194;
					_t168 = _t194 + _t212 * 8;
					 *(_t194 + 4) = (_t194 - _t135 >> 0x0000000c ^  *0x4806110 ^ _t194) & 0x000000ff;
					if(_t168 < _t135 + (( *(_t135 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t168 =  *_t168 ^ (_t212 << 0x00000010 ^  *_t168 ^  *0x4806110 ^ _t168) & 0x7fff0000;
					}
					E047E241A(_v16, _t135, _t194, _a12, _a16);
				}
				return _t204;
			}











































                                                0x047e25e6
                                                0x047e25f6
                                                0x047e25fb
                                                0x047e25fe
                                                0x047e2603
                                                0x047e2610
                                                0x047e2611
                                                0x047e2613
                                                0x047e262f
                                                0x047e2634
                                                0x047e2639
                                                0x047e2641
                                                0x047e2643
                                                0x047e2646
                                                0x047e2648
                                                0x047e2649
                                                0x047e2649
                                                0x047e2649
                                                0x047e2646
                                                0x047e263b
                                                0x047e263b
                                                0x047e263d
                                                0x047e263d
                                                0x047e2639
                                                0x047e2651
                                                0x047e2653
                                                0x047e2655
                                                0x047e2657
                                                0x047e265c
                                                0x047e2668
                                                0x047e266a
                                                0x047e2675
                                                0x047e267c
                                                0x047e2680
                                                0x047e2684
                                                0x047e2687
                                                0x047e2692
                                                0x047e2695
                                                0x047e2698
                                                0x047e269d
                                                0x047e26a2
                                                0x047e26a4
                                                0x047e26a4
                                                0x047e26a8
                                                0x047e26b2
                                                0x047e26c0
                                                0x047e26c6
                                                0x047e26c9
                                                0x047e26d1
                                                0x047e26d4
                                                0x047e26e2
                                                0x047e26ea
                                                0x047e26ed
                                                0x047e26f1
                                                0x047e26f6
                                                0x047e26f9
                                                0x047e2707
                                                0x047e270d
                                                0x047e2710
                                                0x047e2713
                                                0x047e2718
                                                0x047e271d
                                                0x047e271d
                                                0x047e2722
                                                0x047e2750
                                                0x047e2758
                                                0x047e275d
                                                0x047e2760
                                                0x047e2766
                                                0x047e2769
                                                0x047e276e
                                                0x047e2771
                                                0x047e2777
                                                0x047e277d
                                                0x047e2783
                                                0x047e2791
                                                0x047e27a7
                                                0x047e27a9
                                                0x047e27ab
                                                0x047e27ab
                                                0x047e27b1
                                                0x047e27b4
                                                0x047e27b4
                                                0x047e27bc
                                                0x047e27bf
                                                0x047e27c2
                                                0x047e27c2
                                                0x047e27db
                                                0x047e27df
                                                0x047e27e5
                                                0x047e27e8
                                                0x047e27f0
                                                0x047e27ff
                                                0x047e27ff
                                                0x047e27f2
                                                0x047e27f4
                                                0x047e27f4
                                                0x047e281a
                                                0x047e2824
                                                0x047e2826
                                                0x047e2834
                                                0x047e2843
                                                0x047e2858
                                                0x047e2858
                                                0x047e2866
                                                0x047e2866
                                                0x047e2873

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e510268655dfb20fcba7d88ad0ac13f9b6cfd6efa093d7bdcb02863866c0aca9
                                                • Instruction ID: f8844d93a50d941f70ceb962001702f96034178228b022af2e0c7dea198bc0dc
                                                • Opcode Fuzzy Hash: e510268655dfb20fcba7d88ad0ac13f9b6cfd6efa093d7bdcb02863866c0aca9
                                                • Instruction Fuzzy Hash: 90810772A101158FCB08CF7AC8946BEB7F5FF8C310B1986A9D855EB396EA34E901C750
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E1D55 Relevance: .2, Instructions: 226COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 90%
                                                			E047E1D55(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t97;
				signed int _t101;
				signed int _t112;
				unsigned int _t113;
				signed int _t121;
				signed int _t128;
				signed int _t130;
				signed char _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t149;
				signed int _t150;
				void* _t154;
				signed int* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				intOrPtr _t171;
				signed int _t172;
				void* _t175;
				signed int* _t178;
				signed int _t179;
				signed int _t180;
				signed char _t181;
				signed char _t183;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				void* _t191;
				void* _t197;

				_t137 = __ecx;
				_push(0x64);
				_push(0x47f1070);
				E0476D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x24) = __edx;
				 *((intOrPtr*)(_t191 - 0x20)) = __ecx;
				 *((intOrPtr*)(_t191 - 0x38)) = __ecx;
				_t135 = 0;
				 *(_t191 - 0x40) = 0;
				_t171 =  *((intOrPtr*)(__ecx + 0xc));
				_t189 =  *(__ecx + 8);
				 *(_t191 - 0x28) = _t189;
				 *((intOrPtr*)(_t191 - 0x3c)) = _t171;
				 *(_t191 - 0x50) = _t189;
				_t187 = __edx << 0xf;
				 *(_t191 - 0x4c) = _t187;
				_t190 = 0x8000;
				 *(_t191 - 0x34) = 0x8000;
				_t172 = _t171 - _t187;
				if(_t172 <= 0x8000) {
					_t190 = _t172;
					 *(_t191 - 0x34) = _t172;
				}
				 *(_t191 - 0x68) = _t135;
				 *(_t191 - 0x64) = _t135;
				L3:
				while(1) {
					if( *(_t191 + 8) != 0) {
						L22:
						 *(_t191 + 8) = _t135;
						E047E337F(_t137, 1, _t191 - 0x74);
						_t97 =  *((intOrPtr*)(_t191 - 0x20));
						_t175 =  *(_t97 + 0x14);
						 *(_t191 - 0x58) = _t175;
						_t139 = _t97 + 0x14;
						 *(_t191 - 0x44) = _t139;
						_t197 = _t175 - 0xffffffff;
						if(_t197 == 0) {
							 *_t139 =  *(_t191 - 0x24);
							E047E33B6(_t191 - 0x74);
							 *(_t191 - 0x40) = 1;
							_t60 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t101 =  *_t60;
							_t141 =  *(_t191 - 0x24);
							asm("bt [eax], ecx");
							_t103 = (_t101 & 0xffffff00 | __eflags > 0x00000000) & 0x000000ff;
							if(__eflags == 0) {
								goto L41;
							} else {
								_t103 = _t187 - 1 + _t190;
								__eflags = _t187 - 1 + _t190 -  *((intOrPtr*)(_t191 - 0x3c));
								if(_t187 - 1 + _t190 >=  *((intOrPtr*)(_t191 - 0x3c))) {
									goto L41;
								} else {
									__eflags = _t190 - 1;
									if(__eflags > 0) {
										_t143 =  *(_t191 - 0x28);
										_t178 = _t143 + (_t187 >> 5) * 4;
										_t144 = _t143 + (_t187 - 1 + _t190 >> 5) * 4;
										 *(_t191 - 0x50) = _t144;
										_t112 =  *_t178;
										 *(_t191 - 0x54) = _t112;
										_t113 = _t112 | 0xffffffff;
										__eflags = _t178 - _t144;
										if(_t178 != _t144) {
											_t103 = _t113 << _t187;
											__eflags =  *_t178 & _t103;
											if(( *_t178 & _t103) != 0) {
												goto L41;
											} else {
												_t103 =  *(_t191 - 0x50);
												while(1) {
													_t178 =  &(_t178[1]);
													__eflags = _t178 - _t103;
													if(_t178 == _t103) {
														break;
													}
													__eflags =  *_t178 - _t135;
													if( *_t178 != _t135) {
														goto L41;
													} else {
														continue;
													}
													goto L42;
												}
												_t103 = (_t103 | 0xffffffff) >>  !(_t187 - 1 + _t190);
												__eflags = _t103;
												_t149 =  *_t178;
												goto L38;
											}
										} else {
											_t154 = 0x20;
											_t103 = _t113 >> _t154 - _t190 << _t187;
											_t149 =  *(_t191 - 0x54);
											L38:
											_t150 = _t149 & _t103;
											__eflags = _t150;
											asm("sbb cl, cl");
											_t135 =  ~_t150 + 1;
											_t141 =  *(_t191 - 0x24);
											goto L39;
										}
									} else {
										if(__eflags != 0) {
											goto L41;
										} else {
											_t103 =  *(_t191 - 0x28);
											asm("bt [eax], edi");
											if(__eflags >= 0) {
												L40:
												_t136 =  *((intOrPtr*)(_t191 - 0x20));
												asm("lock btr [eax], ecx");
												 *((intOrPtr*)(_t191 - 0x60)) = (_t141 << 0xc) +  *((intOrPtr*)(_t136 + 8));
												 *((intOrPtr*)(_t191 - 0x5c)) = 0x1000;
												_push(0x4000);
												_push(_t191 - 0x5c);
												_push(_t191 - 0x60);
												_push(0xffffffff);
												_t103 = E047596E0();
											} else {
												L39:
												__eflags = _t135;
												if(_t135 == 0) {
													goto L41;
												} else {
													goto L40;
												}
											}
										}
									}
								}
							}
						} else {
							E047E33B6(_t191 - 0x74);
							_t172 = _t191 - 0x58;
							E0474E18B( *(_t191 - 0x44), _t172, 4, _t135,  *0x4805880);
							_t51 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t121 =  *_t51;
							asm("bt [eax], ecx");
							_t103 = (_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff;
							if(((_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff) == 0) {
								goto L41;
							} else {
								_t137 =  *((intOrPtr*)(_t191 - 0x20));
								continue;
							}
						}
					} else {
						 *(_t191 - 4) = _t135;
						_t103 = _t187 - 1 + _t190;
						 *(_t191 - 0x30) = _t103;
						if(_t103 <  *((intOrPtr*)(_t191 - 0x3c))) {
							__eflags = _t190 - 1;
							if(__eflags > 0) {
								_t179 =  *(_t191 - 0x28);
								_t161 = _t179 + (_t187 >> 5) * 4;
								 *(_t191 - 0x2c) = _t161;
								_t128 = _t179 + ( *(_t191 - 0x30) >> 5) * 4;
								 *(_t191 - 0x44) = _t128;
								_t180 =  *_t161;
								__eflags = _t161 - _t128;
								if(_t161 != _t128) {
									_t103 = (_t128 | 0xffffffff) << _t187;
									__eflags = _t103 & _t180;
									if((_t103 & _t180) != 0) {
										goto L5;
									} else {
										_t130 =  *(_t191 - 0x2c);
										_t164 =  *(_t191 - 0x44);
										while(1) {
											_t130 = _t130 + 4;
											 *(_t191 - 0x2c) = _t130;
											_t180 =  *_t130;
											__eflags = _t130 - _t164;
											if(_t130 == _t164) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												continue;
											} else {
												goto L5;
											}
											goto L19;
										}
										_t103 = (_t130 | 0xffffffff) >>  !( *(_t191 - 0x30));
										__eflags = _t103;
										goto L17;
									}
								} else {
									_t167 = 0x20;
									_t103 = (_t128 | 0xffffffff) >> _t167 - _t190 << _t187;
									L17:
									_t183 =  ~(_t180 & _t103);
									asm("sbb dl, dl");
									goto L18;
								}
							} else {
								if(__eflags != 0) {
									goto L5;
								} else {
									_t103 =  *(_t191 - 0x28);
									asm("bt [eax], edi");
									_t183 =  ~(_t172 & 0xffffff00 | __eflags > 0x00000000);
									asm("sbb dl, dl");
									L18:
									_t181 = _t183 + 1;
									__eflags = _t181;
								}
							}
						} else {
							L5:
							_t181 = _t135;
						}
						L19:
						 *(_t191 - 0x19) = _t181;
						_t163 = _t181 & 0x000000ff;
						 *(_t191 - 0x48) = _t163;
						 *(_t191 - 4) = 0xfffffffe;
						if(_t163 == 0) {
							L41:
							_t136 =  *((intOrPtr*)(_t191 - 0x20));
						} else {
							_t137 =  *((intOrPtr*)(_t191 - 0x20));
							goto L22;
						}
					}
					L42:
					__eflags =  *(_t191 - 0x40);
					if( *(_t191 - 0x40) != 0) {
						_t91 = _t136 + 0x14; // 0x14
						_t142 = _t91;
						 *_t91 = 0xffffffff;
						__eflags = 0;
						asm("lock or [eax], edx");
						_t103 = E0474DFDF(_t91, 1, _t142);
					}
					return E0476D0D1(_t103);
				}
			}





































                                                0x047e1d55
                                                0x047e1d55
                                                0x047e1d57
                                                0x047e1d5c
                                                0x047e1d63
                                                0x047e1d66
                                                0x047e1d69
                                                0x047e1d6c
                                                0x047e1d6e
                                                0x047e1d71
                                                0x047e1d74
                                                0x047e1d77
                                                0x047e1d7a
                                                0x047e1d7d
                                                0x047e1d82
                                                0x047e1d85
                                                0x047e1d88
                                                0x047e1d8d
                                                0x047e1d90
                                                0x047e1d94
                                                0x047e1d96
                                                0x047e1d98
                                                0x047e1d98
                                                0x047e1d9b
                                                0x047e1d9e
                                                0x00000000
                                                0x047e1da1
                                                0x047e1da5
                                                0x047e1e78
                                                0x047e1e78
                                                0x047e1e82
                                                0x047e1e87
                                                0x047e1e8a
                                                0x047e1e8d
                                                0x047e1e92
                                                0x047e1e95
                                                0x047e1e98
                                                0x047e1e9b
                                                0x047e1ede
                                                0x047e1ee3
                                                0x047e1ee8
                                                0x047e1ef2
                                                0x047e1ef2
                                                0x047e1ef5
                                                0x047e1ef8
                                                0x047e1efe
                                                0x047e1f03
                                                0x00000000
                                                0x047e1f09
                                                0x047e1f0c
                                                0x047e1f0e
                                                0x047e1f11
                                                0x00000000
                                                0x047e1f17
                                                0x047e1f17
                                                0x047e1f1a
                                                0x047e1f31
                                                0x047e1f34
                                                0x047e1f3f
                                                0x047e1f42
                                                0x047e1f45
                                                0x047e1f47
                                                0x047e1f4a
                                                0x047e1f4d
                                                0x047e1f4f
                                                0x047e1f63
                                                0x047e1f65
                                                0x047e1f67
                                                0x00000000
                                                0x047e1f69
                                                0x047e1f69
                                                0x047e1f72
                                                0x047e1f72
                                                0x047e1f75
                                                0x047e1f77
                                                0x00000000
                                                0x00000000
                                                0x047e1f6e
                                                0x047e1f70
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e1f70
                                                0x047e1f83
                                                0x047e1f83
                                                0x047e1f85
                                                0x00000000
                                                0x047e1f85
                                                0x047e1f51
                                                0x047e1f53
                                                0x047e1f5a
                                                0x047e1f5c
                                                0x047e1f87
                                                0x047e1f87
                                                0x047e1f87
                                                0x047e1f8b
                                                0x047e1f8d
                                                0x047e1f90
                                                0x00000000
                                                0x047e1f90
                                                0x047e1f1c
                                                0x047e1f1c
                                                0x00000000
                                                0x047e1f22
                                                0x047e1f22
                                                0x047e1f25
                                                0x047e1f28
                                                0x047e1f97
                                                0x047e1f97
                                                0x047e1f9d
                                                0x047e1fa7
                                                0x047e1faa
                                                0x047e1fb1
                                                0x047e1fb9
                                                0x047e1fbd
                                                0x047e1fbe
                                                0x047e1fc0
                                                0x047e1f2a
                                                0x047e1f93
                                                0x047e1f93
                                                0x047e1f95
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e1f95
                                                0x047e1f28
                                                0x047e1f1c
                                                0x047e1f1a
                                                0x047e1f11
                                                0x047e1e9d
                                                0x047e1ea0
                                                0x047e1eae
                                                0x047e1eb4
                                                0x047e1ebc
                                                0x047e1ebc
                                                0x047e1ec2
                                                0x047e1ec8
                                                0x047e1ecd
                                                0x00000000
                                                0x047e1ed3
                                                0x047e1ed3
                                                0x00000000
                                                0x047e1ed3
                                                0x047e1ecd
                                                0x047e1dab
                                                0x047e1dab
                                                0x047e1db1
                                                0x047e1db3
                                                0x047e1db9
                                                0x047e1dbf
                                                0x047e1dc2
                                                0x047e1dda
                                                0x047e1ddd
                                                0x047e1de0
                                                0x047e1de9
                                                0x047e1dec
                                                0x047e1def
                                                0x047e1df1
                                                0x047e1df3
                                                0x047e1e0a
                                                0x047e1e0c
                                                0x047e1e0e
                                                0x00000000
                                                0x047e1e10
                                                0x047e1e10
                                                0x047e1e13
                                                0x047e1e16
                                                0x047e1e16
                                                0x047e1e19
                                                0x047e1e1c
                                                0x047e1e1e
                                                0x047e1e20
                                                0x00000000
                                                0x00000000
                                                0x047e1e22
                                                0x047e1e24
                                                0x00000000
                                                0x047e1e26
                                                0x00000000
                                                0x047e1e26
                                                0x00000000
                                                0x047e1e24
                                                0x047e1e30
                                                0x047e1e30
                                                0x00000000
                                                0x047e1e30
                                                0x047e1df5
                                                0x047e1df7
                                                0x047e1e01
                                                0x047e1e32
                                                0x047e1e34
                                                0x047e1e36
                                                0x00000000
                                                0x047e1e36
                                                0x047e1dc4
                                                0x047e1dc4
                                                0x00000000
                                                0x047e1dc6
                                                0x047e1dc6
                                                0x047e1dc9
                                                0x047e1dcf
                                                0x047e1dd1
                                                0x047e1e38
                                                0x047e1e38
                                                0x047e1e38
                                                0x047e1e38
                                                0x047e1dc4
                                                0x047e1dbb
                                                0x047e1dbb
                                                0x047e1dbb
                                                0x047e1dbb
                                                0x047e1e3a
                                                0x047e1e3a
                                                0x047e1e3d
                                                0x047e1e40
                                                0x047e1e43
                                                0x047e1e6f
                                                0x047e1fc7
                                                0x047e1fc7
                                                0x047e1e75
                                                0x047e1e75
                                                0x00000000
                                                0x047e1e75
                                                0x047e1e6f
                                                0x047e1fca
                                                0x047e1fca
                                                0x047e1fce
                                                0x047e1fd0
                                                0x047e1fd0
                                                0x047e1fd3
                                                0x047e1fd9
                                                0x047e1fde
                                                0x047e1fe4
                                                0x047e1fe4
                                                0x047e1fee
                                                0x047e1fee

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4406d30cc106e95574ca915cda86ac46a223e07dfb15c1264063b6872c303355
                                                • Instruction ID: 3064417d47331172317ccbb6fe80b2337cf26d9a62e5bb2984f9712aa41636d8
                                                • Opcode Fuzzy Hash: 4406d30cc106e95574ca915cda86ac46a223e07dfb15c1264063b6872c303355
                                                • Instruction Fuzzy Hash: 5F816B71E012198FDF18CFAAC8819FCB7B2FF49314B544369E412AB385DB31A945CB94
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471C600 Relevance: .2, Instructions: 225COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 67%
                                                			E0471C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x480d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04726D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0475B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4807b9c; // 0x0
					_t74 = L04734620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04759650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L047377F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0475F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E047513C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L047377F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04759650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}










































                                                0x0471c608
                                                0x0471c615
                                                0x0471c625
                                                0x0471c62d
                                                0x0471c635
                                                0x0471c640
                                                0x0471c680
                                                0x0471c687
                                                0x0471c688
                                                0x0471c689
                                                0x0471c694
                                                0x0471c694
                                                0x0471c642
                                                0x0471c64a
                                                0x0471c697
                                                0x04787a25
                                                0x04787a2b
                                                0x04787a2e
                                                0x04787a30
                                                0x04787bea
                                                0x04787bea
                                                0x00000000
                                                0x04787bea
                                                0x04787a36
                                                0x04787a43
                                                0x04787a48
                                                0x04787a4c
                                                0x04787a4e
                                                0x00000000
                                                0x00000000
                                                0x04787a58
                                                0x04787a5a
                                                0x04787a5b
                                                0x04787a5c
                                                0x04787a5d
                                                0x04787a63
                                                0x04787a64
                                                0x04787a6a
                                                0x04787a6c
                                                0x04787a6e
                                                0x047879cb
                                                0x047879cb
                                                0x047879ce
                                                0x047879d0
                                                0x04787a98
                                                0x04787a9b
                                                0x04787a9b
                                                0x04787a9e
                                                0x04787aa1
                                                0x04787bbe
                                                0x04787bbe
                                                0x04787bc0
                                                0x04787be0
                                                0x04787be0
                                                0x04787a01
                                                0x04787a01
                                                0x04787a05
                                                0x04787a07
                                                0x04787a15
                                                0x04787a15
                                                0x04787a1a
                                                0x00000000
                                                0x04787a1a
                                                0x04787bc2
                                                0x04787bc6
                                                0x04787bc9
                                                0x04787bcd
                                                0x04787bcf
                                                0x047879e6
                                                0x047879e6
                                                0x047879eb
                                                0x047879eb
                                                0x047879ef
                                                0x047879f1
                                                0x00000000
                                                0x00000000
                                                0x047879f3
                                                0x047879f5
                                                0x047879ff
                                                0x047879ff
                                                0x00000000
                                                0x047879ff
                                                0x047879f7
                                                0x047879fd
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047879fd
                                                0x04787bd5
                                                0x04787bd8
                                                0x00000000
                                                0x00000000
                                                0x04787ba9
                                                0x04787bac
                                                0x04787bb0
                                                0x04787bb1
                                                0x04787bb1
                                                0x04787bb6
                                                0x00000000
                                                0x04787bb6
                                                0x04787aa7
                                                0x04787aaa
                                                0x00000000
                                                0x00000000
                                                0x04787ab2
                                                0x04787ab3
                                                0x04787ab5
                                                0x04787aec
                                                0x04787aef
                                                0x04787b25
                                                0x04787b28
                                                0x04787b62
                                                0x04787b64
                                                0x04787b8f
                                                0x04787b92
                                                0x04787b96
                                                0x04787b98
                                                0x00000000
                                                0x00000000
                                                0x04787b9e
                                                0x04787b9f
                                                0x04787ba3
                                                0x00000000
                                                0x04787ba3
                                                0x04787b66
                                                0x04787b68
                                                0x04787ae2
                                                0x04787ae2
                                                0x00000000
                                                0x04787ae2
                                                0x04787b6e
                                                0x04787b72
                                                0x04787b75
                                                0x04787b81
                                                0x04787b85
                                                0x04787b87
                                                0x00000000
                                                0x00000000
                                                0x04787b31
                                                0x04787b34
                                                0x04787b3c
                                                0x04787b45
                                                0x04787b46
                                                0x04787b4f
                                                0x04787b51
                                                0x04787b57
                                                0x04787b59
                                                0x04787b59
                                                0x00000000
                                                0x04787b59
                                                0x04787b77
                                                0x00000000
                                                0x04787b77
                                                0x04787b2a
                                                0x00000000
                                                0x04787b2a
                                                0x04787af1
                                                0x04787af3
                                                0x00000000
                                                0x00000000
                                                0x04787afb
                                                0x04787afc
                                                0x04787afe
                                                0x00000000
                                                0x00000000
                                                0x04787b00
                                                0x04787b03
                                                0x00000000
                                                0x00000000
                                                0x04787b05
                                                0x04787b09
                                                0x04787b0d
                                                0x04787b0f
                                                0x00000000
                                                0x00000000
                                                0x04787b18
                                                0x04787b1d
                                                0x00000000
                                                0x04787b1d
                                                0x04787ab7
                                                0x04787ab9
                                                0x00000000
                                                0x00000000
                                                0x04787abf
                                                0x04787ac1
                                                0x00000000
                                                0x00000000
                                                0x04787ac3
                                                0x04787ac6
                                                0x00000000
                                                0x00000000
                                                0x04787ac8
                                                0x04787acc
                                                0x04787ad0
                                                0x04787ad2
                                                0x00000000
                                                0x00000000
                                                0x04787adb
                                                0x00000000
                                                0x04787adb
                                                0x047879d6
                                                0x047879d9
                                                0x047879dc
                                                0x04787a91
                                                0x04787a94
                                                0x00000000
                                                0x04787a94
                                                0x047879e2
                                                0x00000000
                                                0x047879e2
                                                0x04787a74
                                                0x04787a7a
                                                0x00000000
                                                0x00000000
                                                0x04787a8a
                                                0x04787a21
                                                0x04787a21
                                                0x00000000
                                                0x04787a21
                                                0x0471c650
                                                0x0471c651
                                                0x0471c656
                                                0x0471c65c
                                                0x0471c65d
                                                0x0471c663
                                                0x0471c664
                                                0x0471c66a
                                                0x0471c66e
                                                0x047879c5
                                                0x047879c7
                                                0x00000000
                                                0x047879c7
                                                0x0471c67a
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 262986040acc77d5a1b275901fe1a84c58e9443bfb2f6ef1cd56ac5e4dfab78d
                                                • Instruction ID: b140ad4076087c0cfe8057015518732f111f8e68e22d5f82834a93d727f3e8a1
                                                • Opcode Fuzzy Hash: 262986040acc77d5a1b275901fe1a84c58e9443bfb2f6ef1cd56ac5e4dfab78d
                                                • Instruction Fuzzy Hash: B5817076684201DFDB29EF18CC80A6A77E5EB84354F24486EED469B350E330FD45CBA2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D03DA Relevance: .2, Instructions: 218COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 73%
                                                			E047D03DA(signed int* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int* _v20;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				intOrPtr* _t80;
				signed int _t87;
				signed char _t90;
				signed int _t107;
				intOrPtr* _t119;
				signed int _t120;
				signed int _t121;
				signed char _t127;
				void* _t129;
				intOrPtr* _t130;
				signed int _t137;
				signed int _t139;
				signed int _t141;
				signed int _t144;
				signed char _t148;
				signed int _t154;
				signed char _t155;
				signed int _t164;
				unsigned int _t167;
				signed int _t168;
				signed int _t170;
				unsigned int _t173;
				signed int* _t174;
				signed int _t175;
				intOrPtr* _t177;
				signed int _t178;
				signed int _t179;
				signed int _t180;
				signed char _t183;
				intOrPtr _t184;
				unsigned int _t186;
				unsigned int _t187;

				_push( *0x480634c);
				_t119 = __ecx;
				_t184 = __edx;
				_push( *0x4806348);
				_v20 = __ecx;
				_push(0);
				_t129 = 0xc;
				_t80 = E047DBBBB(_t129, _t129);
				_t130 = _t80;
				_v16 = _t130;
				if(_t130 == 0) {
					return _t80;
				}
				 *((intOrPtr*)(_t130 + 8)) = _a4;
				_t82 =  &(__ecx[1]);
				 *((intOrPtr*)(_t130 + 4)) = _t184;
				_v36 =  &(__ecx[1]);
				E04732280( &(__ecx[1]), _t82);
				_v12 = 1;
				 *_t119 =  *((intOrPtr*)( *[fs:0x18] + 0x24));
				_t120 = _t119 + 8;
				_t175 =  *(_t120 + 4);
				_t87 = _t175 >> 5;
				if( *_t120 < _t87 + _t87) {
					L22:
					_t186 = _t175 >> 5;
					_t177 = _v16;
					_t90 = (_t87 | 0xffffffff) << (_t175 & 0x0000001f) &  *(_t177 + 4);
					_v8 = _t90;
					_t137 =  *(_t120 + 8);
					_v8 = (_v8 >> 0x18) + ((_v8 >> 0x00000010 & 0x000000ff) + ((_t90 >> 0x00000008 & 0x000000ff) + ((_t90 & 0x000000ff) + 0xb15dcb) * 0x25) * 0x25) * 0x25;
					_t67 = _t186 - 1; // 0xffffffdf
					_t164 = _t67 & _v8;
					 *_t177 =  *((intOrPtr*)(_t137 + _t164 * 4));
					 *((intOrPtr*)(_t137 + _t164 * 4)) = _t177;
					 *_t120 =  *_t120 + 1;
					_t178 = 0;
					L23:
					 *_v20 =  *_v20 & 0x00000000;
					E0472FFB0(_t120, _t178, _v36);
					if(_t178 != 0) {
						E047DBCD2(_t178,  *0x4806348,  *0x480634c);
					}
					return _v12;
				}
				_t139 = 2;
				_t87 = E0474F3D5( &_v8, _t87 * _t139, _t87 * _t139 >> 0x20);
				if(_t87 < 0) {
					goto L22;
				}
				_t187 = _v8;
				if(_t187 < 4) {
					_t187 = 4;
				}
				_push(0);
				_t87 = E047D0150(_t187 << 2);
				_t179 = _t87;
				_v8 = _t179;
				if(_t179 == 0) {
					_t175 =  *(_t120 + 4);
					if(_t175 >= 0x20) {
						goto L22;
					}
					_v12 = _v12 & 0x00000000;
					_t178 = _v16;
					goto L23;
				} else {
					_t19 = _t187 - 1; // 0x3
					_t141 = _t19;
					if((_t187 & _t141) == 0) {
						L10:
						if(_t187 > 0x4000000) {
							_t187 = 0x4000000;
						}
						_v28 = _v28 & 0x00000000;
						_t167 = _t187 << 2;
						_t107 = _t120 | 0x00000001;
						_v24 = _t179;
						_t168 = _t167 >> 2;
						asm("sbb ecx, ecx");
						_t144 =  !(_t167 + _t179) & _t168;
						if(_t144 <= 0) {
							L15:
							_t180 = 0;
							_t170 = (_t168 | 0xffffffff) << ( *(_t120 + 4) & 0x0000001f);
							_v24 = _t170;
							if(( *(_t120 + 4) & 0xffffffe0) <= 0) {
								L20:
								_t147 =  *(_t120 + 8);
								_t87 = _v8;
								_t175 =  *(_t120 + 4) & 0x0000001f | _t187 << 0x00000005;
								 *(_t120 + 8) = _t87;
								 *(_t120 + 4) = _t175;
								if( *(_t120 + 8) != 0) {
									_push(0);
									_t87 = E047D0180(_t147);
									_t175 =  *(_t120 + 4);
								}
								goto L22;
							} else {
								goto L16;
							}
							do {
								L16:
								_t121 =  *(_t120 + 8);
								_v32 = _t121;
								while(1) {
									_t148 =  *(_t121 + _t180 * 4);
									_v28 = _t148;
									if((_t148 & 0x00000001) != 0) {
										goto L19;
									}
									 *(_t121 + _t180 * 4) =  *_t148;
									_t124 =  *(_t148 + 4) & _t170;
									_t173 = _v8;
									_t154 = _t187 - 0x00000001 & (( *(_t148 + 4) & _t170) >> 0x00000018) + ((( *(_t148 + 4) & _t170) >> 0x00000010 & 0x000000ff) + ((_t124 >> 0x00000008 & 0x000000ff) + ((_t124 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
									_t127 = _v28;
									 *_t127 =  *(_t173 + _t154 * 4);
									 *(_t173 + _t154 * 4) = _t127;
									_t170 = _v24;
									_t121 = _v32;
								}
								L19:
								_t180 = _t180 + 1;
								_t120 =  &(_v20[2]);
							} while (_t180 <  *(_t120 + 4) >> 5);
							goto L20;
						} else {
							_t174 = _t179;
							_t183 = _v28;
							do {
								_t183 = _t183 + 1;
								 *_t174 = _t107;
								_t174 =  &(_t174[1]);
							} while (_t183 < _t144);
							goto L15;
						}
					}
					_t155 = _t141 | 0xffffffff;
					if(_t187 == 0) {
						L9:
						_t187 = 1 << _t155;
						goto L10;
					} else {
						goto L8;
					}
					do {
						L8:
						_t155 = _t155 + 1;
						_t187 = _t187 >> 1;
					} while (_t187 != 0);
					goto L9;
				}
			}













































                                                0x047d03e5
                                                0x047d03eb
                                                0x047d03ed
                                                0x047d03ef
                                                0x047d03f5
                                                0x047d03f8
                                                0x047d03fc
                                                0x047d03ff
                                                0x047d0404
                                                0x047d0406
                                                0x047d040b
                                                0x047d0619
                                                0x047d0619
                                                0x047d0414
                                                0x047d0417
                                                0x047d041b
                                                0x047d041e
                                                0x047d0421
                                                0x047d042c
                                                0x047d0436
                                                0x047d0438
                                                0x047d043b
                                                0x047d0440
                                                0x047d0448
                                                0x047d058e
                                                0x047d0596
                                                0x047d059b
                                                0x047d05a0
                                                0x047d05a3
                                                0x047d05d1
                                                0x047d05d6
                                                0x047d05d9
                                                0x047d05dc
                                                0x047d05e2
                                                0x047d05e4
                                                0x047d05e7
                                                0x047d05e9
                                                0x047d05eb
                                                0x047d05f1
                                                0x047d05f4
                                                0x047d05fb
                                                0x047d060b
                                                0x047d060b
                                                0x00000000
                                                0x047d0610
                                                0x047d0450
                                                0x047d0458
                                                0x047d045f
                                                0x00000000
                                                0x00000000
                                                0x047d0465
                                                0x047d046b
                                                0x047d046f
                                                0x047d046f
                                                0x047d0472
                                                0x047d0478
                                                0x047d047d
                                                0x047d047f
                                                0x047d0484
                                                0x047d061c
                                                0x047d0622
                                                0x00000000
                                                0x00000000
                                                0x047d0628
                                                0x047d062c
                                                0x00000000
                                                0x047d048a
                                                0x047d048a
                                                0x047d048a
                                                0x047d048f
                                                0x047d04a2
                                                0x047d04a9
                                                0x047d04ab
                                                0x047d04ab
                                                0x047d04ad
                                                0x047d04b3
                                                0x047d04b8
                                                0x047d04bb
                                                0x047d04c1
                                                0x047d04c6
                                                0x047d04ca
                                                0x047d04cc
                                                0x047d04dd
                                                0x047d04e6
                                                0x047d04e8
                                                0x047d04f1
                                                0x047d04f4
                                                0x047d0568
                                                0x047d056b
                                                0x047d0571
                                                0x047d0577
                                                0x047d0579
                                                0x047d057c
                                                0x047d0581
                                                0x047d0583
                                                0x047d0586
                                                0x047d058b
                                                0x047d058b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d04f6
                                                0x047d04f6
                                                0x047d04f6
                                                0x047d04f9
                                                0x047d04fc
                                                0x047d04fc
                                                0x047d04ff
                                                0x047d0505
                                                0x00000000
                                                0x00000000
                                                0x047d0509
                                                0x047d050f
                                                0x047d0532
                                                0x047d0542
                                                0x047d0544
                                                0x047d054a
                                                0x047d054c
                                                0x047d054f
                                                0x047d0552
                                                0x047d0552
                                                0x047d0557
                                                0x047d055a
                                                0x047d055b
                                                0x047d0564
                                                0x00000000
                                                0x047d04ce
                                                0x047d04ce
                                                0x047d04d0
                                                0x047d04d3
                                                0x047d04d3
                                                0x047d04d4
                                                0x047d04d6
                                                0x047d04d9
                                                0x00000000
                                                0x047d04d3
                                                0x047d04cc
                                                0x047d0491
                                                0x047d0496
                                                0x047d049d
                                                0x047d04a0
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d0498
                                                0x047d0498
                                                0x047d0498
                                                0x047d0499
                                                0x047d0499
                                                0x00000000
                                                0x047d0498

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1952dc36ca040ed33c08de45a965bdfaa9fbf82e54acf8193096bbe8d27adbe3
                                                • Instruction ID: 452f371637e027d24a53c10e83c7977af1f95d6eb76bf8aaf18b5afc1d28d778
                                                • Opcode Fuzzy Hash: 1952dc36ca040ed33c08de45a965bdfaa9fbf82e54acf8193096bbe8d27adbe3
                                                • Instruction Fuzzy Hash: A971C272A10215DBDB18CF58C980B6DBBF2EF89314F198269D816AF386D735ED41CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DD616 Relevance: .2, Instructions: 216COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 60%
                                                			E047DD616(signed int __ecx, intOrPtr __edx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t79;
				signed char _t86;
				signed int _t88;
				void* _t91;
				signed int _t94;
				signed int _t95;
				unsigned int _t96;
				signed int _t110;
				signed char _t118;
				intOrPtr _t120;
				signed int _t123;
				signed int _t124;
				signed char _t131;
				signed int _t133;
				signed int _t137;
				signed char _t147;
				signed int _t153;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				signed int _t164;
				signed int _t169;
				signed int _t173;

				_v8 =  *0x480d360 ^ _t173;
				_t120 = __edx;
				_t159 = __ecx;
				_v40 = __edx;
				_t150 =  *(__edx + 1) & 0x000000ff;
				_t174 =  *0x480610c & 0x00000001;
				_t160 = 0;
				_v24 = 0;
				_v28 =  *(0x46faef0 + ( *(__edx + 1) & 0x000000ff) * 2) & 0x0000ffff;
				if(( *0x480610c & 0x00000001) == 0) {
					_v12 = 0;
				} else {
					_v12 = E047DC70A(__ecx + 0x38, _t150);
				}
				_t79 = E047DC5FF(_t120, 0, _t174);
				_t153 = _t79 * _v28;
				_v36 = _t153;
				_v32 = (0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + ((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + 0xfff + _t153 >> 0xc) * 2;
				_t86 = E047DA359((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + ((0x00000027 + (0x0000001f + _t79 * 0x00000002 >> 0x00000005) * 0x00000004 & 0xfffffff8) + 0xfff + _t153 >> 0xc) * 2 + _t153,  *((intOrPtr*)(_t159 + 0x2c)));
				_t131 = _t86;
				_v16 = _t86;
				if(_t131 <= 0xc) {
					_t131 = 0xc;
					_v16 = _t131;
				}
				_t123 = 1 << _t131;
				_v20 = 1;
				if(( *0x480610c & 0x00000008) == 0) {
					L11:
					_t88 = 1;
					__eflags = 1;
					L12:
					_t133 = _a4 & _t88;
					_v32 = _t133;
					if(_t133 == 0) {
						L0473FAD0(_t159 + 0x34);
					}
					_t134 = _t159 + (_v16 + 0xfffffffc) * 8;
					_t91 = 0;
					if( *((intOrPtr*)(_t159 + (_v16 + 0xfffffffc) * 8 + 4)) == 0) {
						_t124 = 0;
					} else {
						_t124 = E04741710(_t134);
						_t91 = 0;
					}
					if(_t124 != 0) {
						_t94 = 1 <<  *(_t124 + 0x1c);
						__eflags = 1;
						goto L22;
					} else {
						 *0x480b1e0( *_t159, _v20, _t91, _a4);
						_t124 =  *( *(_t159 + 4) ^  *0x4806110 ^ _t159)();
						if(_t124 != 0) {
							_t94 = 0;
							_t160 = 0;
							L22:
							__eflags =  *0x480610c & 0x00000002;
							_v16 = _t94;
							if(( *0x480610c & 0x00000002) == 0) {
								L25:
								_t95 = E047DD597(_v20, _v28);
								_t156 = _t95;
								_v12 = _t95;
								L26:
								_t96 = _v16;
								__eflags = _t96;
								if(_t96 != 0) {
									__eflags =  *((char*)(_t124 + 0x1d)) - 1;
									if( *((char*)(_t124 + 0x1d)) > 1) {
										_t169 = _t96 >> 0xc;
										__eflags = _t169;
										_t160 =  ~_t169;
										_v24 = _t160;
									}
								}
								__eflags = _t96 - _t156;
								if(_t96 >= _t156) {
									L33:
									_t137 = _v20;
									__eflags = _t156 - _t137;
									if(_t156 != _t137) {
										_t160 = _t160 + (_t156 >> 0xc);
										__eflags = _t160;
									}
									__eflags = _t160;
									if(_t160 != 0) {
										asm("lock xadd [eax], esi");
									}
									_push(_t137);
									_t156 = _t137;
									E047DDEF6(_t124, _t137, _t137, _v28);
									asm("lock inc dword [eax+0x20]");
									asm("lock xadd [eax], ecx");
									_t161 = _t124;
									_t124 = 0;
									__eflags = 0;
									goto L38;
								} else {
									 *0x480b1e0( *_t159, _t124, _t156);
									_t110 =  *( *(_t159 + 0xc) ^  *0x4806110 ^ _t159)();
									__eflags = _t110;
									if(_t110 >= 0) {
										_t160 = _v24;
										_t156 = _v12;
										goto L33;
									}
									_t161 = 0;
									L38:
									_v12 = _t161;
									__eflags = _t124;
									if(_t124 != 0) {
										_t164 =  *(_t159 + 8) ^  *0x4806110 ^ _t159;
										__eflags = _t164;
										 *0x480b1e0( *_t159, _t124, _v20, _a4);
										 *_t164();
										_t161 = _v12;
									}
									L40:
									if(_v32 == 0) {
										E0473FA00(_t124, _t159 + 0x34, _t159, _t159 + 0x34);
									}
									return E0475B640(_t161, _t124, _v8 ^ _t173, _t156, _t159, _t161);
								}
							}
							__eflags = _v12;
							if(_v12 == 0) {
								goto L25;
							}
							_t156 = _v20;
							_v12 = _t156;
							goto L26;
						}
						_t161 = 0;
						goto L40;
					}
				}
				_t146 = _v36;
				if(_v32 > _v36 >> 6) {
					goto L11;
				}
				_t118 = E047DA359(_t146,  *((intOrPtr*)(_t159 + 0x2c)));
				_t147 = _t118;
				_v16 = _t118;
				if(_t147 <= 0xc) {
					_t147 = 0xc;
					_v16 = _t147;
				}
				_t88 = 1;
				_t156 = 1 << _t147;
				if(_t123 > 1) {
					_v20 = 1;
				}
				goto L12;
			}






































                                                0x047dd625
                                                0x047dd629
                                                0x047dd62d
                                                0x047dd62f
                                                0x047dd632
                                                0x047dd638
                                                0x047dd63f
                                                0x047dd641
                                                0x047dd64c
                                                0x047dd64f
                                                0x047dd660
                                                0x047dd651
                                                0x047dd659
                                                0x047dd659
                                                0x047dd667
                                                0x047dd66e
                                                0x047dd67c
                                                0x047dd69a
                                                0x047dd6a0
                                                0x047dd6a5
                                                0x047dd6a7
                                                0x047dd6ad
                                                0x047dd6b1
                                                0x047dd6b2
                                                0x047dd6b2
                                                0x047dd6b8
                                                0x047dd6c1
                                                0x047dd6c4
                                                0x047dd6fb
                                                0x047dd6fd
                                                0x047dd6fd
                                                0x047dd6fe
                                                0x047dd701
                                                0x047dd703
                                                0x047dd706
                                                0x047dd70c
                                                0x047dd70c
                                                0x047dd717
                                                0x047dd71a
                                                0x047dd720
                                                0x047dd72d
                                                0x047dd722
                                                0x047dd727
                                                0x047dd729
                                                0x047dd729
                                                0x047dd731
                                                0x047dd76a
                                                0x047dd76a
                                                0x00000000
                                                0x047dd733
                                                0x047dd749
                                                0x047dd751
                                                0x047dd755
                                                0x047dd75e
                                                0x047dd760
                                                0x047dd76c
                                                0x047dd76c
                                                0x047dd773
                                                0x047dd776
                                                0x047dd786
                                                0x047dd78c
                                                0x047dd791
                                                0x047dd793
                                                0x047dd796
                                                0x047dd796
                                                0x047dd799
                                                0x047dd79b
                                                0x047dd79d
                                                0x047dd7a1
                                                0x047dd7a5
                                                0x047dd7a5
                                                0x047dd7a8
                                                0x047dd7aa
                                                0x047dd7aa
                                                0x047dd7a1
                                                0x047dd7ad
                                                0x047dd7af
                                                0x047dd7d8
                                                0x047dd7d8
                                                0x047dd7db
                                                0x047dd7dd
                                                0x047dd7e4
                                                0x047dd7e4
                                                0x047dd7e4
                                                0x047dd7e6
                                                0x047dd7e8
                                                0x047dd7f0
                                                0x047dd7f0
                                                0x047dd7f4
                                                0x047dd7f9
                                                0x047dd7fd
                                                0x047dd805
                                                0x047dd810
                                                0x047dd814
                                                0x047dd816
                                                0x047dd816
                                                0x00000000
                                                0x047dd7b1
                                                0x047dd7c2
                                                0x047dd7c8
                                                0x047dd7ca
                                                0x047dd7cc
                                                0x047dd7d2
                                                0x047dd7d5
                                                0x00000000
                                                0x047dd7d5
                                                0x047dd7ce
                                                0x047dd818
                                                0x047dd818
                                                0x047dd81b
                                                0x047dd81d
                                                0x047dd831
                                                0x047dd831
                                                0x047dd835
                                                0x047dd83b
                                                0x047dd83d
                                                0x047dd83d
                                                0x047dd840
                                                0x047dd844
                                                0x047dd84a
                                                0x047dd84a
                                                0x047dd861
                                                0x047dd861
                                                0x047dd7af
                                                0x047dd778
                                                0x047dd77c
                                                0x00000000
                                                0x00000000
                                                0x047dd77e
                                                0x047dd781
                                                0x00000000
                                                0x047dd781
                                                0x047dd757
                                                0x00000000
                                                0x047dd757
                                                0x047dd731
                                                0x047dd6c6
                                                0x047dd6d1
                                                0x00000000
                                                0x00000000
                                                0x047dd6d6
                                                0x047dd6db
                                                0x047dd6dd
                                                0x047dd6e3
                                                0x047dd6e7
                                                0x047dd6e8
                                                0x047dd6e8
                                                0x047dd6ed
                                                0x047dd6f0
                                                0x047dd6f4
                                                0x047dd6f6
                                                0x047dd6f6
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3948cd1840d63e2a11060db02528a0e11bf1c8515ae47795a9081ad9bd7ae7cd
                                                • Instruction ID: e00de522a576c408aed130f024266ca8025e0d2833979e76212d6c2a0ce37259
                                                • Opcode Fuzzy Hash: 3948cd1840d63e2a11060db02528a0e11bf1c8515ae47795a9081ad9bd7ae7cd
                                                • Instruction Fuzzy Hash: A7819E71E2021A9FCB24DFA9C8846AEBBF5FF48314F158569D815EB340EB74A951CBC0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DDBD2 Relevance: .2, Instructions: 212COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 93%
                                                			E047DDBD2(intOrPtr* __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				signed short _v12;
				unsigned int _v16;
				intOrPtr* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed short _v40;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int* _t75;
				signed short _t77;
				intOrPtr _t78;
				signed int _t92;
				signed int _t98;
				signed int _t99;
				signed short _t105;
				unsigned int _t108;
				void* _t112;
				unsigned int _t119;
				signed int _t124;
				intOrPtr _t137;
				signed char _t139;
				signed int _t140;
				unsigned int _t141;
				signed char _t142;
				intOrPtr _t152;
				signed int _t153;
				signed int _t158;
				signed int _t159;
				intOrPtr _t172;
				signed int _t176;
				signed int _t178;
				signed short _t182;
				intOrPtr _t183;

				_t119 = __edx;
				_v20 = __ecx;
				_t152 = _a4;
				_t172 = 0;
				_t182 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0x4806114;
				_v16 = __edx;
				_v36 = 0;
				_v5 = 0xff;
				_v40 = _t182;
				_v24 = _t182 >> 0x10;
				if(_t152 == 0) {
					L14:
					_t124 =  *(_t119 + 0x12) & 0x0000ffff;
					_v24 = _t124;
					_t183 = _v36;
					_t53 = _t119 + 0x10; // 0x10
					_t75 = _t53;
					_v28 = _t75;
					_t77 =  *_t75 & 0x0000ffff;
					_v12 = _t77;
					L15:
					while(1) {
						if(_t183 != 0) {
							L20:
							_t153 = _t77 + 0x00000001 & 0x0000ffff;
							asm("lock cmpxchg [ebx], cx");
							_t119 = _v16;
							_t77 = _t77 & 0x0000ffff;
							_v12 = _t77;
							if(_t153 == (_t77 & 0x0000ffff) + 1) {
								if(_t77 == 0) {
									_t78 = _t172;
									L27:
									_t119 = L047DD016(_t119, _t183, _t119, _t78);
									E0472FFB0(_t119, _t172, _t183 + 8);
									_t183 = _t172;
									if(_t119 != 0) {
										E047DC52D(_v20,  *((intOrPtr*)(_v20 + 0x78 + ( *(((_v40 & 0x0000ffff) + 7 >> 3) + 0x46faff8) & 0x000000ff) * 4)), _t119, _a8);
									}
									L29:
									_t172 = 1;
									if(_t183 != 0) {
										_t72 = _t183 + 8; // 0x8
										E0472FFB0(_t119, 1, _t72);
									}
									L31:
									return _t172;
								}
								if((_t77 & 0x0000ffff) != _v24 - 1) {
									goto L29;
								}
								_t78 = 2;
								goto L27;
							}
							_t124 = _v24;
							continue;
						}
						if(_t77 == 0 || (_t77 & 0x0000ffff) == _t124 - 1) {
							_t183 = E047DE018(_t119,  &_v5);
							if(_t183 == 0) {
								_t172 = 1;
								goto L31;
							}
							goto L19;
						} else {
							L19:
							_t77 = _v12;
							goto L20;
						}
					}
				}
				_t92 = _t182 & 0x0000ffff;
				_v28 = _t92;
				_t137 =  *((intOrPtr*)(__ecx + 0x78 + ( *((_t92 + 7 >> 3) + 0x46faff8) & 0x000000ff) * 4));
				_t98 =  *((intOrPtr*)(_t137 + 0x24));
				_t158 = _t152 - (_v24 & 0x0000ffff) - __edx;
				_v24 = _t98;
				_t99 = _t158;
				_v32 = _t158;
				_t139 =  *(_t137 + 0x28) & 0x000000ff;
				if(_t98 == 0) {
					_v12 = _t99 >> _t139;
					_t159 = _t158 & (1 << _t139) - 0x00000001;
					_t105 = _v12;
				} else {
					_t105 = E0475D340(_t99 * _v24, _t139, _t99 * _v24 >> 0x20);
					_v12 = _t105;
					_t159 = _v32 - _v28 * _t105;
				}
				if(_t159 == 0) {
					_t140 =  *(_t119 + 0x14) & 0x0000ffff;
					if(_t140 >= _t105) {
						_t140 = _t105 & 0x0000ffff;
					}
					 *(_t119 + 0x14) = _t140;
					_t141 = _t105 + _t105;
					_t142 = _t141 & 0x0000001f;
					_t176 = 3;
					_t178 =  !(_t176 << _t142);
					_t108 =  *(_t119 + (_t141 >> 5) * 4 + 0x20);
					do {
						asm("lock cmpxchg [ebx], edx");
					} while ((_t108 & _t178) != 0);
					if((_t108 >> _t142 & 0x00000001) != 0) {
						_t119 = _v16;
						_t172 = 0;
						if( *((char*)(_t119 + 0x1d)) > 1) {
							_t112 = E047DD864(_t119, _a4 - _t119, _t182 & 0x0000ffff, 0,  &_v32);
							_t184 = _t112;
							if(_t112 != 0xffffffff) {
								asm("lock xadd [ecx], edx");
								E047DD8DF(_v20, _t119, _t184, 2, _a8);
							}
						}
						goto L14;
					}
					_push(_t142);
					_push(_v12);
					E047DA80D( *_v20, 0x11, _a4, _v16);
					_t172 = 0;
				}
			}








































                                                0x047ddbdc
                                                0x047ddbde
                                                0x047ddbe1
                                                0x047ddbed
                                                0x047ddbef
                                                0x047ddbf7
                                                0x047ddbfd
                                                0x047ddc00
                                                0x047ddc04
                                                0x047ddc07
                                                0x047ddc0c
                                                0x047ddd1f
                                                0x047ddd1f
                                                0x047ddd23
                                                0x047ddd26
                                                0x047ddd29
                                                0x047ddd29
                                                0x047ddd2c
                                                0x047ddd32
                                                0x047ddd35
                                                0x00000000
                                                0x047ddd38
                                                0x047ddd3a
                                                0x047ddd5d
                                                0x047ddd63
                                                0x047ddd69
                                                0x047ddd6e
                                                0x047ddd71
                                                0x047ddd78
                                                0x047ddd7d
                                                0x047ddd8c
                                                0x047ddd9e
                                                0x047ddda0
                                                0x047dddad
                                                0x047dddb0
                                                0x047dddb5
                                                0x047dddb9
                                                0x047dddd9
                                                0x047dddd9
                                                0x047dddde
                                                0x047ddde0
                                                0x047ddde3
                                                0x047ddde5
                                                0x047ddde9
                                                0x047ddde9
                                                0x047dddee
                                                0x047dddf6
                                                0x047dddf6
                                                0x047ddd97
                                                0x00000000
                                                0x00000000
                                                0x047ddd9b
                                                0x00000000
                                                0x047ddd9b
                                                0x047ddd7f
                                                0x00000000
                                                0x047ddd7f
                                                0x047ddd3f
                                                0x047ddd54
                                                0x047ddd58
                                                0x047ddd86
                                                0x00000000
                                                0x047ddd86
                                                0x00000000
                                                0x047ddd5a
                                                0x047ddd5a
                                                0x047ddd5a
                                                0x00000000
                                                0x047ddd5a
                                                0x047ddd3f
                                                0x047ddd38
                                                0x047ddc12
                                                0x047ddc15
                                                0x047ddc25
                                                0x047ddc31
                                                0x047ddc34
                                                0x047ddc3b
                                                0x047ddc3e
                                                0x047ddc40
                                                0x047ddc43
                                                0x047ddc46
                                                0x047ddc62
                                                0x047ddc6b
                                                0x047ddc6d
                                                0x047ddc48
                                                0x047ddc4b
                                                0x047ddc59
                                                0x047ddc5c
                                                0x047ddc5c
                                                0x047ddc72
                                                0x047ddc78
                                                0x047ddc7f
                                                0x047ddc81
                                                0x047ddc81
                                                0x047ddc84
                                                0x047ddc88
                                                0x047ddc8d
                                                0x047ddc95
                                                0x047ddc9b
                                                0x047ddca0
                                                0x047ddca2
                                                0x047ddca6
                                                0x047ddca6
                                                0x047ddcb0
                                                0x047ddcd1
                                                0x047ddcd4
                                                0x047ddcda
                                                0x047ddcec
                                                0x047ddcf1
                                                0x047ddcf6
                                                0x047ddd0c
                                                0x047ddd1a
                                                0x047ddd1a
                                                0x047ddcf6
                                                0x00000000
                                                0x047ddcda
                                                0x047ddcb5
                                                0x047ddcb6
                                                0x047ddcc5
                                                0x047ddcca
                                                0x047ddcca

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8ccc6baf0873703dabafcd7abe97e4aeb4712571b75203340fc700d6ce97f054
                                                • Instruction ID: c684f26a458f6edc00273fe1bc22e917e2f37d4070371a6e82e1669a4db92587
                                                • Opcode Fuzzy Hash: 8ccc6baf0873703dabafcd7abe97e4aeb4712571b75203340fc700d6ce97f054
                                                • Instruction Fuzzy Hash: 6D714C75E101299FCF24DFA9C8809BEB7F1EF88314B144169E845EB344D634ED45DBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E28EC Relevance: .2, Instructions: 211COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 97%
                                                			E047E28EC(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				unsigned int _t62;
				unsigned int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t77;
				intOrPtr _t85;
				unsigned int _t95;
				signed int _t98;
				signed int _t100;
				void* _t104;
				signed short _t108;
				signed int _t113;
				intOrPtr _t115;
				signed int _t116;
				intOrPtr _t117;
				signed int _t118;
				intOrPtr _t120;
				signed int _t121;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				signed int _t136;
				signed int _t137;
				signed int _t140;
				signed int _t145;
				intOrPtr _t147;
				signed int _t148;
				void* _t156;

				_t115 = _a4;
				_v40 = __edx;
				_t147 = __ecx;
				_v20 = __ecx;
				if(__edx != _t115) {
					_t115 = _t115 + 2;
				}
				_t62 = _t115 + 7 >> 3;
				_t120 = _t62 + 1;
				_v28 = _t120;
				if(( *(_t147 + 0x38) & 0x00000001) != 0) {
					_t120 = _t62 + 2;
					_v28 = _t120;
				}
				_t64 = _t120 + _t120 & 0x0000ffff;
				_t136 = _a8 & 0x00000001;
				_v36 = _t120 + _t120 & 0x0000ffff;
				_v12 = _t136;
				if(_t136 == 0) {
					E04732280(_t64, _t147);
					_t136 = _v12;
				}
				_v5 = 0xff;
				while(1) {
					L7:
					_t121 = 0;
					_t145 =  *(_t147 + 8);
					_v24 =  *(_t147 + 0xc) & 1;
					_v16 = 0;
					if(_t145 == 0) {
						goto L17;
					}
					_t108 =  *0x4806110; // 0x4eb9a8c4
					_v32 = _t108 & 0x0000ffff;
					do {
						_t156 = _v36 - ( *(_t145 - 4) & 0x0000ffff ^ _t145 - 0x00000004 & 0x0000ffff ^ _v32);
						if(_t156 < 0) {
							__eflags = _v24;
							_t121 = _t145;
							_t113 =  *_t145;
							_v16 = _t121;
							if(_v24 == 0) {
								L15:
								_t145 = _t113;
								goto L16;
							}
							__eflags = _t113;
							if(_t113 == 0) {
								goto L15;
							}
							_t145 = _t145 ^ _t113;
							goto L16;
						}
						if(_t156 <= 0) {
							L18:
							if(_t145 != 0) {
								_t122 =  *0x4806110; // 0x4eb9a8c4
								_t36 = _t145 - 4; // -4
								_t116 = _t36;
								_t137 = _t116;
								_t69 =  *_t116 ^ _t122 ^ _t116;
								__eflags = _t69;
								if(_t69 >= 0) {
									_t71 = _t69 >> 0x00000010 & 0x00007fff;
									__eflags = _t71;
									if(_t71 == 0) {
										L36:
										_t72 = 0;
										__eflags = 0;
										L37:
										_t139 = _t137 - (_t72 << 0x0000000c) & 0xfffff000;
										__eflags = (0x0000abed ^  *((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x16)) -  *((intOrPtr*)((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x14));
										if(__eflags == 0) {
											_t77 = E047E25DD(_t147, _t139, __eflags, _t116, _v28, _a8,  &_v5);
											__eflags = _t77;
											if(_t77 == 0) {
												L39:
												_t148 = 0;
												__eflags = _v12;
												if(_v12 != 0) {
													L42:
													return _t148;
												}
												E0472FFB0(_t116, _t145, _v20);
												L41:
												_t148 = 0;
												__eflags = 0;
												goto L42;
											}
											_t46 = _t116 + 8; // 0x4
											_t148 = _t46;
											_t140 = (( *_t116 ^  *0x4806110 ^ _t116) >> 0x00000001 & 0x00007fff) * 8 - 8;
											_t85 = _v20;
											__eflags =  *(_t85 + 0x38) & 0x00000001;
											if(( *(_t85 + 0x38) & 0x00000001) != 0) {
												_t118 = _t116 + 0x10;
												__eflags = _t118 & 0x00000fff;
												if((_t118 & 0x00000fff) == 0) {
													_t148 = _t118;
													_t140 = _t140 - 8;
													__eflags = _t140;
												}
											}
											_t117 = _v40;
											_t124 =  *_t145;
											__eflags = _t117 - _t140;
											if(_t117 >= _t140) {
												_t125 = _t124 & 0xfffffeff;
												__eflags = _t125;
												 *_t145 = _t125;
											} else {
												_t126 = _t124 | 0x00000100;
												_push(_t126);
												 *_t145 = _t126;
												E047E2506(_t148, _t140, _t140 - _t117);
												_t85 = _v20;
											}
											__eflags = _v12;
											if(_v12 == 0) {
												E0472FFB0(_t117, _t145, _t85);
											}
											__eflags = _a8 & 0x00000002;
											if((_a8 & 0x00000002) != 0) {
												E0475FA60(_t148, 0, _t117);
											}
											goto L42;
										}
										_push(_t122);
										_push(0);
										E047DA80D( *((intOrPtr*)(_t147 + 0x20)), 0x12, _t139, _t116);
										goto L39;
									}
									_t137 = _t116 - (_t71 << 3);
									_t95 =  *_t137 ^ _t122 ^ _t137;
									__eflags = _t95;
									if(_t95 < 0) {
										L34:
										_t98 =  *(_t137 + 4) ^ _t122 ^ _t137;
										__eflags = _t98;
										L35:
										_t72 = _t98 & 0x000000ff;
										goto L37;
									}
									_t100 = _t95 >> 0x00000010 & 0x00007fff;
									__eflags = _t100;
									if(_t100 == 0) {
										goto L36;
									}
									_t137 = _t137 + _t100 * 0xfffffff8;
									__eflags = _t137;
									goto L34;
								}
								_t98 =  *_t145 ^ _t122 ^ _t116;
								goto L35;
							}
							if(_t136 == 0) {
								E0472FFB0(_t115, _t145, _t147);
							}
							_t104 = E047E3149(_t147, _t115, _a8);
							_t146 = _t104;
							if(_t104 == 0) {
								goto L41;
							} else {
								if(_v12 == 0) {
									E04732280(_t104, _t147);
								}
								_v5 = 0xff;
								E047E2876(_t147, _t146);
								_t136 = _v12;
								goto L7;
							}
						}
						_t113 =  *(_t145 + 4);
						if(_v24 == 0 || _t113 == 0) {
							_t121 = _v16;
							goto L15;
						} else {
							_t121 = _v16;
							_t145 = _t145 ^ _t113;
						}
						L16:
					} while (_t145 != 0);
					L17:
					_t145 = _t121;
					goto L18;
				}
			}











































                                                0x047e28f5
                                                0x047e28fa
                                                0x047e28fe
                                                0x047e2900
                                                0x047e2906
                                                0x047e2908
                                                0x047e2908
                                                0x047e290e
                                                0x047e2915
                                                0x047e2918
                                                0x047e291b
                                                0x047e291d
                                                0x047e2920
                                                0x047e2920
                                                0x047e2929
                                                0x047e292c
                                                0x047e292f
                                                0x047e2932
                                                0x047e2935
                                                0x047e2938
                                                0x047e293d
                                                0x047e293d
                                                0x047e2940
                                                0x047e2944
                                                0x047e2944
                                                0x047e2948
                                                0x047e294a
                                                0x047e2950
                                                0x047e2953
                                                0x047e2958
                                                0x00000000
                                                0x00000000
                                                0x047e295a
                                                0x047e2962
                                                0x047e2965
                                                0x047e2976
                                                0x047e2978
                                                0x047e29e0
                                                0x047e29e4
                                                0x047e29e6
                                                0x047e29e8
                                                0x047e29eb
                                                0x047e2993
                                                0x047e2993
                                                0x00000000
                                                0x047e2993
                                                0x047e29ed
                                                0x047e29ef
                                                0x00000000
                                                0x00000000
                                                0x047e29f1
                                                0x00000000
                                                0x047e29f1
                                                0x047e297a
                                                0x047e299b
                                                0x047e299d
                                                0x047e29f5
                                                0x047e29fb
                                                0x047e29fb
                                                0x047e2a00
                                                0x047e2a04
                                                0x047e2a04
                                                0x047e2a06
                                                0x047e2a13
                                                0x047e2a13
                                                0x047e2a18
                                                0x047e2a44
                                                0x047e2a44
                                                0x047e2a44
                                                0x047e2a46
                                                0x047e2a50
                                                0x047e2a5a
                                                0x047e2a5e
                                                0x047e2a99
                                                0x047e2a9e
                                                0x047e2aa0
                                                0x047e2a70
                                                0x047e2a70
                                                0x047e2a72
                                                0x047e2a75
                                                0x047e2a82
                                                0x047e2a89
                                                0x047e2a89
                                                0x047e2a7a
                                                0x047e2a7f
                                                0x047e2a7f
                                                0x047e2a7f
                                                0x00000000
                                                0x047e2a7f
                                                0x047e2aa4
                                                0x047e2aa4
                                                0x047e2ab6
                                                0x047e2abd
                                                0x047e2ac0
                                                0x047e2ac4
                                                0x047e2ac6
                                                0x047e2ac9
                                                0x047e2acf
                                                0x047e2ad1
                                                0x047e2ad3
                                                0x047e2ad3
                                                0x047e2ad3
                                                0x047e2acf
                                                0x047e2ad6
                                                0x047e2ad9
                                                0x047e2adb
                                                0x047e2add
                                                0x047e2af9
                                                0x047e2af9
                                                0x047e2aff
                                                0x047e2adf
                                                0x047e2adf
                                                0x047e2ae7
                                                0x047e2aea
                                                0x047e2aef
                                                0x047e2af4
                                                0x047e2af4
                                                0x047e2b01
                                                0x047e2b05
                                                0x047e2b08
                                                0x047e2b08
                                                0x047e2b0d
                                                0x047e2b11
                                                0x047e2b1b
                                                0x047e2b20
                                                0x00000000
                                                0x047e2b11
                                                0x047e2a60
                                                0x047e2a61
                                                0x047e2a6b
                                                0x00000000
                                                0x047e2a6b
                                                0x047e2a1f
                                                0x047e2a25
                                                0x047e2a25
                                                0x047e2a27
                                                0x047e2a38
                                                0x047e2a3d
                                                0x047e2a3d
                                                0x047e2a3f
                                                0x047e2a3f
                                                0x00000000
                                                0x047e2a3f
                                                0x047e2a2c
                                                0x047e2a2c
                                                0x047e2a31
                                                0x00000000
                                                0x00000000
                                                0x047e2a36
                                                0x047e2a36
                                                0x00000000
                                                0x047e2a36
                                                0x047e2a0c
                                                0x00000000
                                                0x047e2a0c
                                                0x047e29a1
                                                0x047e29a4
                                                0x047e29a4
                                                0x047e29b0
                                                0x047e29b5
                                                0x047e29b9
                                                0x00000000
                                                0x047e29bf
                                                0x047e29c3
                                                0x047e29c6
                                                0x047e29c6
                                                0x047e29cd
                                                0x047e29d3
                                                0x047e29d8
                                                0x00000000
                                                0x047e29d8
                                                0x047e29b9
                                                0x047e2980
                                                0x047e2983
                                                0x047e2990
                                                0x00000000
                                                0x047e2989
                                                0x047e2989
                                                0x047e298c
                                                0x047e298c
                                                0x047e2995
                                                0x047e2995
                                                0x047e2999
                                                0x047e2999
                                                0x00000000
                                                0x047e2999

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0641fc46642c84e62c8766ab8880f9a681eb38a152284c46fd885f267781f65f
                                                • Instruction ID: 18284c0205a0baffc88d7bbf1e0cf60eee703d6a219c068c1243eca999e09614
                                                • Opcode Fuzzy Hash: 0641fc46642c84e62c8766ab8880f9a681eb38a152284c46fd885f267781f65f
                                                • Instruction Fuzzy Hash: AD71C431A0010A9BDB24CF6AD88467EB7FAEF4C314F1486A9D915E7382EB34F941D790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04796DC9 Relevance: .2, Instructions: 199COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 79%
                                                			E04796DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E04796B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E04737D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E04759AE0();
					_t87 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E0479795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E0479795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E0479795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E0479795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L04734620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E04796B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E04796B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E04796B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E04796B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E04737D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E04759AE0();
								L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L04732400( &_v36);
							if(_v24 >= 0) {
								_t87 = L04732400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L04732400( &_v52);
							}
							if(_v28 >= 0) {
								return L04732400( &_v60);
							}
						}
					}
				}
				return _t87;
			}































                                                0x04796dd4
                                                0x04796dde
                                                0x04796de1
                                                0x04796de3
                                                0x04796de6
                                                0x04796de9
                                                0x04796dec
                                                0x04796def
                                                0x04796df2
                                                0x04796df5
                                                0x04796dfe
                                                0x04796e04
                                                0x04796e09
                                                0x04796e0d
                                                0x04796e18
                                                0x04796e1b
                                                0x04796e22
                                                0x04796e2d
                                                0x04796e30
                                                0x04796e36
                                                0x04796e42
                                                0x04796e4d
                                                0x04796e50
                                                0x04796e55
                                                0x04796e5c
                                                0x04796e6e
                                                0x04796e5e
                                                0x04796e67
                                                0x04796e67
                                                0x04796e73
                                                0x04796e74
                                                0x04796e77
                                                0x04796e7c
                                                0x04796e7d
                                                0x04796e8e
                                                0x04796e93
                                                0x04796e9c
                                                0x04796ea8
                                                0x04796eab
                                                0x04796eac
                                                0x04796eb3
                                                0x04796ecd
                                                0x04796edc
                                                0x04796ee2
                                                0x04796ee5
                                                0x04796ef2
                                                0x04796efb
                                                0x04796f01
                                                0x04796f06
                                                0x04796f0b
                                                0x04796f11
                                                0x04796f1a
                                                0x04796f22
                                                0x04796f26
                                                0x04796f26
                                                0x04796f33
                                                0x04796f41
                                                0x04796f44
                                                0x04796f47
                                                0x04796f54
                                                0x04796f65
                                                0x04796f77
                                                0x04796f7c
                                                0x04796f82
                                                0x04796f91
                                                0x04796f99
                                                0x04796fa3
                                                0x04796fae
                                                0x04796fae
                                                0x04796fba
                                                0x04796fbb
                                                0x04796fbc
                                                0x04796fc1
                                                0x04796fc2
                                                0x04796fd3
                                                0x04796fd8
                                                0x04796fd8
                                                0x04796fdf
                                                0x04796fe8
                                                0x04796fee
                                                0x04796fee
                                                0x04796ff5
                                                0x04796ffb
                                                0x04796ffb
                                                0x04797004
                                                0x00000000
                                                0x0479700a
                                                0x04797004
                                                0x04796eb3
                                                0x04796e9c
                                                0x04797015

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                                • Instruction ID: d12cf132e00f876f822fb5c4bcf65d8ea99010b88b8e6be052563524757b34e1
                                                • Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                                • Instruction Fuzzy Hash: 7C716B71A00609EFDB14DFA8D984AAEBBF9FF48714F104569E504A7351DB30BE41CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047AB8D0 Relevance: .2, Instructions: 199COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 39%
                                                			E047AB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4807b9c; // 0x0
				_t124 = L04734620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04759800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E047595B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E047595D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L047377F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04759910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E047595D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4807b9c; // 0x0
									_t92 = L04734620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04759910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0471A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E047AE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E047AE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E047595B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}




















                                                0x047ab8d9
                                                0x047ab8e4
                                                0x00000000
                                                0x047ab8e6
                                                0x047ab8f3
                                                0x047ab8f5
                                                0x047ab8f5
                                                0x047ab8f8
                                                0x047ab920
                                                0x047ab924
                                                0x047ab936
                                                0x047ab939
                                                0x047ab93d
                                                0x047ab948
                                                0x047ab9a0
                                                0x047ab9a0
                                                0x047ab9a4
                                                0x047ab9bf
                                                0x047ab9c4
                                                0x047ab9c6
                                                0x047ab9cd
                                                0x047ab9d1
                                                0x047abad4
                                                0x047abad8
                                                0x047abada
                                                0x047abadc
                                                0x047abadc
                                                0x047abadf
                                                0x047abae0
                                                0x047abae2
                                                0x047abae4
                                                0x047abaec
                                                0x047abaee
                                                0x047abaf0
                                                0x047abaf0
                                                0x047abaec
                                                0x047abafb
                                                0x047abafc
                                                0x047abafe
                                                0x047abb01
                                                0x047abb01
                                                0x00000000
                                                0x047abb06
                                                0x047ab9d7
                                                0x047ab9db
                                                0x047ab9db
                                                0x047ab9de
                                                0x047ab9de
                                                0x047ab9e4
                                                0x047ab9e7
                                                0x047ab9ea
                                                0x047ab9ec
                                                0x047ab9ef
                                                0x047ab9f3
                                                0x047aba1b
                                                0x047aba1b
                                                0x047aba23
                                                0x047aba24
                                                0x047aba27
                                                0x047aba2a
                                                0x047aba2b
                                                0x047aba2e
                                                0x047aba30
                                                0x047aba37
                                                0x047aba3f
                                                0x047aba9c
                                                0x047abaa2
                                                0x047abb13
                                                0x047abb15
                                                0x047abaae
                                                0x047abaae
                                                0x047abab3
                                                0x047abab5
                                                0x047ababa
                                                0x047abac8
                                                0x047abac8
                                                0x047ababa
                                                0x047abacd
                                                0x047abacf
                                                0x00000000
                                                0x047abacf
                                                0x047abb1a
                                                0x00000000
                                                0x047abb1c
                                                0x047abaa7
                                                0x047abb11
                                                0x00000000
                                                0x047abb11
                                                0x047abaa9
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047aba41
                                                0x047aba41
                                                0x047aba41
                                                0x047aba58
                                                0x047aba5d
                                                0x047aba62
                                                0x00000000
                                                0x00000000
                                                0x047aba64
                                                0x047aba67
                                                0x047aba68
                                                0x047aba69
                                                0x047aba6c
                                                0x047aba6f
                                                0x047aba71
                                                0x047aba78
                                                0x047aba80
                                                0x00000000
                                                0x00000000
                                                0x047aba90
                                                0x047aba90
                                                0x047aba97
                                                0x00000000
                                                0x047aba97
                                                0x047ab9f5
                                                0x047ab9f7
                                                0x047ab9f7
                                                0x047ab9fa
                                                0x047aba03
                                                0x047aba07
                                                0x047aba0c
                                                0x047aba10
                                                0x047aba17
                                                0x00000000
                                                0x047ab9f7
                                                0x047ab9a6
                                                0x047ab9a8
                                                0x047ab9af
                                                0x047ab9b3
                                                0x00000000
                                                0x00000000
                                                0x047ab9b9
                                                0x00000000
                                                0x047ab9b9
                                                0x047ab94d
                                                0x047ab98f
                                                0x047ab995
                                                0x047ab999
                                                0x047ab960
                                                0x047ab967
                                                0x047ab968
                                                0x047ab96a
                                                0x00000000
                                                0x047ab96a
                                                0x047ab99b
                                                0x047ab99e
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047ab99e
                                                0x047ab951
                                                0x047ab954
                                                0x047ab95a
                                                0x047ab95e
                                                0x047ab972
                                                0x047ab979
                                                0x047ab97d
                                                0x047ab97f
                                                0x047ab980
                                                0x047ab982
                                                0x047ab984
                                                0x00000000
                                                0x047ab984
                                                0x00000000
                                                0x047ab926
                                                0x00000000
                                                0x047ab926

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c1fba805c543e49b004b6bdb4408565b9102df4fb34ee85cbd4e77d45dd638d5
                                                • Instruction ID: e2804e2d466c5574b76d7540c7121d724201a3b5dc23022d4164d92495350939
                                                • Opcode Fuzzy Hash: c1fba805c543e49b004b6bdb4408565b9102df4fb34ee85cbd4e77d45dd638d5
                                                • Instruction Fuzzy Hash: F6710F72200B01EFE731CF25C848F66BBA5EB80724F104A28E7558B7A1EB75F964DB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D1002 Relevance: .2, Instructions: 198COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047D1002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0x4805898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0x48058b0 = _t128;
								 *0x48058b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0x48058b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0x48058bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0x48058bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0x48058b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0x4805898 = 7;
										return _t75;
									} else {
										 *0x4805898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0x4805898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}











































                                                0x047d1002
                                                0x047d100c
                                                0x047d100f
                                                0x047d1012
                                                0x047d1018
                                                0x00000000
                                                0x047d102e
                                                0x047d1030
                                                0x00000000
                                                0x047d1032
                                                0x047d1032
                                                0x047d1038
                                                0x047d1038
                                                0x047d121e
                                                0x047d11ff
                                                0x047d1205
                                                0x047d1207
                                                0x047d120c
                                                0x047d120e
                                                0x047d1210
                                                0x047d1212
                                                0x047d1212
                                                0x047d1210
                                                0x047d121c
                                                0x047d121c
                                                0x047d1228
                                                0x047d1228
                                                0x047d101c
                                                0x047d101c
                                                0x047d101c
                                                0x047d101f
                                                0x047d1022
                                                0x047d1025
                                                0x047d102c
                                                0x047d102c
                                                0x00000000
                                                0x047d102c
                                                0x047d1027
                                                0x047d102a
                                                0x047d103f
                                                0x047d103f
                                                0x047d1042
                                                0x047d1044
                                                0x047d1047
                                                0x047d1049
                                                0x047d104c
                                                0x047d104e
                                                0x047d1088
                                                0x047d1088
                                                0x047d108a
                                                0x047d108d
                                                0x047d108f
                                                0x047d1091
                                                0x047d1091
                                                0x047d1093
                                                0x047d1095
                                                0x047d1097
                                                0x047d10c8
                                                0x047d10cb
                                                0x047d10ce
                                                0x047d10d0
                                                0x047d10f4
                                                0x047d10f4
                                                0x047d10fa
                                                0x047d1100
                                                0x047d1102
                                                0x047d1150
                                                0x047d1150
                                                0x047d1154
                                                0x047d1167
                                                0x047d116a
                                                0x047d116a
                                                0x047d1156
                                                0x047d1156
                                                0x047d1158
                                                0x047d115b
                                                0x047d115d
                                                0x047d115f
                                                0x047d115f
                                                0x047d115f
                                                0x047d1162
                                                0x047d1162
                                                0x047d116c
                                                0x047d116f
                                                0x047d1171
                                                0x047d117b
                                                0x047d117b
                                                0x047d117d
                                                0x047d1183
                                                0x047d1183
                                                0x047d1186
                                                0x047d1188
                                                0x047d1199
                                                0x047d118a
                                                0x047d118a
                                                0x047d118c
                                                0x047d118f
                                                0x047d1191
                                                0x047d1191
                                                0x047d1191
                                                0x047d1194
                                                0x047d1194
                                                0x047d119c
                                                0x047d11a2
                                                0x047d11a8
                                                0x047d11ac
                                                0x047d11af
                                                0x047d11c7
                                                0x047d11b1
                                                0x047d11b1
                                                0x047d11b4
                                                0x047d11b7
                                                0x047d11b9
                                                0x047d11b9
                                                0x047d11b9
                                                0x047d11bc
                                                0x047d11c2
                                                0x047d11c2
                                                0x047d11cb
                                                0x047d11ce
                                                0x047d11d4
                                                0x047d11e7
                                                0x047d11ed
                                                0x047d11ef
                                                0x00000000
                                                0x00000000
                                                0x047d11f1
                                                0x00000000
                                                0x047d11d6
                                                0x047d11d6
                                                0x00000000
                                                0x047d11d6
                                                0x047d11d4
                                                0x047d1104
                                                0x047d1106
                                                0x00000000
                                                0x00000000
                                                0x047d1108
                                                0x047d110c
                                                0x047d111d
                                                0x047d110e
                                                0x047d110e
                                                0x047d1110
                                                0x047d1113
                                                0x047d1115
                                                0x047d1115
                                                0x047d1115
                                                0x047d1118
                                                0x047d1118
                                                0x047d1126
                                                0x047d113a
                                                0x047d113d
                                                0x047d113f
                                                0x00000000
                                                0x047d1141
                                                0x047d1141
                                                0x00000000
                                                0x047d1141
                                                0x047d113f
                                                0x047d10d6
                                                0x047d10d9
                                                0x047d10dd
                                                0x047d10e3
                                                0x047d10e6
                                                0x047d10e9
                                                0x00000000
                                                0x00000000
                                                0x047d10ee
                                                0x047d10f0
                                                0x047d10f2
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d10f2
                                                0x00000000
                                                0x047d1099
                                                0x047d1099
                                                0x047d109c
                                                0x047d109c
                                                0x047d109e
                                                0x047d10a0
                                                0x047d10b3
                                                0x047d10a2
                                                0x047d10a2
                                                0x047d10a4
                                                0x047d10a7
                                                0x047d10a9
                                                0x047d10ab
                                                0x047d10ab
                                                0x047d10ab
                                                0x047d10ae
                                                0x047d10ae
                                                0x047d10b6
                                                0x047d10b9
                                                0x00000000
                                                0x00000000
                                                0x047d10be
                                                0x047d10c1
                                                0x047d10c3
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d10c3
                                                0x047d10c5
                                                0x00000000
                                                0x047d10c5
                                                0x047d1097
                                                0x047d1050
                                                0x047d1053
                                                0x047d1056
                                                0x047d1059
                                                0x047d105c
                                                0x047d105e
                                                0x047d1060
                                                0x047d1062
                                                0x047d1064
                                                0x047d1064
                                                0x047d1062
                                                0x047d1066
                                                0x047d1069
                                                0x047d106b
                                                0x047d106d
                                                0x047d106f
                                                0x047d1076
                                                0x047d1076
                                                0x047d1076
                                                0x00000000
                                                0x047d1076
                                                0x047d1071
                                                0x047d1074
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047d1074
                                                0x047d1079
                                                0x047d1079
                                                0x047d107b
                                                0x047d107b
                                                0x047d107f
                                                0x047d1082
                                                0x047d1085
                                                0x00000000
                                                0x047d1085
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2add2f7e6f03da966827495a3368213bdcfc7e6ef273a671beae5f28ec416711
                                                • Instruction ID: 431784c65b5162097e5b8e68022dbf06bb23f0de2ab1ef9affdbc6226d422b6a
                                                • Opcode Fuzzy Hash: 2add2f7e6f03da966827495a3368213bdcfc7e6ef273a671beae5f28ec416711
                                                • Instruction Fuzzy Hash: 33718D34A20762DBDB24CF56D58067AB3F1FB48301BA44C6ED8828B741E776B990DB60
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047152A5 Relevance: .2, Instructions: 161COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 78%
                                                			E047152A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0472EEF0(0x48079a0);
					_t104 =  *0x4808210; // 0x2ac2d30
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E0472EB70(_t93, 0x48079a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E04759890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0472EEF0(0x48079a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0472EB70(0, 0x48079a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x2ac2d3d
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0474F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0472EEF0(0x48079a0);
									__eflags =  *0x4808210 - _t104; // 0x2ac2d30
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4808210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E04794888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E0472EB70(_t95, 0x48079a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E047595D0();
											L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E047595D0();
											L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0472EB70(_t93, 0x48079a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E047595D0();
										L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E047595D0();
										L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0474F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

























                                                0x047152a5
                                                0x047152ad
                                                0x047152b0
                                                0x047152b3
                                                0x047152b7
                                                0x047152ba
                                                0x047152bf
                                                0x047152c4
                                                0x047152cc
                                                0x00000000
                                                0x00000000
                                                0x047152ce
                                                0x047152d9
                                                0x047152dd
                                                0x047152e7
                                                0x047152f7
                                                0x047152f9
                                                0x047152fd
                                                0x04770dcf
                                                0x04770dd5
                                                0x04770dd6
                                                0x04770dd7
                                                0x04770dd8
                                                0x04770dd9
                                                0x04770dde
                                                0x04770ddf
                                                0x04770de0
                                                0x04770de1
                                                0x04770de2
                                                0x04770de5
                                                0x04770dea
                                                0x04770dec
                                                0x04770f60
                                                0x04770f64
                                                0x04770f70
                                                0x04770f76
                                                0x04770f79
                                                0x04770f79
                                                0x00000000
                                                0x04770f64
                                                0x04770df2
                                                0x04770df7
                                                0x04770e04
                                                0x04770e0d
                                                0x04770e0d
                                                0x04770e10
                                                0x04770e1a
                                                0x04770e1c
                                                0x04770e4c
                                                0x04770e52
                                                0x04770e61
                                                0x04770e67
                                                0x04770e6b
                                                0x04770e70
                                                0x04770e76
                                                0x04770ed7
                                                0x04770edc
                                                0x04770ee0
                                                0x04770ee6
                                                0x04770eea
                                                0x04770eed
                                                0x04770ef0
                                                0x04770ef3
                                                0x04770ef6
                                                0x04770ef9
                                                0x04770efe
                                                0x04770f01
                                                0x04770f01
                                                0x04770f0b
                                                0x04770f12
                                                0x04770f16
                                                0x04770f18
                                                0x04770f1b
                                                0x04770f2c
                                                0x04770f31
                                                0x04770f31
                                                0x04770f35
                                                0x04770f39
                                                0x04770f3a
                                                0x04770f3c
                                                0x04770f3f
                                                0x04770f50
                                                0x04770f55
                                                0x04770f55
                                                0x04770f59
                                                0x047152eb
                                                0x047152f1
                                                0x047152f1
                                                0x04770e7d
                                                0x04770e84
                                                0x04770e88
                                                0x04770e8a
                                                0x04770e8d
                                                0x04770e9e
                                                0x04770ea3
                                                0x04770ea3
                                                0x04770ea7
                                                0x04770eaf
                                                0x04770eb3
                                                0x04770eb9
                                                0x04770eb9
                                                0x04770ebc
                                                0x04770ecd
                                                0x04770ecd
                                                0x00000000
                                                0x04770eb3
                                                0x04770e21
                                                0x04770e2b
                                                0x04770e2f
                                                0x04770e30
                                                0x04770e3a
                                                0x04770e3f
                                                0x04770e41
                                                0x00000000
                                                0x00000000
                                                0x04770e47
                                                0x00000000
                                                0x04770e47
                                                0x04770df9
                                                0x04770dfe
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04770dfe
                                                0x04715303
                                                0x04715307
                                                0x00000000
                                                0x04715309
                                                0x00000000
                                                0x04715309
                                                0x04715307
                                                0x047152e9
                                                0x047152e9
                                                0x00000000
                                                0x047152e9
                                                0x0471530e
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3dc48372123fa4e229e2042f4a2c13855d7c8c46ccfdf4c06e6db63db30635a2
                                                • Instruction ID: a36955d666504eb4185355ca2b903687338fd512f8ec9639bd0aa57b3073508b
                                                • Opcode Fuzzy Hash: 3dc48372123fa4e229e2042f4a2c13855d7c8c46ccfdf4c06e6db63db30635a2
                                                • Instruction Fuzzy Hash: 6451FEB1205341AFE721EF28C944B27BBE4FF80714F10491AE495977A0E7B4F840CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04742AE4 Relevance: .2, Instructions: 159COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04742AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4808204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4808208; // 0x4808207
				_t8 = _t57 + 0x4808208; // 0x4808207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4808450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x480821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4806d5c; // 0x7f080654
							_t72 =  *0x4806d5c; // 0x7f080654
							_t75 =  *0x4806d5c; // 0x7f080654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4806d5c; // 0x7f080654
							_t84 =  *0x4806d5c; // 0x7f080654
							_t87 =  *0x4806d5c; // 0x7f080654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E0475F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}






































                                                0x04742ae4
                                                0x04742aec
                                                0x04742aef
                                                0x04742af4
                                                0x04742af7
                                                0x04742afd
                                                0x04742b92
                                                0x04742b92
                                                0x04742b97
                                                0x04742b9c
                                                0x04742b9c
                                                0x04742b03
                                                0x04742b06
                                                0x04742b09
                                                0x04742b09
                                                0x04742b0f
                                                0x04742b15
                                                0x04742b15
                                                0x04742b1b
                                                0x04742b1e
                                                0x04742b21
                                                0x04742b26
                                                0x04742b29
                                                0x04742b81
                                                0x04742b84
                                                0x04742c0e
                                                0x04742c15
                                                0x04742c24
                                                0x04742c24
                                                0x04742b8a
                                                0x04742b8a
                                                0x04742b8a
                                                0x04742b8a
                                                0x04742b90
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04742b4a
                                                0x04742b4a
                                                0x04742b4d
                                                0x04742b53
                                                0x00000000
                                                0x00000000
                                                0x04742b55
                                                0x04742b58
                                                0x04742bb7
                                                0x04785d1b
                                                0x04785d37
                                                0x04785d47
                                                0x04785d53
                                                0x04742bbd
                                                0x04742bbd
                                                0x04742bbd
                                                0x04742bb7
                                                0x04742b5d
                                                0x04742c2f
                                                0x04785d5b
                                                0x04785d77
                                                0x04785d87
                                                0x04785d93
                                                0x04742c35
                                                0x04742c35
                                                0x04742c35
                                                0x04742c2f
                                                0x04742b65
                                                0x04742b9f
                                                0x04742ba2
                                                0x04742b67
                                                0x04742b67
                                                0x04742b69
                                                0x04742b6b
                                                0x04742b6e
                                                0x04742bc9
                                                0x04742bcc
                                                0x04742bcf
                                                0x04742bd4
                                                0x04742bd6
                                                0x04742bd6
                                                0x04742bdb
                                                0x04742c02
                                                0x04742c05
                                                0x04742c07
                                                0x00000000
                                                0x04742c07
                                                0x04742be0
                                                0x04742c00
                                                0x04742c3f
                                                0x04742c3f
                                                0x00000000
                                                0x04742c00
                                                0x04742be5
                                                0x04742be7
                                                0x04742bec
                                                0x04742bf4
                                                0x04742bf6
                                                0x00000000
                                                0x04742bf6
                                                0x04742b70
                                                0x04742b76
                                                0x04742b2b
                                                0x04742b2b
                                                0x04742b2d
                                                0x04742b2f
                                                0x04742b32
                                                0x04742b35
                                                0x04742b3a
                                                0x00000000
                                                0x04742b40
                                                0x04742b43
                                                0x04742b45
                                                0x04742b47
                                                0x04742b4a
                                                0x04742b4d
                                                0x04742b53
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04742b53
                                                0x04742b78
                                                0x04742b78
                                                0x04742b7b
                                                0x04742b7e
                                                0x00000000
                                                0x04742b7e
                                                0x04742b76
                                                0x04742ba5
                                                0x04742ba5
                                                0x04742ba8
                                                0x04742bad
                                                0x00000000
                                                0x00000000
                                                0x04742baf
                                                0x04742baf
                                                0x04742bc2
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 57f040750ce774a01dee8eaaa876c208367a381f5f0562710c8f2887075f4290
                                                • Instruction ID: c5395cf2e1e7118731e420a11b15eeff454e9b7cbd2c257695c39cb613e360e8
                                                • Opcode Fuzzy Hash: 57f040750ce774a01dee8eaaa876c208367a381f5f0562710c8f2887075f4290
                                                • Instruction Fuzzy Hash: 0D517D76B101158BCB14DF19C8909BDB7B1FBC8740715889AF846AB326F734BEA1DB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DAE44 Relevance: .2, Instructions: 152COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 86%
                                                			E047DAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E047DC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E047DACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E047DFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E047DEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E04737D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E047D1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E047E1536(0x4808ae4, (_t74 -  *0x4808b04 >> 0x14) + (_t74 -  *0x4808b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L047DC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E047DA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E047BCB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E047DACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}



















                                                0x047dae44
                                                0x047dae4c
                                                0x047dae53
                                                0x047dae55
                                                0x047dae5c
                                                0x047dae64
                                                0x047dae68
                                                0x047dae75
                                                0x047dae75
                                                0x047dae78
                                                0x047dae7a
                                                0x047dae7c
                                                0x047dae7f
                                                0x047daea8
                                                0x047daeab
                                                0x047daead
                                                0x00000000
                                                0x00000000
                                                0x047daeb3
                                                0x047daeb8
                                                0x047daebb
                                                0x047daebd
                                                0x00000000
                                                0x047dae81
                                                0x047dae88
                                                0x047dae8f
                                                0x047dae9b
                                                0x047dae96
                                                0x047dae96
                                                0x047dae96
                                                0x047daea0
                                                0x047daea3
                                                0x047daebf
                                                0x047daebf
                                                0x047daec3
                                                0x047daec9
                                                0x047daf0d
                                                0x047daf14
                                                0x047daf3d
                                                0x047daf3d
                                                0x047daf41
                                                0x047daf44
                                                0x047daf67
                                                0x047daf67
                                                0x047daf6a
                                                0x047dafca
                                                0x047dafd1
                                                0x00000000
                                                0x047dafd1
                                                0x047daf6c
                                                0x047daf6d
                                                0x047daf75
                                                0x047daf7c
                                                0x047daf7e
                                                0x047daf80
                                                0x047daf85
                                                0x047daf87
                                                0x047daf99
                                                0x047daf89
                                                0x047daf92
                                                0x047daf92
                                                0x047daf9e
                                                0x047dafa1
                                                0x047dafa3
                                                0x047dafa9
                                                0x047dafb0
                                                0x047dafb2
                                                0x047dafb4
                                                0x047dafbc
                                                0x047dafbc
                                                0x047dafb4
                                                0x047dafb0
                                                0x00000000
                                                0x047dafa1
                                                0x047daf4f
                                                0x047daf57
                                                0x047daf5c
                                                0x047daf5e
                                                0x00000000
                                                0x00000000
                                                0x047daf60
                                                0x047daf64
                                                0x047daf64
                                                0x00000000
                                                0x047daf64
                                                0x047daf1a
                                                0x047daf25
                                                0x00000000
                                                0x00000000
                                                0x047daf27
                                                0x047daf28
                                                0x047daf33
                                                0x00000000
                                                0x047daed0
                                                0x047daed0
                                                0x047daed2
                                                0x047daee1
                                                0x047daee4
                                                0x00000000
                                                0x00000000
                                                0x047daee6
                                                0x047daeec
                                                0x00000000
                                                0x00000000
                                                0x047daefb
                                                0x047daf07
                                                0x047dafd3
                                                0x047dafdb
                                                0x047dafdb
                                                0x00000000
                                                0x047daf07
                                                0x047daed6
                                                0x047daed8
                                                0x047daedf
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047daedf
                                                0x047daec9

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9cc087c17004b1695482532af33572016ed38731d04962a1847c92ca462b8580
                                                • Instruction ID: 6c7358882d433c4c22bee3c1ac5715515be2cae508593c8114ef73072ff10d64
                                                • Opcode Fuzzy Hash: 9cc087c17004b1695482532af33572016ed38731d04962a1847c92ca462b8580
                                                • Instruction Fuzzy Hash: 1C41F5B17202119BDB2ADB25C894B7BB3BAFF84724F084659F85697390DB34F841C691
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473DBE9 Relevance: .1, Instructions: 149COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 86%
                                                			E0473DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0471CC50(E04714510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E04737D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E047E8ED6(_t102, _t98);
						}
						_t76 = _v44;
						E04732280(_t58, _v44);
						E0473DD82(_v44, _t102, _t98);
						E0473B944(_t102, _v5);
						return E0472FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4808628; // 0x0
							_v28 = _t67;
							_t68 =  *0x480862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4808628; // 0x0
						_t105 = _v28;
						_t80 =  *0x480862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x47dfb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}









































                                                0x0473dbe9
                                                0x0473dbf2
                                                0x0473dbf7
                                                0x0473dbf9
                                                0x0473dbfc
                                                0x0473dc00
                                                0x0473dc03
                                                0x0473dc14
                                                0x0473dd54
                                                0x0473dd54
                                                0x0473dd54
                                                0x0473dc18
                                                0x0473dc1d
                                                0x0473dc1d
                                                0x0473dc32
                                                0x0473dc3b
                                                0x0473dc3e
                                                0x0473dc46
                                                0x0473dd5b
                                                0x0473dd62
                                                0x0473dd64
                                                0x0473dd67
                                                0x0473dd69
                                                0x0473dd6b
                                                0x0473dd6e
                                                0x0473dd70
                                                0x0473dd73
                                                0x0473dd73
                                                0x00000000
                                                0x0473dc4c
                                                0x0473dc4e
                                                0x04783ae3
                                                0x04783ae8
                                                0x04783aea
                                                0x0473dce7
                                                0x0473dce9
                                                0x0473dcec
                                                0x0473dcee
                                                0x0473dcf0
                                                0x0473dcf3
                                                0x0473dcf5
                                                0x04783af2
                                                0x04783af5
                                                0x04783af5
                                                0x0473dd06
                                                0x0473dd08
                                                0x0473dd0b
                                                0x0473dd12
                                                0x04783b08
                                                0x0473dd18
                                                0x0473dd18
                                                0x0473dd18
                                                0x0473dd20
                                                0x0473dd23
                                                0x04783b16
                                                0x04783b16
                                                0x0473dd29
                                                0x0473dd2d
                                                0x0473dd36
                                                0x0473dd40
                                                0x0473dd51
                                                0x0473dd51
                                                0x0473dc54
                                                0x0473dc59
                                                0x0473dc59
                                                0x0473dc5e
                                                0x0473dc5e
                                                0x0473dc63
                                                0x0473dc66
                                                0x0473dc6b
                                                0x0473dc78
                                                0x0473dc7b
                                                0x0473dc81
                                                0x0473dc81
                                                0x0473dc83
                                                0x0473dc89
                                                0x00000000
                                                0x00000000
                                                0x0473dd7b
                                                0x0473dd7b
                                                0x0473dc8f
                                                0x0473dc8f
                                                0x0473dc92
                                                0x0473dc99
                                                0x0473dc9f
                                                0x0473dca5
                                                0x0473dcaa
                                                0x0473dcaa
                                                0x0473dcb3
                                                0x0473dcb8
                                                0x0473dcbb
                                                0x0473dcc1
                                                0x0473dccf
                                                0x0473dcd2
                                                0x0473dcd5
                                                0x0473dcd7
                                                0x0473dcda
                                                0x0473dcdc
                                                0x0473dcdc
                                                0x0473dce2
                                                0x0473dce4
                                                0x00000000
                                                0x0473dce4

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 79f7079b827dd5d77f0cd602ae73a30db3301770c6c603117f4893c3b177bbd7
                                                • Instruction ID: a0d9dbdace41c3a1d555d815274c9cd517a6724d88de5d6075a09c667b08b935
                                                • Opcode Fuzzy Hash: 79f7079b827dd5d77f0cd602ae73a30db3301770c6c603117f4893c3b177bbd7
                                                • Instruction Fuzzy Hash: 7951ADB1A00615DFCB24DFA8C480AAEFBF1FB48711F21855AD955A7341EB31BD84CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472EF40 Relevance: .1, Instructions: 147COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 96%
                                                			E0472EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04719080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x775ec21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04712D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}




























                                                0x0472ef4b
                                                0x0472ef4d
                                                0x0472ef57
                                                0x0472f0bd
                                                0x0472f0c2
                                                0x0472f0d2
                                                0x0472f0d2
                                                0x0472f0c2
                                                0x0472ef5d
                                                0x0472ef5f
                                                0x0472ef67
                                                0x0472ef6a
                                                0x0472ef6d
                                                0x0472ef74
                                                0x0472ef7f
                                                0x0472ef82
                                                0x0472ef82
                                                0x0472ef86
                                                0x0472ef88
                                                0x0472ef8c
                                                0x0472ef8f
                                                0x0472ef8f
                                                0x0472ef8f
                                                0x00000000
                                                0x0472ef91
                                                0x0472ef93
                                                0x0472efc4
                                                0x0472efc4
                                                0x0472efc4
                                                0x0472efca
                                                0x0472efd0
                                                0x0472f0a6
                                                0x00000000
                                                0x00000000
                                                0x0472f0af
                                                0x0477bb06
                                                0x0477bb0a
                                                0x0472f0b5
                                                0x0472f0b5
                                                0x0472f0b5
                                                0x0472f0b5
                                                0x00000000
                                                0x0472efd6
                                                0x0472efd9
                                                0x0472f0de
                                                0x0472f0e2
                                                0x0472efdf
                                                0x0472efdf
                                                0x0472efdf
                                                0x0472efe5
                                                0x0477bafc
                                                0x0477bafc
                                                0x0472efe5
                                                0x0472efeb
                                                0x0472efed
                                                0x0472f00f
                                                0x0472f011
                                                0x0472f01a
                                                0x0472f01d
                                                0x0472f021
                                                0x0472f028
                                                0x0472f029
                                                0x0472f029
                                                0x0472f02c
                                                0x00000000
                                                0x0472f02c
                                                0x0472eff3
                                                0x0472eff9
                                                0x0472f0ea
                                                0x0472f0ed
                                                0x0472f0ef
                                                0x00000000
                                                0x0472f0ef
                                                0x0472f003
                                                0x0477bb12
                                                0x0472f045
                                                0x0472f049
                                                0x0472f051
                                                0x0472f09e
                                                0x0472f0a0
                                                0x0472f0a0
                                                0x0472f09e
                                                0x0472f053
                                                0x0472f064
                                                0x0472f064
                                                0x0472f06b
                                                0x0477bb1a
                                                0x0477bb1a
                                                0x0472f071
                                                0x0472f071
                                                0x0472f07d
                                                0x0472f082
                                                0x0472f08f
                                                0x0472f08f
                                                0x0472f009
                                                0x0472f00d
                                                0x00000000
                                                0x0472f00d
                                                0x0472efd0
                                                0x0472ef97
                                                0x0472efa5
                                                0x0472efaa
                                                0x00000000
                                                0x0472efac
                                                0x0472efac
                                                0x0472efac
                                                0x00000000
                                                0x0472efb2
                                                0x0472f036
                                                0x0472f03a
                                                0x0472f040
                                                0x0472f090
                                                0x00000000
                                                0x0472f092
                                                0x0472f042
                                                0x00000000
                                                0x0472f042
                                                0x0472efb7
                                                0x0472efb9
                                                0x0472efbc
                                                0x0472efb0
                                                0x0472efb0
                                                0x00000000
                                                0x0472efbe
                                                0x0472efbe
                                                0x0472efc1
                                                0x00000000
                                                0x0472efc1
                                                0x0472efbc
                                                0x0472efaa
                                                0x0472ef91

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                                • Instruction ID: 7448ea43ac59d60818e30b2b312fa1967e211a5c7d2d5913e1fcb611c9f03353
                                                • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                                • Instruction Fuzzy Hash: 4E510130E04269DFDB20CF69C2907AEBBF1BF05314F1885A8C94597381D375BA89E751
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E740D Relevance: .1, Instructions: 141COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 84%
                                                			E047E740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0476D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0475F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04734620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04734620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0475F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04734620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}





















                                                0x047e740d
                                                0x047e740d
                                                0x047e7412
                                                0x047e7413
                                                0x047e7416
                                                0x047e7418
                                                0x047e741c
                                                0x047e741f
                                                0x047e7422
                                                0x047e7422
                                                0x047e7428
                                                0x047e742a
                                                0x047e742a
                                                0x047e7451
                                                0x047e7432
                                                0x047e744f
                                                0x047e744f
                                                0x00000000
                                                0x047e7434
                                                0x047e7438
                                                0x047e7443
                                                0x047e7517
                                                0x047e7517
                                                0x047e751a
                                                0x047e7535
                                                0x047e7520
                                                0x047e7527
                                                0x047e752c
                                                0x047e7531
                                                0x047e7533
                                                0x00000000
                                                0x047e7533
                                                0x00000000
                                                0x047e7531
                                                0x047e754b
                                                0x047e754f
                                                0x047e755c
                                                0x047e755c
                                                0x047e755f
                                                0x047e7560
                                                0x047e7561
                                                0x047e7562
                                                0x047e7563
                                                0x047e7568
                                                0x047e756a
                                                0x047e756c
                                                0x047e756d
                                                0x047e756d
                                                0x047e756f
                                                0x047e7572
                                                0x047e7574
                                                0x047e7577
                                                0x047e757c
                                                0x047e757f
                                                0x00000000
                                                0x047e7551
                                                0x047e7551
                                                0x047e7551
                                                0x047e7553
                                                0x047e7553
                                                0x047e7449
                                                0x047e7449
                                                0x047e744c
                                                0x047e744c
                                                0x00000000
                                                0x047e744c
                                                0x047e7443
                                                0x047e750e
                                                0x047e7514
                                                0x047e7514
                                                0x047e7455
                                                0x047e7469
                                                0x047e746d
                                                0x00000000
                                                0x047e7473
                                                0x047e7473
                                                0x047e7476
                                                0x047e7480
                                                0x047e7484
                                                0x047e748e
                                                0x047e7493
                                                0x047e7493
                                                0x047e7496
                                                0x047e7499
                                                0x047e74a1
                                                0x047e74b1
                                                0x047e74b5
                                                0x00000000
                                                0x047e74bb
                                                0x047e74c1
                                                0x047e74c1
                                                0x047e74c4
                                                0x047e74c5
                                                0x047e74c6
                                                0x047e74c7
                                                0x047e74c8
                                                0x047e74cd
                                                0x00000000
                                                0x047e74d3
                                                0x047e74d3
                                                0x047e74d6
                                                0x047e74d8
                                                0x047e74db
                                                0x047e74dd
                                                0x047e74e0
                                                0x047e74e7
                                                0x047e74ee
                                                0x047e74ee
                                                0x047e74f4
                                                0x047e74f9
                                                0x00000000
                                                0x047e74fb
                                                0x047e74fb
                                                0x047e74fd
                                                0x047e7500
                                                0x047e7503
                                                0x047e7505
                                                0x047e7505
                                                0x047e74f9
                                                0x00000000
                                                0x047e74cd
                                                0x047e74b5
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                                • Instruction ID: d273f2cc850f4157c40f7acec371b32cba871721154bf7eb1c9271c63d363894
                                                • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                                • Instruction Fuzzy Hash: 9E516C71600606EFDB19CF55C880AA6BBB5FF49309F15C1AAE9089F312E371E946CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04742990 Relevance: .1, Instructions: 133COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 97%
                                                			E04742990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x47eff00);
				E0476D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x46f1664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E0475E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x46f1668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E047951BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x46f166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04742AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04726600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04742C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0472EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04742AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04742C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04742ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E0476D0D1(_t62);
				goto L28;
			}





















                                                0x04742990
                                                0x04742992
                                                0x04742997
                                                0x047429a3
                                                0x047429a6
                                                0x047429ab
                                                0x047429ad
                                                0x047429b2
                                                0x04785c80
                                                0x047429b8
                                                0x047429b8
                                                0x047429bb
                                                0x047429c0
                                                0x047429c5
                                                0x047429c6
                                                0x047429c6
                                                0x047429cb
                                                0x00000000
                                                0x00000000
                                                0x047429cd
                                                0x047429d0
                                                0x047429d9
                                                0x047429db
                                                0x047429dd
                                                0x04742a7f
                                                0x04742a84
                                                0x04742a87
                                                0x04742a89
                                                0x04785ca1
                                                0x04785ca3
                                                0x00000000
                                                0x04742a8f
                                                0x04742a8f
                                                0x00000000
                                                0x04742a8f
                                                0x00000000
                                                0x047429e3
                                                0x047429e3
                                                0x047429e3
                                                0x00000000
                                                0x047429e3
                                                0x047429dd
                                                0x00000000
                                                0x047429db
                                                0x047429e6
                                                0x047429e9
                                                0x047429eb
                                                0x047429ed
                                                0x047429f3
                                                0x047429f5
                                                0x047429f8
                                                0x047429fa
                                                0x04742a97
                                                0x04742a9a
                                                0x04742a9d
                                                0x04742add
                                                0x00000000
                                                0x04742a9f
                                                0x04742aa2
                                                0x04742aa5
                                                0x04742aa8
                                                0x04742aab
                                                0x04785cab
                                                0x04785caf
                                                0x04785cc5
                                                0x04785cda
                                                0x04785cdc
                                                0x04785cdf
                                                0x04785ce5
                                                0x00000000
                                                0x04785ceb
                                                0x04785ced
                                                0x04785cee
                                                0x00000000
                                                0x04785cee
                                                0x04785cb1
                                                0x04785cb4
                                                0x04785cb9
                                                0x04785cbb
                                                0x00000000
                                                0x04785cbd
                                                0x04785cbd
                                                0x00000000
                                                0x04785cbd
                                                0x04785cbb
                                                0x04742ab1
                                                0x04742ab1
                                                0x04742ac4
                                                0x04742ac6
                                                0x04742ac6
                                                0x00000000
                                                0x04742ac6
                                                0x04742aab
                                                0x00000000
                                                0x04742a00
                                                0x04742a09
                                                0x04742a0e
                                                0x04742a21
                                                0x04742a24
                                                0x04742a35
                                                0x04742a3a
                                                0x04742a3d
                                                0x04742a42
                                                0x04742a59
                                                0x04742a59
                                                0x04742a5c
                                                0x04742a5f
                                                0x04742a5f
                                                0x047429fa
                                                0x047429f3
                                                0x04742a64
                                                0x04742a64
                                                0x04742a6b
                                                0x04742a6b
                                                0x04742a6d
                                                0x04742a72
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4f12e0e177fba476d2ef07e239f829fb96c6565690cc0e8479d01f3f765c2078
                                                • Instruction ID: a49898e301588ccc60ee952b9c06f7417a30daebe1a070cb6b19a5ba089dde44
                                                • Opcode Fuzzy Hash: 4f12e0e177fba476d2ef07e239f829fb96c6565690cc0e8479d01f3f765c2078
                                                • Instruction Fuzzy Hash: 99513871A00219EFDF25DF55C844AEEBBB5BB88394F048095FC14AB361D331A962DF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04744D3B Relevance: .1, Instructions: 131COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 78%
                                                			E04744D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x480d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0475FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4807bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0475B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04734620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0471CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0475B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0475F380(_t67 + 0xc, 0x46f5138, 0x10) == 0) {
								 *0x48060d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04744F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04744E70(0x48086b0, 0x4745690, 0, 0) != 0) {
					_t46 = E0471CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}




















                                                0x04744d3b
                                                0x04744d4d
                                                0x04744d53
                                                0x04744d58
                                                0x04744d65
                                                0x04744d6c
                                                0x04744d71
                                                0x04744d77
                                                0x04744d7f
                                                0x04744d8c
                                                0x04744d8e
                                                0x04744dad
                                                0x04744db0
                                                0x04744db7
                                                0x04744db8
                                                0x04744db9
                                                0x04744dba
                                                0x04744dbb
                                                0x04744dc1
                                                0x04744dc8
                                                0x04744dcc
                                                0x04744dd5
                                                0x04744dde
                                                0x04744ddf
                                                0x04744de0
                                                0x04744de1
                                                0x04744de6
                                                0x04744de7
                                                0x04744de9
                                                0x04744df3
                                                0x00000000
                                                0x00000000
                                                0x04786c7c
                                                0x04786c8a
                                                0x04786c8a
                                                0x04786c9d
                                                0x04786ca7
                                                0x04786cac
                                                0x04786cb2
                                                0x04786cb9
                                                0x00000000
                                                0x04786cbf
                                                0x04786cbf
                                                0x00000000
                                                0x04786cbf
                                                0x04786cb9
                                                0x04744dfb
                                                0x04786ccf
                                                0x04786cd3
                                                0x04744e32
                                                0x04744e39
                                                0x04786ce0
                                                0x04786cf2
                                                0x04786cf2
                                                0x04786ce0
                                                0x04744e3f
                                                0x04744e41
                                                0x04744e51
                                                0x04744e51
                                                0x04744e03
                                                0x04744e03
                                                0x04744e09
                                                0x04744e0f
                                                0x04744e57
                                                0x00000000
                                                0x00000000
                                                0x04744e1b
                                                0x04744e30
                                                0x04744e5b
                                                0x04744e5b
                                                0x00000000
                                                0x04744e30
                                                0x04744e11
                                                0x04744e11
                                                0x04744e16
                                                0x00000000
                                                0x04744e16
                                                0x04744e01
                                                0x00000000
                                                0x04744e01
                                                0x04744da5
                                                0x04786c6b
                                                0x00000000
                                                0x04744dab
                                                0x04744dab
                                                0x00000000
                                                0x04744dab

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 253e426d4c7ac0a31f4e94dd7736b34f4a9861971b3fa33a0eb74d8e2aaef2ce
                                                • Instruction ID: 2f44500e97b1405814b0dfc855df739c138badfa1deff8a5780ff3eca338d34c
                                                • Opcode Fuzzy Hash: 253e426d4c7ac0a31f4e94dd7736b34f4a9861971b3fa33a0eb74d8e2aaef2ce
                                                • Instruction Fuzzy Hash: 9641E571A40328AFEB21DF24CD84F7AB7A9EB85714F004099E9459B381D7B4FE44DB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04744BAD Relevance: .1, Instructions: 131COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 85%
                                                			E04744BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x480d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0471CC50(_t86);
					L11:
					return E0475B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4808504
				E04732280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E0475FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E0475B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L04734620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0471CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4808504
								E0472FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E04744F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}


























                                                0x04744bad
                                                0x04744bbf
                                                0x04744bc2
                                                0x04744bc6
                                                0x04744bcd
                                                0x04744bd9
                                                0x047867fe
                                                0x04786800
                                                0x04744ccc
                                                0x04744ccd
                                                0x04744cb7
                                                0x04744cc9
                                                0x04744cc9
                                                0x04744bdf
                                                0x04744be5
                                                0x00000000
                                                0x00000000
                                                0x04744beb
                                                0x04744bef
                                                0x00000000
                                                0x00000000
                                                0x04744bf5
                                                0x04744bf9
                                                0x04744c06
                                                0x04744c0b
                                                0x04744c17
                                                0x04744c1c
                                                0x04744c1f
                                                0x04744c25
                                                0x04744c33
                                                0x04744c3d
                                                0x04744c40
                                                0x04744c43
                                                0x04744c47
                                                0x04744c4d
                                                0x04744c53
                                                0x04744c54
                                                0x04744c55
                                                0x04744c56
                                                0x04744c5b
                                                0x04744c5c
                                                0x04744c63
                                                0x04744c6b
                                                0x00000000
                                                0x00000000
                                                0x04786776
                                                0x04786784
                                                0x04786784
                                                0x0478679f
                                                0x047867a7
                                                0x047867af
                                                0x047867ce
                                                0x00000000
                                                0x047867b1
                                                0x047867b7
                                                0x047867b8
                                                0x047867c1
                                                0x047867d3
                                                0x047867d9
                                                0x047867dd
                                                0x04744c94
                                                0x04744c94
                                                0x04744c98
                                                0x04744c9c
                                                0x04744ca3
                                                0x047867f4
                                                0x047867f4
                                                0x04744cb5
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04744cb5
                                                0x04744c79
                                                0x04744c7e
                                                0x04744c89
                                                0x04744c8b
                                                0x04744c8f
                                                0x04744c8f
                                                0x00000000
                                                0x04744c89
                                                0x047867c3
                                                0x00000000
                                                0x047867c3
                                                0x047867af
                                                0x04744c73
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 596cc94baa6ee3a1ea2df5b2ebb3b7334bb796d2c8855135678db2d3201972f4
                                                • Instruction ID: 737c9837d35ba62e6195c5bec2b915dc82ea33e42b5776918b7ae16329a12c4c
                                                • Opcode Fuzzy Hash: 596cc94baa6ee3a1ea2df5b2ebb3b7334bb796d2c8855135678db2d3201972f4
                                                • Instruction Fuzzy Hash: 7441C535A40228ABDB21EF64C944BEA77B8EF45710F0505A9E908AB351DB74FE84CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E2B28 Relevance: .1, Instructions: 129COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 92%
                                                			E047E2B28(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t30;
				signed int _t35;
				unsigned int _t50;
				signed int _t52;
				signed int _t53;
				unsigned int _t58;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t69;
				intOrPtr _t75;
				signed int _t81;
				signed int _t87;
				void* _t88;
				signed int _t90;
				signed int _t93;

				_t69 = __ecx;
				_t30 = _a4;
				_t90 = __edx;
				_t81 = __ecx;
				_v12 = __ecx;
				_t87 = _t30 - 8;
				if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
					_t87 = _t87 - 8;
				}
				_t67 = 0;
				if(_t90 != 0) {
					L14:
					if((0x0000abed ^  *(_t90 + 0x16)) ==  *((intOrPtr*)(_t90 + 0x14))) {
						_t75 = (( *_t87 ^  *0x4806110 ^ _t87) >> 0x00000001 & 0x00007fff) * 8 - 8;
						 *_a12 = _t75;
						_t35 = _a8 & 0x00000001;
						_v16 = _t35;
						if(_t35 == 0) {
							E04732280(_t35, _t81);
							_t81 = _v12;
						}
						_v5 = 0xff;
						if(( *_t87 ^  *0x4806110 ^ _t87) < 0) {
							_t91 = _v12;
							_t88 = E047E241A(_v12, _t90, _t87, _a8,  &_v5);
							if(_v16 == _t67) {
								E0472FFB0(_t67, _t88, _t91);
							}
							if(_t88 != 0) {
								E047E3209(_t91, _t88, _a8);
							}
							_t67 = 1;
						} else {
							_push(_t75);
							_push(_t67);
							E047DA80D( *((intOrPtr*)(_t81 + 0x20)), 8, _a4, _t87);
							if(_v16 == _t67) {
								E0472FFB0(_t67, _t87, _v12);
							}
						}
					} else {
						_push(_t69);
						_push(_t67);
						E047DA80D( *((intOrPtr*)(_t81 + 0x20)), 0x12, _t90, _t67);
					}
					return _t67;
				}
				_t69 =  *0x4806110; // 0x4eb9a8c4
				_t93 = _t87;
				_t50 = _t69 ^ _t87 ^  *_t87;
				if(_t50 >= 0) {
					_t52 = _t50 >> 0x00000010 & 0x00007fff;
					if(_t52 == 0) {
						L12:
						_t53 = _t67;
						L13:
						_t90 = _t93 - (_t53 << 0x0000000c) & 0xfffff000;
						goto L14;
					}
					_t93 = _t87 - (_t52 << 3);
					_t58 =  *_t93 ^ _t69 ^ _t93;
					if(_t58 < 0) {
						L10:
						_t61 =  *(_t93 + 4) ^ _t69 ^ _t93;
						L11:
						_t53 = _t61 & 0x000000ff;
						goto L13;
					}
					_t63 = _t58 >> 0x00000010 & 0x00007fff;
					if(_t63 == 0) {
						goto L12;
					}
					_t93 = _t93 + _t63 * 0xfffffff8;
					goto L10;
				}
				_t61 =  *(_t87 + 4) ^ _t69 ^ _t87;
				goto L11;
			}
























                                                0x047e2b28
                                                0x047e2b30
                                                0x047e2b35
                                                0x047e2b37
                                                0x047e2b3a
                                                0x047e2b3d
                                                0x047e2b44
                                                0x047e2b4d
                                                0x047e2b4d
                                                0x047e2b50
                                                0x047e2b54
                                                0x047e2bb0
                                                0x047e2bbd
                                                0x047e2be8
                                                0x047e2bef
                                                0x047e2bf4
                                                0x047e2bf7
                                                0x047e2bfa
                                                0x047e2bfd
                                                0x047e2c02
                                                0x047e2c02
                                                0x047e2c0f
                                                0x047e2c13
                                                0x047e2c3b
                                                0x047e2c4a
                                                0x047e2c4f
                                                0x047e2c52
                                                0x047e2c52
                                                0x047e2c59
                                                0x047e2c62
                                                0x047e2c62
                                                0x047e2c69
                                                0x047e2c15
                                                0x047e2c18
                                                0x047e2c19
                                                0x047e2c21
                                                0x047e2c29
                                                0x047e2c2f
                                                0x047e2c2f
                                                0x047e2c29
                                                0x047e2bbf
                                                0x047e2bc2
                                                0x047e2bc3
                                                0x047e2bc9
                                                0x047e2bc9
                                                0x047e2c72
                                                0x047e2c72
                                                0x047e2b56
                                                0x047e2b5c
                                                0x047e2b62
                                                0x047e2b64
                                                0x047e2b72
                                                0x047e2b77
                                                0x047e2ba3
                                                0x047e2ba3
                                                0x047e2ba5
                                                0x047e2baa
                                                0x00000000
                                                0x047e2baa
                                                0x047e2b7e
                                                0x047e2b84
                                                0x047e2b86
                                                0x047e2b97
                                                0x047e2b9c
                                                0x047e2b9e
                                                0x047e2b9e
                                                0x00000000
                                                0x047e2b9e
                                                0x047e2b8b
                                                0x047e2b90
                                                0x00000000
                                                0x00000000
                                                0x047e2b95
                                                0x00000000
                                                0x047e2b95
                                                0x047e2b6b
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bde16ccc259e091f030333693634a8097afaac17545a78cb26437e1aceab16b2
                                                • Instruction ID: 7f3cc273cdd957d84a1016c885afdec8b50d419633585f09285e8295635c215b
                                                • Opcode Fuzzy Hash: bde16ccc259e091f030333693634a8097afaac17545a78cb26437e1aceab16b2
                                                • Instruction Fuzzy Hash: 20411472B101156BD714CF2AC88497AB7ADFF8C724B0487A9E815DB382E674FD46C790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DD466 Relevance: .1, Instructions: 123COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 67%
                                                			E047DD466(signed int __ecx, unsigned int __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v9;
				intOrPtr _v16;
				short _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				signed int _t67;
				signed char _t75;
				short _t84;
				signed int _t87;
				short* _t89;
				unsigned int _t90;
				signed int _t95;
				void* _t98;
				signed int _t99;

				_v8 =  *0x480d360 ^ _t99;
				_t90 = __edx;
				_v36 = __ecx;
				_v20 = 0;
				_v40 = __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x4806114 & 0x0000ffff;
				_v28 = 0;
				_t87 = E047DDDF9(__edx, _a4, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x4806114 & 0x0000ffff,  &_v24,  &_v28, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x4806114 & 0x0000ffff,  &_v9);
				_v32 = _t87;
				if(_t87 != 0xffffffff) {
					_t75 =  *(__edx + 0x1c) & 0x000000ff;
					_v20 = 1;
					_v16 = 1;
					 *0x480b1e0( *__ecx, (_t87 << _t75) + __edx, _v24 << _t75);
					_t53 =  *( *(__ecx + 0xc) ^  *0x4806110 ^ __ecx)();
					_t69 = _t53;
					if(_t53 < 0) {
						_t88 = _v16;
					} else {
						_t69 = 0;
						_t98 = 0;
						_t89 = ( *(__edx + 0x1e) & 0x0000ffff) + __edx + _v32 * 2;
						asm("sbb eax, eax");
						_t67 =  !(_v24 + _v24 + _t89) & _v24 + _v24 >> 0x00000001;
						if(_t67 > 0) {
							_t84 = _v20;
							do {
								if( *_t89 == _t69) {
									 *_t89 = _t84;
								}
								_t89 = _t89 + 2;
								_t98 = _t98 + 1;
							} while (_t98 < _t67);
						}
						goto L2;
						L18:
					}
				} else {
					_t69 = 0;
					L2:
					_t88 = _t69;
				}
				_t95 = _v28;
				if(_t95 != 0) {
					_t95 =  ~(_t95 <<  *(_t90 + 0x1c) >> 0xc);
					asm("lock xadd [eax], esi");
				}
				if(_t88 != 0) {
					_t88 = _a4;
					E047DD864(_t90, _a4, _v40, 2, 0);
				}
				if(_v20 != 0) {
					E0472FFB0(_t69, _t90, _t90 + 0xc);
				}
				return E0475B640(_t69, _t69, _v8 ^ _t99, _t88, _t90, _t95);
				goto L18;
			}

























                                                0x047dd475
                                                0x047dd47b
                                                0x047dd492
                                                0x047dd49e
                                                0x047dd4a4
                                                0x047dd4ac
                                                0x047dd4bc
                                                0x047dd4be
                                                0x047dd4c4
                                                0x047dd4cc
                                                0x047dd4dc
                                                0x047dd4e1
                                                0x047dd4f5
                                                0x047dd4fb
                                                0x047dd4fd
                                                0x047dd501
                                                0x047dd53d
                                                0x047dd503
                                                0x047dd507
                                                0x047dd50e
                                                0x047dd510
                                                0x047dd520
                                                0x047dd524
                                                0x047dd526
                                                0x047dd528
                                                0x047dd52b
                                                0x047dd52e
                                                0x047dd530
                                                0x047dd530
                                                0x047dd533
                                                0x047dd536
                                                0x047dd537
                                                0x047dd53b
                                                0x00000000
                                                0x00000000
                                                0x047dd526
                                                0x047dd4c6
                                                0x047dd4c6
                                                0x047dd4c8
                                                0x047dd4c8
                                                0x047dd4c8
                                                0x047dd540
                                                0x047dd545
                                                0x047dd555
                                                0x047dd55a
                                                0x047dd55a
                                                0x047dd560
                                                0x047dd562
                                                0x047dd56e
                                                0x047dd56e
                                                0x047dd577
                                                0x047dd57d
                                                0x047dd57d
                                                0x047dd594
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0e8c121453f6f5acc627d7df8fb6ebccb715e3e591ac5caa7a8d25d901219c62
                                                • Instruction ID: d0933572538538c8fe09f17faa2bdb14485bd53ec0f7743f70bf16583ba559f4
                                                • Opcode Fuzzy Hash: 0e8c121453f6f5acc627d7df8fb6ebccb715e3e591ac5caa7a8d25d901219c62
                                                • Instruction Fuzzy Hash: 29418271E101299BCB24DFA9C881ABEB7F5FF88314B15422AE816EB340D674AD45CBD0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DAA16 Relevance: .1, Instructions: 120COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047DAA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E047DABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E047DAB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E047DAC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E047BCB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L047377F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E04737D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E047D131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E047BCB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}



















                                                0x047daa1f
                                                0x047daa21
                                                0x047daa23
                                                0x047daa2b
                                                0x047daa30
                                                0x047daa36
                                                0x047daa39
                                                0x047daa42
                                                0x047daa75
                                                0x047daa7a
                                                0x047daa7c
                                                0x047daa7c
                                                0x047daa88
                                                0x047daa8a
                                                0x047daa8f
                                                0x047dab02
                                                0x047dab04
                                                0x047daa99
                                                0x047daaa8
                                                0x047daaaf
                                                0x047daab3
                                                0x047daacc
                                                0x047daad1
                                                0x047daad6
                                                0x047daae0
                                                0x047daaf3
                                                0x047daaf9
                                                0x047daafe
                                                0x047daafe
                                                0x047daaf3
                                                0x047daad6
                                                0x047daab3
                                                0x047dab07
                                                0x047dab0a
                                                0x047dab11
                                                0x047dab23
                                                0x047dab13
                                                0x047dab1c
                                                0x047dab1c
                                                0x047dab2b
                                                0x047dab44
                                                0x047dab44
                                                0x047dab51
                                                0x047dab51
                                                0x047daa44
                                                0x047daa47
                                                0x047daa4c
                                                0x00000000
                                                0x00000000
                                                0x047daa5a
                                                0x047daa64
                                                0x047daa72
                                                0x00000000
                                                0x047daa66
                                                0x047daa66
                                                0x047daa68
                                                0x047daa6a
                                                0x00000000
                                                0x047daa6a

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                                • Instruction ID: 362b157b66d9784c455d94c363507b34120e62df8eeb57732f0c12c7f48954f7
                                                • Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                                • Instruction Fuzzy Hash: DB31D132B102446BEB158B69C845FAFF7BBFF85314F058069E845A7391DA74ED42C690
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04728A0A Relevance: .1, Instructions: 120COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 94%
                                                			E04728A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x480d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0475B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0472E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x46f1180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04741DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04753C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04728999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}



























                                                0x04728a0a
                                                0x04728a1c
                                                0x04728a23
                                                0x04728a2e
                                                0x04728a30
                                                0x04728a36
                                                0x04728a3c
                                                0x04728a3e
                                                0x04728a4a
                                                0x04728a52
                                                0x04728a9c
                                                0x04728aae
                                                0x04728a58
                                                0x04728a5e
                                                0x04728a6a
                                                0x04728a6f
                                                0x04728a75
                                                0x04728a7d
                                                0x04728a85
                                                0x04728a86
                                                0x04728a89
                                                0x04728a93
                                                0x04728a99
                                                0x04728a9b
                                                0x00000000
                                                0x04728aaf
                                                0x04728abe
                                                0x04728ac3
                                                0x04728acb
                                                0x04728ad7
                                                0x04728ae0
                                                0x04728af1
                                                0x00000000
                                                0x04728af1
                                                0x04728acd
                                                0x04728ad5
                                                0x04728afb
                                                0x04728afd
                                                0x04728aff
                                                0x04728b07
                                                0x04728b22
                                                0x04728b24
                                                0x04728b2a
                                                0x04728b2e
                                                0x04728b3f
                                                0x04728b78
                                                0x04728b41
                                                0x04728b52
                                                0x04728b54
                                                0x04728b5c
                                                0x04728b74
                                                0x04728b74
                                                0x04728b5c
                                                0x04728b3f
                                                0x04728b5e
                                                0x04728b61
                                                0x04728b64
                                                0x04728b64
                                                0x04728b6c
                                                0x04728b6c
                                                0x04728b11
                                                0x04779cd5
                                                0x04779cd5
                                                0x04728b17
                                                0x04728b1a
                                                0x04728b1a
                                                0x00000000
                                                0x04728ad5
                                                0x04728a89

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0073112ad339d4f40b93920d22ce073fb46a4e4d0e88270eb1edfeafb5982e16
                                                • Instruction ID: f1fcbe105effe9514fafedfb06286e93355ccf7521cc3ad4981db23443ca8bd9
                                                • Opcode Fuzzy Hash: 0073112ad339d4f40b93920d22ce073fb46a4e4d0e88270eb1edfeafb5982e16
                                                • Instruction Fuzzy Hash: 8C4150B5A002389BDB34EF59CD88AA9B7B4EF44300F1146EAD81997351EB71AE84CF51
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DFDE2 Relevance: .1, Instructions: 116COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 76%
                                                			E047DFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E047DFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E047E0A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E04737D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E047D1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E047E2B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E047DC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E047DDBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E04737D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E047DA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}










                                                0x047dfde7
                                                0x047dfde8
                                                0x047dfdec
                                                0x047dfdee
                                                0x047dfdf5
                                                0x047dfdf7
                                                0x047dfdfc
                                                0x047dfe19
                                                0x047dfe22
                                                0x047dfe26
                                                0x047dfec6
                                                0x047dfecd
                                                0x047dfed5
                                                0x047dfee7
                                                0x047dfed7
                                                0x047dfee0
                                                0x047dfee0
                                                0x047dfeef
                                                0x047dff00
                                                0x047dff02
                                                0x047dff07
                                                0x047dff07
                                                0x00000000
                                                0x047dfeef
                                                0x047dfe33
                                                0x047dfe55
                                                0x047dfe59
                                                0x047dfe5b
                                                0x047dfe5e
                                                0x047dfe69
                                                0x047dfe6d
                                                0x047dfe6d
                                                0x047dfe69
                                                0x047dfe35
                                                0x047dfe41
                                                0x047dfe41
                                                0x047dfe79
                                                0x047dfe8b
                                                0x047dfe7b
                                                0x047dfe84
                                                0x047dfe84
                                                0x047dfe93
                                                0x00000000
                                                0x047dfea8
                                                0x047dfeba
                                                0x00000000
                                                0x047dfeba
                                                0x047dfdfe
                                                0x047dfe01
                                                0x047dfe02
                                                0x047dfe08
                                                0x047dff0c
                                                0x047dff14
                                                0x047dff14

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                                • Instruction ID: 522bfb0c37f473f67a3955ed7d963b01d0bf3202bf7313673aad3be5c0ea59bd
                                                • Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                                • Instruction Fuzzy Hash: 5A310832320644AFD3269B79C848F6A7BFAEBC5750F184159E8479B382DA74FC41C720
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E22AE Relevance: .1, Instructions: 116COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047E22AE(unsigned int* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, char* _a12) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t50;
				signed int _t53;
				signed char _t63;
				signed char _t71;
				signed char _t75;
				signed int _t77;
				unsigned int _t106;
				unsigned int* _t114;
				signed int _t117;

				_v20 = _v20 & 0x00000000;
				_t117 = _a4;
				_t114 = __ecx;
				_v24 = __edx;
				E047E21E8(_t117, __edx,  &_v16,  &_v12);
				if(_v24 != 0 && (_v12 | _v8) != 0) {
					_t71 =  !_v8;
					_v16 =  !_v12 >> 8 >> 8;
					_t72 = _t71 >> 8;
					_t50 = _v16;
					_t20 = (_t50 >> 8) + 0x46fac00; // 0x6070708
					_t75 = ( *((intOrPtr*)((_t71 >> 8 >> 8 >> 8) + 0x46fac00)) +  *((intOrPtr*)((_t71 >> 0x00000008 >> 0x00000008 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x46fac00)) & 0x000000ff) + ( *_t20 +  *((intOrPtr*)((_t50 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x46fac00)) & 0x000000ff);
					_v16 = _t75;
					if(( *(__ecx + 0x38) & 0x00000002) != 0) {
						L6:
						_t53 =  *0x4806110; // 0x4eb9a8c4
						 *_t117 = ( !_t53 ^  *_t117 ^ _t117) & 0x7fffffff ^  !_t53 ^ _t117;
						 *(_t117 + 4) = (_t117 - _v24 >> 0x0000000c ^  *0x4806110 ^ _t117) & 0x000000ff | 0x00000200;
						_t77 = _a8 & 0x00000001;
						if(_t77 == 0) {
							E0472FFB0(_t77, _t114, _t114);
						}
						_t63 = E047E2FBD(_t114, _v24, _v12, _v8, _v16, 0);
						_v36 = 1;
						if(_t77 == 0) {
							E04732280(_t63, _t114);
						}
						 *(_t117 + 4) =  *(_t117 + 4) & 0xfffffdff;
						 *_a12 = 0xff;
					} else {
						_t106 =  *(__ecx + 0x18) >> 7;
						if(_t106 <= 8) {
							_t106 = 8;
						}
						if( *((intOrPtr*)(_t114 + 0x1c)) + _t75 > _t106) {
							goto L6;
						}
					}
				}
				return _v20;
			}




















                                                0x047e22b9
                                                0x047e22c2
                                                0x047e22c6
                                                0x047e22c8
                                                0x047e22d8
                                                0x047e22e2
                                                0x047e2303
                                                0x047e2314
                                                0x047e2321
                                                0x047e234a
                                                0x047e235b
                                                0x047e236c
                                                0x047e2372
                                                0x047e2376
                                                0x047e238f
                                                0x047e238f
                                                0x047e23b4
                                                0x047e23c6
                                                0x047e23c9
                                                0x047e23cc
                                                0x047e23cf
                                                0x047e23cf
                                                0x047e23e9
                                                0x047e23ee
                                                0x047e23f8
                                                0x047e23fb
                                                0x047e23fb
                                                0x047e2403
                                                0x047e240a
                                                0x047e2378
                                                0x047e237b
                                                0x047e2381
                                                0x047e2385
                                                0x047e2385
                                                0x047e238d
                                                0x00000000
                                                0x00000000
                                                0x047e238d
                                                0x047e2376
                                                0x047e2417

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1936e200c0d69077c6c0c8582f1a1f9c8287953d283fac49056a0bde8390bb41
                                                • Instruction ID: 3b87536417558ffed93e3183bd4e7f510ca9d7ba52b401633daa0a90d25251f5
                                                • Opcode Fuzzy Hash: 1936e200c0d69077c6c0c8582f1a1f9c8287953d283fac49056a0bde8390bb41
                                                • Instruction Fuzzy Hash: A14124B11143018BD304CF29C8A497ABBE4EFC9325F05868DF4D58B3D2DA34E809CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E20A8 Relevance: .1, Instructions: 114COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 94%
                                                			E047E20A8(intOrPtr __ecx, intOrPtr __edx, signed int _a4, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _t35;
				signed int _t57;
				unsigned int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				unsigned int _t92;
				unsigned int _t97;
				signed int _t100;
				unsigned int _t102;

				_t79 = __edx;
				_t35 =  *0x4806110; // 0x4eb9a8c4
				_t57 = _a4;
				_v8 = __ecx;
				_t84 =  *_t57;
				_v12 = __edx;
				_t61 = _t84 ^ _t35 ^ _t57;
				_t83 = _t61 >> 0x00000001 & 0x00007fff;
				_v20 = _t83;
				 *_t57 = (_t84 ^ _t35 ^ _t57) & 0x7fffffff ^ _t35 ^ _t57;
				_t63 = _t61 >> 0x00000010 & 0x00007fff;
				if(_t63 != 0) {
					_t100 =  *0x4806110; // 0x4eb9a8c4
					_t77 = _t57 - (_t63 << 3);
					_v16 = _t77;
					_t102 = _t100 ^ _t77 ^  *_t77;
					_t106 = _t102;
					if(_t102 >= 0) {
						E047E2E3F(_v8, __edx, _t106, _t77);
						_t57 = _v16;
						_t79 = _v12;
						_t83 = _t83 + (_t102 >> 0x00000001 & 0x00007fff);
					}
				}
				_t64 = _t57 + _t83 * 8;
				if(_t64 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
					asm("lfence");
					_t97 =  *_t64 ^  *0x4806110 ^ _t64;
					_t109 = _t97;
					if(_t97 >= 0) {
						E047E2E3F(_v8, _t79, _t109, _t64);
						_t79 = _v12;
						_t83 = _t83 + (_t97 >> 0x00000001 & 0x00007fff);
					}
				}
				if(( *(_v8 + 0x38) & 0x00000001) != 0) {
					_t73 = _t57 + _t83 * 8;
					if(_t73 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
						asm("lfence");
						_t92 =  *_t73 ^  *0x4806110 ^ _t73;
						_t113 = _t92;
						if(_t92 >= 0) {
							E047E2E3F(_v8, _t79, _t113, _t73);
							_t83 = _t83 + (_t92 >> 0x00000001 & 0x00007fff);
						}
					}
				}
				if(_v20 != _t83) {
					_t66 = _v12;
					_t80 = _t57 + _t83 * 8;
					 *_t57 =  *_t57 ^ (_t83 + _t83 ^  *_t57 ^  *0x4806110 ^ _t57) & 0x0000fffe;
					if(_t80 < _v12 + (( *(_t66 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t80 =  *_t80 ^ (_t83 << 0x00000010 ^  *_t80 ^  *0x4806110 ^ _t80) & 0x7fff0000;
					}
				}
				 *_a8 = _t83;
				return _t57;
			}





















                                                0x047e20a8
                                                0x047e20b0
                                                0x047e20b6
                                                0x047e20ba
                                                0x047e20be
                                                0x047e20c4
                                                0x047e20cb
                                                0x047e20db
                                                0x047e20e4
                                                0x047e20e7
                                                0x047e20e9
                                                0x047e20ef
                                                0x047e20f1
                                                0x047e20fe
                                                0x047e2102
                                                0x047e2105
                                                0x047e2105
                                                0x047e2107
                                                0x047e210d
                                                0x047e2112
                                                0x047e2115
                                                0x047e2120
                                                0x047e2120
                                                0x047e2107
                                                0x047e2126
                                                0x047e2131
                                                0x047e2133
                                                0x047e213e
                                                0x047e213e
                                                0x047e2140
                                                0x047e2146
                                                0x047e214b
                                                0x047e2156
                                                0x047e2156
                                                0x047e2140
                                                0x047e215f
                                                0x047e2165
                                                0x047e2170
                                                0x047e2172
                                                0x047e217d
                                                0x047e217d
                                                0x047e217f
                                                0x047e2185
                                                0x047e2192
                                                0x047e2192
                                                0x047e217f
                                                0x047e2170
                                                0x047e2197
                                                0x047e2199
                                                0x047e21a1
                                                0x047e21b1
                                                0x047e21bf
                                                0x047e21d6
                                                0x047e21d6
                                                0x047e21bf
                                                0x047e21dd
                                                0x047e21e5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 18aa46278f2197550c14970461ae4a1342052cebc41de2f213c7c0a26f8f25b0
                                                • Instruction ID: fd147839d8cce4ff53c380ff52ed46faed72374c5ff3369a3dacf84de7a3e59e
                                                • Opcode Fuzzy Hash: 18aa46278f2197550c14970461ae4a1342052cebc41de2f213c7c0a26f8f25b0
                                                • Instruction Fuzzy Hash: F241B233E1002A8BCB18CF69C495579B3B6FB8C30575606BDD805AB382EB34BE51C790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E2D07 Relevance: .1, Instructions: 112COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047E2D07(void* __ecx, void* __edx, void* __eflags, signed short _a4) {
				char _v5;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				signed int _t34;
				signed char _t40;
				signed int* _t49;
				signed int _t55;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				signed short _t60;
				unsigned int _t66;
				unsigned int _t71;
				signed int _t77;
				signed char _t83;
				signed char _t84;
				signed int _t91;
				signed int _t93;
				signed int _t96;

				_t34 = E047E21E8(_a4, __edx,  &_v24,  &_v20);
				_t83 =  !_v20;
				_t57 =  !_v16;
				_t84 = _t83 >> 8;
				_v12 = _t84 >> 8;
				_v5 =  *((intOrPtr*)((_t83 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t84 & 0x000000ff) + 0x46fac00));
				_t58 = _t57 >> 8;
				_t59 = _t58 >> 8;
				_t66 = _t59 >> 8;
				_t60 = _a4;
				_t13 = _t66 + 0x46fac00; // 0x6070708
				_t40 = _v12;
				_t71 = _t40 >> 8;
				_v12 = 0;
				_t17 = _t71 + 0x46fac00; // 0x6070708
				 *((intOrPtr*)(__ecx + 0x1c)) =  *((intOrPtr*)(__ecx + 0x1c)) + ( *_t13 +  *((intOrPtr*)((_t59 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t57 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t58 & 0x000000ff) + 0x46fac00)) & 0x000000ff) + ( *_t17 +  *((intOrPtr*)((_t40 & 0x000000ff) + 0x46fac00)) + _v5 & 0x000000ff);
				 *_t60 =  *_t60 ^ ( *_t60 ^  *0x4806110 ^ _t34 ^ _t60) & 0x00000001;
				_t49 = __ecx + 8;
				_t77 =  *_t60 & 0x0000ffff ^ _t60 & 0x0000ffff ^  *0x4806110 & 0x0000ffff;
				_t91 =  *_t49;
				_t96 = _t49[1] & 1;
				_v24 = _t49;
				if(_t91 != 0) {
					_t93 = _t77;
					L2:
					while(1) {
						if(_t93 < (_t91 - 0x00000004 & 0x0000ffff ^  *(_t91 - 4) & 0x0000ffff ^  *0x4806110 & 0x0000ffff)) {
							_t55 =  *_t91;
							if(_t96 == 0) {
								L11:
								if(_t55 == 0) {
									goto L13;
								} else {
									goto L12;
								}
							} else {
								if(_t55 == 0) {
									L13:
									_v12 = 0;
								} else {
									_t55 = _t55 ^ _t91;
									goto L11;
								}
							}
						} else {
							_t55 =  *(_t91 + 4);
							if(_t96 == 0) {
								L6:
								if(_t55 != 0) {
									L12:
									_t91 = _t55;
									continue;
								} else {
									goto L7;
								}
							} else {
								if(_t55 == 0) {
									L7:
									_v12 = 1;
								} else {
									_t55 = _t55 ^ _t91;
									goto L6;
								}
							}
						}
						goto L14;
					}
				}
				L14:
				_t29 = _t60 + 4; // 0x4
				return E0472B090(_v24, _t91, _v12, _t29);
			}
























                                                0x047e2d1f
                                                0x047e2d2c
                                                0x047e2d31
                                                0x047e2d33
                                                0x047e2d42
                                                0x047e2d4b
                                                0x047e2d51
                                                0x047e2d5d
                                                0x047e2d62
                                                0x047e2d6e
                                                0x047e2d71
                                                0x047e2d7d
                                                0x047e2d87
                                                0x047e2d8d
                                                0x047e2d91
                                                0x047e2da5
                                                0x047e2db7
                                                0x047e2dc8
                                                0x047e2dcf
                                                0x047e2dd1
                                                0x047e2dd3
                                                0x047e2dd6
                                                0x047e2ddb
                                                0x047e2ddd
                                                0x00000000
                                                0x047e2ddf
                                                0x047e2df5
                                                0x047e2e0e
                                                0x047e2e12
                                                0x047e2e1a
                                                0x047e2e1c
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e2e14
                                                0x047e2e16
                                                0x047e2e22
                                                0x047e2e22
                                                0x047e2e18
                                                0x047e2e18
                                                0x00000000
                                                0x047e2e18
                                                0x047e2e16
                                                0x047e2df7
                                                0x047e2df7
                                                0x047e2dfc
                                                0x047e2e04
                                                0x047e2e06
                                                0x047e2e1e
                                                0x047e2e1e
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x047e2dfe
                                                0x047e2e00
                                                0x047e2e08
                                                0x047e2e08
                                                0x047e2e02
                                                0x047e2e02
                                                0x00000000
                                                0x047e2e02
                                                0x047e2e00
                                                0x047e2dfc
                                                0x00000000
                                                0x047e2df5
                                                0x047e2ddf
                                                0x047e2e26
                                                0x047e2e26
                                                0x047e2e3c

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 651e14ef1b46ec40ebf563361aa05de3a29923c02f55f4a5d99ead4c3b4a10d1
                                                • Instruction ID: dfc7b9d0723d872317cdf9a5d917d391f9cf1aadbea9a6f40ff13d943d40e5e2
                                                • Opcode Fuzzy Hash: 651e14ef1b46ec40ebf563361aa05de3a29923c02f55f4a5d99ead4c3b4a10d1
                                                • Instruction Fuzzy Hash: C04129B16001655FC701CB76C4946BABFF5EF89201B0AC2EAD8C5DB346FA38D956C3A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047DEA55 Relevance: .1, Instructions: 111COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 70%
                                                			E047DEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E04732280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E047DE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0471F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0472FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E047DAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E047DBCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E04737D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E047CFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0472FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E047DA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}






















                                                0x047dea55
                                                0x047dea66
                                                0x047dea68
                                                0x047dea6c
                                                0x047dea6f
                                                0x047dea72
                                                0x047dea75
                                                0x047dea7a
                                                0x047dea7a
                                                0x047dea7e
                                                0x047dea80
                                                0x047dea85
                                                0x047dea8b
                                                0x047deab5
                                                0x047deabc
                                                0x047deabf
                                                0x047deabf
                                                0x047deaca
                                                0x047deace
                                                0x047dead0
                                                0x047deae4
                                                0x047deaeb
                                                0x047deaf0
                                                0x047deaf5
                                                0x047deb09
                                                0x047deb0d
                                                0x047deb1d
                                                0x047deb2d
                                                0x047deb38
                                                0x047deb3d
                                                0x047deb41
                                                0x047deb4a
                                                0x047deb60
                                                0x047deb4c
                                                0x047deb52
                                                0x047deb59
                                                0x047deb59
                                                0x047deb68
                                                0x047deb71
                                                0x047deb71
                                                0x047dea8d
                                                0x047dea8f
                                                0x047dea92
                                                0x047dea97
                                                0x047dea97
                                                0x047dea9b
                                                0x047dea9c
                                                0x047dea9e
                                                0x047deaa6
                                                0x047deaa6
                                                0x047deb7e

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                                • Instruction ID: d945eb7f03037eec1a2d883169edbc4acd0c40b93f4d061fcd2e3540ad35725f
                                                • Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                                • Instruction Fuzzy Hash: B9319272614B059BD72ADF24C884A6BB7B9FFC4614F04492DE5968B741DB30F805C7A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047969A6 Relevance: .1, Instructions: 108COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 69%
                                                			E047969A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x480d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04726C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E04796BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04759980() >= 0) {
							E04732280(_t56, 0x4808778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4808774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4808774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0471B6F0(0x46fc338, 0x46fc288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04759520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E047595D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0472FFB0(_t68, _t77, 0x4808778);
				}
				_pop(_t78);
				return E0475B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}
































                                                0x047969b5
                                                0x047969be
                                                0x047969c3
                                                0x047969c9
                                                0x047969cc
                                                0x047969d1
                                                0x047969d3
                                                0x047969de
                                                0x047969e1
                                                0x047969ea
                                                0x047969f6
                                                0x047969fe
                                                0x04796a13
                                                0x04796a14
                                                0x04796a15
                                                0x04796a16
                                                0x04796a1e
                                                0x04796a26
                                                0x04796a31
                                                0x04796a36
                                                0x04796a37
                                                0x04796a40
                                                0x04796a49
                                                0x04796a4a
                                                0x04796a53
                                                0x04796a59
                                                0x04796a5d
                                                0x04796a5e
                                                0x04796a64
                                                0x04796a67
                                                0x04796a6a
                                                0x04796a6d
                                                0x04796a70
                                                0x04796a77
                                                0x04796a7d
                                                0x04796a86
                                                0x04796a89
                                                0x04796a9c
                                                0x04796a9f
                                                0x04796aa2
                                                0x04796aa5
                                                0x04796aaf
                                                0x04796ab1
                                                0x04796ab8
                                                0x04796ab9
                                                0x04796abb
                                                0x04796abe
                                                0x04796ac5
                                                0x04796ac5
                                                0x04796aaf
                                                0x04796a40
                                                0x04796a26
                                                0x047969fe
                                                0x04796ace
                                                0x04796ad0
                                                0x04796ad3
                                                0x04796ad8
                                                0x04796adf
                                                0x04796adf
                                                0x04796ae8
                                                0x04796aef
                                                0x04796aef
                                                0x04796af9
                                                0x04796b06

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b8a086d58d0b0325286e17953d1a4404f57461bd75b3dac21c9a7c7ce3d95823
                                                • Instruction ID: f786d8f7e609a43a4e2888093a1ae9de092dc69a56f3ec1d484d0e652e5bb228
                                                • Opcode Fuzzy Hash: b8a086d58d0b0325286e17953d1a4404f57461bd75b3dac21c9a7c7ce3d95823
                                                • Instruction Fuzzy Hash: 5E419AB1D00208AFDB24DFA5D944BFEBBF4EF48704F04862AE914A7350EB74A945CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04715210 Relevance: .1, Instructions: 107COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 85%
                                                			E04715210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E047152A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E047595D0();
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0472EB70(_t54, 0x48079a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E047595D0();
								L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0472EB70(_t54, 0x48079a0);
						}
						return _t52;
					}
					L5:
					_t33 = E0475F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0472EB70(_t54, 0x48079a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E047595D0();
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}














                                                0x04715220
                                                0x04715224
                                                0x04770d13
                                                0x04770d16
                                                0x04770d19
                                                0x0471522a
                                                0x0471522a
                                                0x0471522d
                                                0x0471522d
                                                0x04715231
                                                0x04715235
                                                0x04715239
                                                0x04770d5c
                                                0x04770d62
                                                0x00000000
                                                0x00000000
                                                0x04770d6a
                                                0x04770d7b
                                                0x04770d7f
                                                0x04770d81
                                                0x04770d84
                                                0x04770d95
                                                0x04770d95
                                                0x04770d6c
                                                0x04770d71
                                                0x04770d71
                                                0x04770d9a
                                                0x00000000
                                                0x0471524a
                                                0x0471524a
                                                0x04715250
                                                0x04770d24
                                                0x04770d35
                                                0x04770d39
                                                0x04770d3b
                                                0x04770d3e
                                                0x04770d50
                                                0x04770d50
                                                0x04770d26
                                                0x04770d2b
                                                0x04770d2b
                                                0x00000000
                                                0x04770d55
                                                0x04715256
                                                0x0471525b
                                                0x04715265
                                                0x04770da7
                                                0x0471526b
                                                0x0471526e
                                                0x04715272
                                                0x04770db1
                                                0x04770db4
                                                0x04770dc5
                                                0x04770dc5
                                                0x04715272
                                                0x04715278
                                                0x0471527e
                                                0x0471528a
                                                0x0471528c
                                                0x0471528d
                                                0x00000000
                                                0x04715280
                                                0x04715282
                                                0x04715288
                                                0x0471529f
                                                0x04715292
                                                0x00000000
                                                0x04715292
                                                0x00000000
                                                0x04715288
                                                0x0471527e

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 962ccbe472f7bdd5443e6cf9ccc5e403fbddf9f0ced43584357a479b9d5b778d
                                                • Instruction ID: 5c8d3d1698a94972c95229cb2126bcae398dc2173f8d92cfbee49c77d6be6adb
                                                • Opcode Fuzzy Hash: 962ccbe472f7bdd5443e6cf9ccc5e403fbddf9f0ced43584357a479b9d5b778d
                                                • Instruction Fuzzy Hash: 59312472251750EBDB2A9F28CD84F6677A5FF50724F508A29E8154B7A0EB70F900CA90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04753D43 Relevance: .1, Instructions: 106COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04753D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04727B60(0, _t61, 0x46f11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04727B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04734620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}
















                                                0x04753d4c
                                                0x04753d50
                                                0x04753d55
                                                0x04753d5e
                                                0x0478e79a
                                                0x00000000
                                                0x0478e79a
                                                0x04753d68
                                                0x0478e789
                                                0x04753d9d
                                                0x04753da3
                                                0x04753daf
                                                0x04753db5
                                                0x04753dbc
                                                0x04753dc4
                                                0x04753dc9
                                                0x04753dce
                                                0x0478e7ae
                                                0x0478e7ae
                                                0x04753dde
                                                0x04753de2
                                                0x04753de7
                                                0x04753e0d
                                                0x04753e13
                                                0x04753e16
                                                0x04753e1e
                                                0x04753e25
                                                0x04753e28
                                                0x00000000
                                                0x00000000
                                                0x04753e2a
                                                0x04753e2f
                                                0x04753e37
                                                0x04753e37
                                                0x00000000
                                                0x04753e37
                                                0x04753e31
                                                0x00000000
                                                0x04753e31
                                                0x04753e20
                                                0x04753e20
                                                0x04753e35
                                                0x00000000
                                                0x04753de9
                                                0x04753de9
                                                0x04753de9
                                                0x04753dee
                                                0x04753dfd
                                                0x04753dff
                                                0x04753e02
                                                0x04753e05
                                                0x04753e05
                                                0x00000000
                                                0x04753df0
                                                0x04753de7
                                                0x0478e78f
                                                0x0478e794
                                                0x04753d79
                                                0x04753d84
                                                0x04753d89
                                                0x04753d8e
                                                0x00000000
                                                0x0478e7a4
                                                0x04753d96
                                                0x04753d9a
                                                0x00000000
                                                0x04753d9a
                                                0x00000000
                                                0x0478e794
                                                0x04753d6e
                                                0x04753d73
                                                0x00000000
                                                0x0478e7b5
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7b3192a4445c0e5c6042572db6c26f8b337f9b4320d13b9ff2b63bbaa043545d
                                                • Instruction ID: 63ef203403dc128a2099e5310692ae4047141e5e1f5e116ac512fe951ee54905
                                                • Opcode Fuzzy Hash: 7b3192a4445c0e5c6042572db6c26f8b337f9b4320d13b9ff2b63bbaa043545d
                                                • Instruction Fuzzy Hash: CC317C31605615DBD7289F2AC841A6ABBF5EF55780B05806EEC45CF370E7B4E841D790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474A61C Relevance: .1, Instructions: 106COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 78%
                                                			E0474A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x47f0220);
				E0476D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4807b9c; // 0x0
				_t55 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0476D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4807b10 =  *0x4807b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x480536c; // 0x2acc3b0
					if( *_t51 != 0x4805368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4805368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x480536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0474A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}


















                                                0x0474a61c
                                                0x0474a61e
                                                0x0474a623
                                                0x0474a628
                                                0x0474a62b
                                                0x0474a62d
                                                0x0474a648
                                                0x0474a64a
                                                0x0474a64f
                                                0x04789b44
                                                0x0474a6ec
                                                0x0474a6f1
                                                0x0474a6f1
                                                0x0474a655
                                                0x0474a657
                                                0x0474a65a
                                                0x0474a65d
                                                0x0474a662
                                                0x0474a663
                                                0x0474a667
                                                0x0474a668
                                                0x0474a66d
                                                0x0474a706
                                                0x0474a706
                                                0x04789bda
                                                0x04789be6
                                                0x04789beb
                                                0x00000000
                                                0x04789beb
                                                0x0474a679
                                                0x04789b7a
                                                0x00000000
                                                0x04789b7a
                                                0x0474a683
                                                0x0474a6f4
                                                0x0474a6f7
                                                0x0474a6f9
                                                0x0474a6fd
                                                0x0474a6a0
                                                0x0474a6a0
                                                0x0474a6ad
                                                0x0474a6af
                                                0x0474a6b4
                                                0x04789ba7
                                                0x04789bac
                                                0x00000000
                                                0x00000000
                                                0x04789bc6
                                                0x04789bce
                                                0x04789bd1
                                                0x04789bd3
                                                0x04789bd3
                                                0x00000000
                                                0x04789bd1
                                                0x0474a6bd
                                                0x0474a6c3
                                                0x0474a6c6
                                                0x0474a6d2
                                                0x0474a701
                                                0x0474a704
                                                0x00000000
                                                0x0474a704
                                                0x0474a6d4
                                                0x0474a6d6
                                                0x0474a6d9
                                                0x0474a6db
                                                0x0474a6e1
                                                0x0474a6e6
                                                0x0474a6e8
                                                0x0474a6e8
                                                0x0474a6ea
                                                0x00000000
                                                0x0474a6ea
                                                0x0474a688
                                                0x0474a692
                                                0x0474a694
                                                0x0474a699
                                                0x00000000
                                                0x00000000
                                                0x0474a69d
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 31ebf74b09a2c94dd77b522ae53f6605a9108e542763b0a5fa591d3d522a93a5
                                                • Instruction ID: 90a254b9a4496ed506f11a32c4dd66df9152d7520fabb62cd10328ac33076881
                                                • Opcode Fuzzy Hash: 31ebf74b09a2c94dd77b522ae53f6605a9108e542763b0a5fa591d3d522a93a5
                                                • Instruction Fuzzy Hash: F94177B5A50209DFDB15CF68C890BA9BBF2FB89304F1580A9E904AB340D778BD41CF90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04797016 Relevance: .1, Instructions: 104COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 76%
                                                			E04797016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x480d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E04796B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E04796B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04737D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04759AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0475B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04734620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}






















                                                0x04797016
                                                0x0479701e
                                                0x0479702b
                                                0x04797033
                                                0x04797037
                                                0x0479703c
                                                0x0479703e
                                                0x04797041
                                                0x04797045
                                                0x0479704a
                                                0x04797050
                                                0x04797055
                                                0x0479705a
                                                0x04797062
                                                0x04797062
                                                0x0479705a
                                                0x04797064
                                                0x04797064
                                                0x04797067
                                                0x04797071
                                                0x04797096
                                                0x0479709b
                                                0x047970a2
                                                0x047970a6
                                                0x047970a7
                                                0x047970ad
                                                0x047970b3
                                                0x047970b6
                                                0x047970bb
                                                0x047970c3
                                                0x047970c3
                                                0x047970c6
                                                0x047970cd
                                                0x047970dd
                                                0x047970e0
                                                0x047970e2
                                                0x047970e2
                                                0x047970ee
                                                0x04797101
                                                0x047970f0
                                                0x047970f9
                                                0x047970f9
                                                0x0479710a
                                                0x0479710e
                                                0x04797112
                                                0x04797117
                                                0x04797118
                                                0x04797118
                                                0x047970bb
                                                0x0479711d
                                                0x04797123
                                                0x04797131
                                                0x04797131
                                                0x04797136
                                                0x0479713d
                                                0x0479713e
                                                0x0479713f
                                                0x0479714a
                                                0x0479714a
                                                0x04797084
                                                0x04797088
                                                0x00000000
                                                0x0479708e
                                                0x0479708e
                                                0x04797092
                                                0x00000000
                                                0x04797092

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bd4c7f575cd7286a13d2683d9f8ce6255344077f994ecaa72de7f70d97c246f1
                                                • Instruction ID: 4ee290984ac676ee8f8e5e4749d062ab019a20a1e6515e94d2eb5b19d40ee958
                                                • Opcode Fuzzy Hash: bd4c7f575cd7286a13d2683d9f8ce6255344077f994ecaa72de7f70d97c246f1
                                                • Instruction Fuzzy Hash: 50319272614751DBC728DF68D944A6AB7E9BFC8700F044A29F89587790E730FD04C7A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473C182 Relevance: .1, Instructions: 104COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 68%
                                                			E0473C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04737D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E047E8D34(_v8, _t80);
					}
					E04732280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0472FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E047E8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0472FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0475B180();
						if(_a4 != 0) {
							E04732280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0473BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0473BB2D(_t16, _t15);
						E0473B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0472FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0472FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0472FFB0(0, __ecx, _t24);
				}
				return 0;
			}
















                                                0x0473c18d
                                                0x0473c18f
                                                0x0473c191
                                                0x0473c19b
                                                0x0473c1a0
                                                0x0473c1d4
                                                0x0473c1de
                                                0x04782d6e
                                                0x0473c1e4
                                                0x0473c1e4
                                                0x0473c1e4
                                                0x0473c1ec
                                                0x04782d7d
                                                0x04782d7d
                                                0x0473c1f3
                                                0x0473c1ff
                                                0x04782d88
                                                0x04782d8d
                                                0x04782d94
                                                0x04782d94
                                                0x04782d9f
                                                0x04782da4
                                                0x04782dab
                                                0x04782db0
                                                0x04782db2
                                                0x04782db3
                                                0x04782db4
                                                0x04782dbc
                                                0x04782dc3
                                                0x04782dc3
                                                0x0473c205
                                                0x0473c205
                                                0x0473c208
                                                0x0473c20e
                                                0x0473c211
                                                0x0473c216
                                                0x0473c219
                                                0x0473c21f
                                                0x0473c222
                                                0x0473c22c
                                                0x0473c234
                                                0x0473c23a
                                                0x0473c23f
                                                0x0473c245
                                                0x0473c24b
                                                0x0473c251
                                                0x0473c25a
                                                0x0473c276
                                                0x0473c27d
                                                0x0473c27d
                                                0x0473c25c
                                                0x0473c25c
                                                0x00000000
                                                0x0473c25e
                                                0x0473c1a4
                                                0x0473c1aa
                                                0x0473c1b3
                                                0x0473c265
                                                0x0473c26c
                                                0x0473c26c
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                                • Instruction ID: 56b90c614fb5fe81383512f8826aaf864286f582573b650b001621edbf3dd735
                                                • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                                • Instruction Fuzzy Hash: 82315AB270158ABEE705FBB5C984BE9F764BF46208F04815AD51C9B303DB347A09E7A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04756DE6 Relevance: .1, Instructions: 101COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 86%
                                                			E04756DE6(signed int __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t39;
				intOrPtr _t52;
				intOrPtr _t53;
				signed int _t59;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr* _t66;
				void* _t68;
				intOrPtr _t69;
				signed int _t73;
				signed int _t75;
				intOrPtr _t77;
				signed int _t80;
				intOrPtr _t82;

				_t68 = __edx;
				_push(__ecx);
				_t80 = __ecx;
				_t75 = _a4;
				if(__edx >  *((intOrPtr*)(__ecx + 0x90))) {
					L23:
					asm("lock inc dword [esi+0x110]");
					if(( *(_t80 + 0xd4) & 0x00010000) != 0) {
						asm("lock inc dword [ecx+eax+0x4]");
					}
					_t39 = 0;
					L13:
					return _t39;
				}
				_t63 =  *(__ecx + 0x88);
				_t4 = _t68 + 7; // 0xa
				_t69 =  *((intOrPtr*)(__ecx + 0x8c));
				_t59 = _t4 & 0xfffffff8;
				_v8 = _t69;
				if(_t75 >= _t63) {
					_t75 = _t75 % _t63;
					L15:
					_t69 = _v8;
				}
				_t64 =  *((intOrPtr*)(_t80 + 0x17c + _t75 * 4));
				if(_t64 == 0) {
					L14:
					if(E04756EBE(_t80, _t64, _t75) != 1) {
						goto L23;
					}
					goto L15;
				}
				asm("lock inc dword [ecx+0xc]");
				if( *((intOrPtr*)(_t64 + 0x2c)) != 1 ||  *((intOrPtr*)(_t64 + 8)) > _t69) {
					goto L14;
				} else {
					_t73 = _t59;
					asm("lock xadd [eax], edx");
					if(_t73 + _t59 > _v8) {
						if(_t73 <= _v8) {
							 *(_t64 + 4) = _t73;
						}
						goto L14;
					}
					_t77 = _t73 + _t64;
					_v8 = _t77;
					 *_a12 = _t64;
					_t66 = _a8;
					if(_t66 == 0) {
						L12:
						_t39 = _t77;
						goto L13;
					}
					_t52 =  *((intOrPtr*)(_t80 + 0x10));
					if(_t52 != 0) {
						_t53 = _t52 - 1;
						if(_t53 == 0) {
							asm("rdtsc");
							 *_t66 = _t53;
							L11:
							 *(_t66 + 4) = _t73;
							goto L12;
						}
						E04746A60(_t66);
						goto L12;
					}
					while(1) {
						_t73 =  *0x7ffe0018;
						_t82 =  *0x7FFE0014;
						if(_t73 ==  *0x7FFE001C) {
							break;
						}
						asm("pause");
					}
					_t66 = _a8;
					_t77 = _v8;
					 *_t66 = _t82;
					goto L11;
				}
			}


















                                                0x04756de6
                                                0x04756dee
                                                0x04756df1
                                                0x04756df4
                                                0x04756dfd
                                                0x047905d3
                                                0x047905d3
                                                0x047905e4
                                                0x047905f9
                                                0x047905f9
                                                0x047905fe
                                                0x04756e96
                                                0x04756e9c
                                                0x04756e9c
                                                0x04756e03
                                                0x04756e09
                                                0x04756e0c
                                                0x04756e12
                                                0x04756e15
                                                0x04756e1b
                                                0x047905a1
                                                0x04756eb1
                                                0x04756eb1
                                                0x04756eb1
                                                0x04756e21
                                                0x04756e2a
                                                0x04756e9f
                                                0x04756eab
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04756eab
                                                0x04756e2c
                                                0x04756e34
                                                0x00000000
                                                0x04756e3d
                                                0x04756e3d
                                                0x04756e42
                                                0x04756e4d
                                                0x047905ac
                                                0x047905b2
                                                0x047905b2
                                                0x00000000
                                                0x047905ac
                                                0x04756e56
                                                0x04756e59
                                                0x04756e5d
                                                0x04756e5f
                                                0x04756e64
                                                0x04756e94
                                                0x04756e94
                                                0x00000000
                                                0x04756e94
                                                0x04756e6a
                                                0x04756e6d
                                                0x047905ba
                                                0x047905bd
                                                0x047905ca
                                                0x047905cc
                                                0x04756e91
                                                0x04756e91
                                                0x00000000
                                                0x04756e91
                                                0x047905c0
                                                0x00000000
                                                0x047905c0
                                                0x04756e7e
                                                0x04756e7e
                                                0x04756e80
                                                0x04756e86
                                                0x00000000
                                                0x00000000
                                                0x04756eba
                                                0x04756eba
                                                0x04756e88
                                                0x04756e8b
                                                0x04756e8f
                                                0x00000000
                                                0x04756e8f

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8f5923ccfc62e11761a64181f477a9fcd764954153fe337c5a9bd4bea8846838
                                                • Instruction ID: 9b27bb4af723b7aa79e04b2453b30925f2ed24e68789b9024c286e1654283311
                                                • Opcode Fuzzy Hash: 8f5923ccfc62e11761a64181f477a9fcd764954153fe337c5a9bd4bea8846838
                                                • Instruction Fuzzy Hash: 95314D31215605DFCB248F29C480A6AB7A6FF85314B54C95DE85D9F361EB71FC42CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047C3D40 Relevance: .1, Instructions: 98COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 70%
                                                			E047C3D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x480d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E04732280(_t34, 0x4808a6c);
				_t64 =  *0x4805768; // 0x776f5768
				if(_t64 != 0x4805768) {
					while(1) {
						_t8 = _t64 + 8; // 0x776f5770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E0472FFB0(_t53, _t64, 0x4808a6c);
						 *0x480b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E04732280(_t45, 0x4808a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x4805768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E0472FFB0(_t51, _t64, 0x4808a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E0475B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

































                                                0x047c3d40
                                                0x047c3d48
                                                0x047c3d52
                                                0x047c3d59
                                                0x047c3d5d
                                                0x047c3d61
                                                0x047c3d63
                                                0x047c3d67
                                                0x047c3d69
                                                0x047c3d72
                                                0x047c3d76
                                                0x047c3d7a
                                                0x047c3d7f
                                                0x047c3d8b
                                                0x047c3d91
                                                0x047c3d91
                                                0x047c3d91
                                                0x047c3d94
                                                0x047c3d96
                                                0x047c3d9d
                                                0x047c3da1
                                                0x047c3db0
                                                0x047c3dba
                                                0x047c3dbc
                                                0x047c3dbc
                                                0x047c3dc6
                                                0x047c3dcb
                                                0x047c3dcf
                                                0x047c3dd1
                                                0x047c3dd4
                                                0x00000000
                                                0x00000000
                                                0x047c3dd9
                                                0x047c3e0c
                                                0x047c3e0c
                                                0x047c3e0f
                                                0x047c3ddb
                                                0x047c3ddb
                                                0x047c3de0
                                                0x00000000
                                                0x047c3de2
                                                0x047c3de2
                                                0x047c3de4
                                                0x047c3de8
                                                0x047c3deb
                                                0x047c3df1
                                                0x00000000
                                                0x047c3df3
                                                0x047c3df3
                                                0x047c3df5
                                                0x047c3df8
                                                0x047c3dfa
                                                0x00000000
                                                0x047c3dfa
                                                0x047c3df1
                                                0x047c3de0
                                                0x047c3e11
                                                0x047c3e11
                                                0x00000000
                                                0x047c3dfe
                                                0x047c3e04
                                                0x047c3e06
                                                0x00000000
                                                0x047c3e06
                                                0x00000000
                                                0x047c3e04
                                                0x047c3d91
                                                0x047c3e15
                                                0x047c3e1a
                                                0x047c3e1f
                                                0x047c3e1f
                                                0x047c3e23
                                                0x047c3e29
                                                0x00000000
                                                0x00000000
                                                0x047c3e2e
                                                0x00000000
                                                0x047c3e30
                                                0x047c3e30
                                                0x047c3e35
                                                0x00000000
                                                0x047c3e37
                                                0x047c3e3e
                                                0x047c3e42
                                                0x047c3e48
                                                0x047c3e4e
                                                0x00000000
                                                0x047c3e4e
                                                0x047c3e35
                                                0x00000000
                                                0x047c3e2e
                                                0x047c3e5b
                                                0x047c3e5c
                                                0x047c3e5d
                                                0x047c3e68
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a99823982467afb837277f4af05b7c425c8f690075cbcec6582f59a2db50d684
                                                • Instruction ID: a4f996396f9c96c15e8d8c10b172e743f0ccfa3e73e652adb724ab17c3d493fb
                                                • Opcode Fuzzy Hash: a99823982467afb837277f4af05b7c425c8f690075cbcec6582f59a2db50d684
                                                • Instruction Fuzzy Hash: 5C315571609302DFC714EF28D98481ABBE1FF85714F0589AEE8889B791D730E944CBA2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474A70E Relevance: .1, Instructions: 96COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 92%
                                                			E0474A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4807b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4807b10 = 8;
					 *0x4807b14 = 0x4807b0c;
					 *0x4807b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E0474A990(0x4807b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0474A840(__edx, __ecx, __ecx, _t52, 0x4807b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4807b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0x4807b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4807b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L04734620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4807b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E0475F3E0(_t50,  *0x4807b14, _t8 >> 3);
						_t28 =  *0x4807b14; // 0x776f7b0c
						__eflags = _t28 - 0x4807b0c;
						if(_t28 != 0x4807b0c) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0x4807b14 = _t50;
						_t48 = _v12;
						 *0x4807b10 = _t9;
						goto L6;
					}
					 *0x4807b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}
















                                                0x0474a713
                                                0x0474a714
                                                0x0474a717
                                                0x0474a71d
                                                0x0474a720
                                                0x0474a722
                                                0x0474a727
                                                0x0474a74a
                                                0x0474a754
                                                0x0474a75e
                                                0x0474a768
                                                0x0474a76a
                                                0x0474a773
                                                0x0474a78b
                                                0x0474a790
                                                0x0474a792
                                                0x0474a741
                                                0x0474a741
                                                0x0474a743
                                                0x0474a749
                                                0x0474a749
                                                0x0474a732
                                                0x0474a73a
                                                0x0474a797
                                                0x0474a79d
                                                0x0474a7a3
                                                0x0474a7a9
                                                0x0474a7b6
                                                0x0474a7bc
                                                0x0474a7ca
                                                0x0474a7e0
                                                0x0474a7e2
                                                0x0474a7e4
                                                0x04789bf2
                                                0x00000000
                                                0x04789bf2
                                                0x0474a7ed
                                                0x0474a7f2
                                                0x0474a800
                                                0x0474a805
                                                0x0474a80d
                                                0x0474a812
                                                0x04789c08
                                                0x04789c08
                                                0x0474a818
                                                0x0474a81b
                                                0x0474a821
                                                0x0474a824
                                                0x00000000
                                                0x0474a824
                                                0x0474a7ae
                                                0x00000000
                                                0x0474a7ae
                                                0x0474a73c
                                                0x0474a73e
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fcd55be49592ef275277555862de75ef289e26f46c003725a8fe5eaf8c9d063d
                                                • Instruction ID: 6e613fca081d1fcd46fb944c6da2b29d474874952ecfd4ae310158a8e9d9dfbb
                                                • Opcode Fuzzy Hash: fcd55be49592ef275277555862de75ef289e26f46c003725a8fe5eaf8c9d063d
                                                • Instruction Fuzzy Hash: 5C31CCB1660204AFE762DF18D8A0F297BF9EB84710F544E5AE105D7340E378BD81CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047461A0 Relevance: .1, Instructions: 93COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 97%
                                                			E047461A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04745E50(0x46f67cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E047E9D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0471F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}



















                                                0x047461b3
                                                0x047461b5
                                                0x047461bd
                                                0x047461c3
                                                0x047461c7
                                                0x047461d2
                                                0x047461ff
                                                0x047461ff
                                                0x04746201
                                                0x04746207
                                                0x04746207
                                                0x047461d4
                                                0x047461d9
                                                0x00000000
                                                0x00000000
                                                0x047461df
                                                0x047461e2
                                                0x00000000
                                                0x00000000
                                                0x047461e6
                                                0x047461e8
                                                0x047461ee
                                                0x047461ee
                                                0x047461f9
                                                0x0478762f
                                                0x04787632
                                                0x04787635
                                                0x04787639
                                                0x04787640
                                                0x0478766e
                                                0x04787675
                                                0x00000000
                                                0x00000000
                                                0x04787681
                                                0x04787689
                                                0x0478768d
                                                0x04787691
                                                0x04787695
                                                0x04787699
                                                0x047876af
                                                0x047876b5
                                                0x047876b7
                                                0x047876b7
                                                0x047876d7
                                                0x047876dc
                                                0x00000000
                                                0x047876dc
                                                0x047876a2
                                                0x047876a9
                                                0x04787651
                                                0x04787653
                                                0x04787653
                                                0x04787656
                                                0x04787656
                                                0x00000000
                                                0x04787656
                                                0x04787644
                                                0x04787646
                                                0x04787648
                                                0x04787648
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d2a8c2c9a85a8d2175f44e1efeeea288872d099ee48254d0c6de77f76fbc1df7
                                                • Instruction ID: 60d3ace5128668f8eb53eba12025d85cce4b546cfe399fef68009a4d1ee7881c
                                                • Opcode Fuzzy Hash: d2a8c2c9a85a8d2175f44e1efeeea288872d099ee48254d0c6de77f76fbc1df7
                                                • Instruction Fuzzy Hash: 57318D716097019FD324EF19C900B26B7E4FB88B00F15496DE999DB351E7B4F804CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471AA16 Relevance: .1, Instructions: 93COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 95%
                                                			E0471AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x480d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4807b9c; // 0x0
					_t53 = L04734620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0475B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0475F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04726C59(_t53, _t51, _t58) != 0) {
							_t28 = E04745E50(0x46fc338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0474B230(_v32, _v28, 0x46fc2d8, 1,  &_v24);
								_t28 = E0471F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}




















                                                0x0471aa25
                                                0x0471aa29
                                                0x0471aa2d
                                                0x0471aa30
                                                0x0471aa37
                                                0x0471aa3c
                                                0x04774458
                                                0x04774458
                                                0x04774472
                                                0x04774474
                                                0x04774476
                                                0x0471aa64
                                                0x0471aa74
                                                0x0477447c
                                                0x04774483
                                                0x04774492
                                                0x0471aa52
                                                0x0471aa54
                                                0x0471aa5e
                                                0x047744a8
                                                0x047744ad
                                                0x047744af
                                                0x047744b6
                                                0x047744b6
                                                0x047744b9
                                                0x047744bc
                                                0x047744cd
                                                0x047744d3
                                                0x047744d6
                                                0x047744e1
                                                0x047744e1
                                                0x047744e6
                                                0x047744e8
                                                0x047744fb
                                                0x047744fb
                                                0x047744e8
                                                0x00000000
                                                0x0471aa5e
                                                0x04774476
                                                0x0471aa42
                                                0x0471aa46
                                                0x0471aa48
                                                0x0471aa4c
                                                0x00000000
                                                0x00000000
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: aa7a4d5d80c1f2e64def2d3dfaddaf5e9ad086363307140d2f9a513883679dcb
                                                • Instruction ID: fb7815130a04dbf228538fed636a368e99cbbb863ded696d065f0aab850b48a0
                                                • Opcode Fuzzy Hash: aa7a4d5d80c1f2e64def2d3dfaddaf5e9ad086363307140d2f9a513883679dcb
                                                • Instruction Fuzzy Hash: 1C31D171A01229ABDF149FA8CD81A7FB7B9EF04704B41446AF905EB350E774BD50DBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04758EC7 Relevance: .1, Instructions: 92COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 93%
                                                			E04758EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x480d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04744E70(0x48086e4, 0x4759490, 0, 0);
					if( *0x48053e8 > 5 && E04758F33(0x48053e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x48053e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x48053e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x46fbc46;
						_t48 = E04797B9C(0x48053e8, 0x46fbc46, _t67, 0x48053e8, _t70,  &_v140);
					}
				}
				return E0475B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}











































                                                0x04758ec7
                                                0x04758ed9
                                                0x04758edc
                                                0x04758ee6
                                                0x04758ee9
                                                0x04758eee
                                                0x04758efc
                                                0x04758f08
                                                0x04791349
                                                0x04791353
                                                0x0479135d
                                                0x04791366
                                                0x0479136f
                                                0x04791375
                                                0x0479137c
                                                0x04791385
                                                0x04791390
                                                0x04791391
                                                0x0479139c
                                                0x0479139d
                                                0x047913a6
                                                0x047913ac
                                                0x047913b2
                                                0x047913b5
                                                0x047913bc
                                                0x047913bf
                                                0x047913c2
                                                0x047913c5
                                                0x047913c8
                                                0x047913cb
                                                0x047913ce
                                                0x047913d1
                                                0x047913d4
                                                0x047913d7
                                                0x047913da
                                                0x047913dd
                                                0x047913e0
                                                0x047913e3
                                                0x047913e6
                                                0x047913e9
                                                0x047913f6
                                                0x04791400
                                                0x04791400
                                                0x04758f08
                                                0x04758f32

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0629b3011fd421201fbc8bce9e580ded2a073efbf04e848a9446444b917135aa
                                                • Instruction ID: e0dab79c5b4d0e4b0bbfa8dc8eb6366ca230f5270cdd110e5dc472099625f79f
                                                • Opcode Fuzzy Hash: 0629b3011fd421201fbc8bce9e580ded2a073efbf04e848a9446444b917135aa
                                                • Instruction Fuzzy Hash: 5F41B0B1D002189FDB20CFAAD980AADFBF4FB48304F5081AEE549A7340E7746A84CF50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04754A2C Relevance: .1, Instructions: 92COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 58%
                                                			E04754A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x480d360 ^ _t62;
				_v8 =  *0x480d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E04732280(_t26, 0x4808608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0472FFB0(_t41, _t51, 0x4808608);
						L2:
						 *0x480b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E0475B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E04732280(_t28, 0x4808608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0472FFB0(_t42, _t53, 0x4808608);
							if(_t53 != 0) {
								L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0472FFB0(_t41, _t51, 0x4808608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}
























                                                0x04754a2c
                                                0x04754a34
                                                0x04754a3c
                                                0x04754a3e
                                                0x04754a48
                                                0x04754a4b
                                                0x04754a4d
                                                0x04754a51
                                                0x04754a9c
                                                0x00000000
                                                0x00000000
                                                0x04754aa3
                                                0x04754aa8
                                                0x04754aad
                                                0x04754ab1
                                                0x04754ade
                                                0x04754ae3
                                                0x04754a5a
                                                0x04754a62
                                                0x04754a6a
                                                0x04754a6e
                                                0x0478f203
                                                0x04754a84
                                                0x04754a88
                                                0x04754a89
                                                0x04754a8a
                                                0x04754a95
                                                0x04754a95
                                                0x04754a79
                                                0x04754a80
                                                0x04754af2
                                                0x04754af4
                                                0x04754af9
                                                0x04754aff
                                                0x04754b01
                                                0x04754b03
                                                0x04754b08
                                                0x0478f20a
                                                0x0478f212
                                                0x0478f216
                                                0x0478f216
                                                0x04754b08
                                                0x04754b13
                                                0x04754b1a
                                                0x0478f229
                                                0x0478f229
                                                0x04754b1a
                                                0x04754a82
                                                0x00000000
                                                0x04754a82
                                                0x04754ab7
                                                0x04754acd
                                                0x04754acd
                                                0x04754ad5
                                                0x04754ada
                                                0x00000000
                                                0x04754ada
                                                0x04754ac2
                                                0x04754acb
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04754acb
                                                0x04754a53
                                                0x04754a53
                                                0x04754a58
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 421668f700b6ad06b3b618c9deae67d9e59470b4f86934766d9f86d0cc73ede6
                                                • Instruction ID: ffd000990722611a63e638cba38bf1378ea26e20d908164b0937d33501c54ce9
                                                • Opcode Fuzzy Hash: 421668f700b6ad06b3b618c9deae67d9e59470b4f86934766d9f86d0cc73ede6
                                                • Instruction Fuzzy Hash: 3031F1322013509BD7B1AF54CE48B2AB7A4FB84B14F014929E8668B761DBB4F880CB85
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474E730 Relevance: .1, Instructions: 89COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 74%
                                                			E0474E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04759670() < 0) {
					L0476DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4807b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04734620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0474E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

















                                                0x0474e730
                                                0x0474e736
                                                0x0474e738
                                                0x0474e73d
                                                0x0474e73e
                                                0x0474e740
                                                0x0474e749
                                                0x0474e765
                                                0x0474e76a
                                                0x0474e76b
                                                0x0474e76c
                                                0x0474e76d
                                                0x0474e76e
                                                0x0474e76f
                                                0x0474e775
                                                0x0474e777
                                                0x0474e77e
                                                0x0478b675
                                                0x0474e784
                                                0x0474e784
                                                0x0474e789
                                                0x0474e7a8
                                                0x0474e7ac
                                                0x0474e807
                                                0x0474e7ae
                                                0x0474e7ae
                                                0x0474e7b1
                                                0x0474e7b4
                                                0x0474e7b9
                                                0x0474e7c0
                                                0x0474e7c4
                                                0x0474e7ca
                                                0x0474e7cc
                                                0x00000000
                                                0x0474e7d3
                                                0x0474e7d6
                                                0x00000000
                                                0x00000000
                                                0x0474e7ff
                                                0x0474e802
                                                0x00000000
                                                0x00000000
                                                0x0474e7f9
                                                0x0474e7fc
                                                0x00000000
                                                0x00000000
                                                0x0474e7f3
                                                0x0474e7f6
                                                0x00000000
                                                0x00000000
                                                0x0474e7ed
                                                0x0474e7f0
                                                0x00000000
                                                0x00000000
                                                0x0474e7e7
                                                0x0474e7ea
                                                0x00000000
                                                0x00000000
                                                0x0478b685
                                                0x0478b688
                                                0x00000000
                                                0x00000000
                                                0x0478b682
                                                0x00000000
                                                0x00000000
                                                0x0474e7cc
                                                0x0474e7d9
                                                0x0474e7dc
                                                0x0474e7de
                                                0x0474e7de
                                                0x0474e7ac
                                                0x0474e7e4
                                                0x0474e74b
                                                0x0474e751
                                                0x0474e759
                                                0x0474e761
                                                0x0474e761

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1c0605ae863c32ea05232195870bab75a3233e4698e051309eeee5bbb0356606
                                                • Instruction ID: 94af4a21a5e9ee8e46e9f0dbcc61f9304292c5adda848cb152c40f79440867ac
                                                • Opcode Fuzzy Hash: 1c0605ae863c32ea05232195870bab75a3233e4698e051309eeee5bbb0356606
                                                • Instruction Fuzzy Hash: AF317A75A14249EFD745CF29C840B9ABBE8FB58324F14825AF914CB341E771EC80CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474BC2C Relevance: .1, Instructions: 88COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 67%
                                                			E0474BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4806100; // 0x37
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04732280(0xd, 0x1681f1a0);
				_t41 =  *0x48060f8; // 0x0
				if(_t41 != 0) {
					 *0x48060f8 =  *_t41;
					 *0x48060fc =  *0x48060fc + 0xffff;
				}
				E0472FFB0(_t41, 0x800, 0x1681f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x48060f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04734620(0x4806100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4806100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}










                                                0x0474bc36
                                                0x0474bc42
                                                0x0474bc45
                                                0x0474bc4a
                                                0x0474bd35
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474bc50
                                                0x0474bc50
                                                0x0474bc58
                                                0x0474bc5a
                                                0x0474bc60
                                                0x00000000
                                                0x00000000
                                                0x0478a4f2
                                                0x0478a4f6
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0478a4fc
                                                0x0474bc79
                                                0x0474bc7e
                                                0x0474bc86
                                                0x0474bd16
                                                0x0474bd20
                                                0x0474bd20
                                                0x0474bc8d
                                                0x0474bc94
                                                0x0474bcbd
                                                0x0474bcca
                                                0x0474bccb
                                                0x0474bccc
                                                0x0474bccd
                                                0x0474bcce
                                                0x0474bcd4
                                                0x0474bcea
                                                0x0474bcee
                                                0x0474bcf2
                                                0x0474bd00
                                                0x0474bd04
                                                0x00000000
                                                0x0474bc96
                                                0x0474bcab
                                                0x0474bcaf
                                                0x0474bd2c
                                                0x0474bd2c
                                                0x0474bd09
                                                0x00000000
                                                0x0474bd09
                                                0x0474bcb1
                                                0x0474bcb5
                                                0x0474bcbb
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474bcbb

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 46d2069cf98e0f1bedfc8cb6c5f682a2bc5ec6878da0251c951b8a779db68f97
                                                • Instruction ID: daf1879c3a17740208f37f6a3aed9dc01ac8b49cd5be1681251a2a0e4e6d41ed
                                                • Opcode Fuzzy Hash: 46d2069cf98e0f1bedfc8cb6c5f682a2bc5ec6878da0251c951b8a779db68f97
                                                • Instruction Fuzzy Hash: 9131CC36A106169BDB51EF58D4C07B673A4FB98315F0548B9E948EB302FB78FD498B80
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04741DB5 Relevance: .1, Instructions: 87COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 60%
                                                			E04741DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0473F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04734620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0473F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}












                                                0x04741dc2
                                                0x04741dc5
                                                0x04741dc7
                                                0x04741dcc
                                                0x04741dce
                                                0x04741dd6
                                                0x04741ddf
                                                0x04741de0
                                                0x04741de1
                                                0x04741de5
                                                0x04741de8
                                                0x04741def
                                                0x04741df0
                                                0x04741df6
                                                0x04741df7
                                                0x04741dfe
                                                0x04741e1a
                                                0x00000000
                                                0x00000000
                                                0x04741e0b
                                                0x04741e12
                                                0x04741e12
                                                0x04741e00
                                                0x04741e00
                                                0x04741e05
                                                0x04741e1e
                                                0x04741e23
                                                0x0478570f
                                                0x04785713
                                                0x00000000
                                                0x00000000
                                                0x04785719
                                                0x04785719
                                                0x04741e2c
                                                0x04741e2d
                                                0x04741e2e
                                                0x04741e2f
                                                0x04741e31
                                                0x04741e32
                                                0x04741e35
                                                0x04741e3d
                                                0x04785723
                                                0x0478573d
                                                0x0478573d
                                                0x00000000
                                                0x04785723
                                                0x04741e49
                                                0x04741e4e
                                                0x04741e4e
                                                0x04741e09
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                                • Instruction ID: a3878899caab33bc9f56bd3de880fd4282b337a608ef4bfdb06223fca65ed772
                                                • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                                • Instruction Fuzzy Hash: 06218075A00128EFD720DF69CC88E6ABBBDEF85685F514055E50597310DB30BE41D790
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04719100 Relevance: .1, Instructions: 87COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 76%
                                                			E04719100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x47ef6e8);
				E0476D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E047E88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0476D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x48086c0; // 0x2ac07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x48086b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04732280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E047E88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0475AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x480b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x48084c0;
										if(_t69 >=  *0x48084c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E047E9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0471922A(_t82);
							_t53 = E04737D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E047E8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x48086c0; // 0x2ac07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x48086b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x48086bc;
										_t72 = 0x48086b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04719240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x48086c4;
									_t72 = 0x48086c0;
									L18:
									E04749B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}


















                                                0x04719100
                                                0x04719100
                                                0x04719100
                                                0x04719100
                                                0x04719102
                                                0x04719107
                                                0x0471910c
                                                0x04719110
                                                0x04719115
                                                0x04719136
                                                0x04719143
                                                0x047737e4
                                                0x047737e4
                                                0x04719149
                                                0x0471914e
                                                0x0471914e
                                                0x04719117
                                                0x0471911d
                                                0x00000000
                                                0x00000000
                                                0x0471911f
                                                0x04719125
                                                0x00000000
                                                0x04719151
                                                0x04719158
                                                0x0471915d
                                                0x04719161
                                                0x04719168
                                                0x04773715
                                                0x00000000
                                                0x0471916e
                                                0x0471916e
                                                0x04719175
                                                0x04719177
                                                0x0471917e
                                                0x0471917f
                                                0x04719182
                                                0x04719182
                                                0x04719187
                                                0x04719187
                                                0x0471918a
                                                0x0471918d
                                                0x0471918f
                                                0x04719192
                                                0x04719195
                                                0x04719198
                                                0x04719198
                                                0x04719198
                                                0x0471919a
                                                0x00000000
                                                0x00000000
                                                0x0477371f
                                                0x04773721
                                                0x04773727
                                                0x0477372f
                                                0x04773733
                                                0x04773735
                                                0x04773738
                                                0x0477373b
                                                0x0477373d
                                                0x04773740
                                                0x00000000
                                                0x00000000
                                                0x04773746
                                                0x04773749
                                                0x00000000
                                                0x00000000
                                                0x0477374f
                                                0x04773751
                                                0x00000000
                                                0x00000000
                                                0x04773757
                                                0x04773759
                                                0x0477375c
                                                0x0477375c
                                                0x0477375e
                                                0x0477375e
                                                0x04773761
                                                0x04773764
                                                0x00000000
                                                0x00000000
                                                0x04773766
                                                0x04773768
                                                0x047737a3
                                                0x047737a3
                                                0x047737a5
                                                0x047737a7
                                                0x047737ad
                                                0x047737b0
                                                0x047737b2
                                                0x047737bc
                                                0x047737c2
                                                0x047737c2
                                                0x047737b2
                                                0x04719187
                                                0x04719187
                                                0x0471918a
                                                0x0471918d
                                                0x0471918f
                                                0x04719192
                                                0x04719195
                                                0x00000000
                                                0x04719195
                                                0x00000000
                                                0x04719187
                                                0x0477376a
                                                0x0477376a
                                                0x0477376c
                                                0x0477376c
                                                0x0477376f
                                                0x04773775
                                                0x00000000
                                                0x00000000
                                                0x04773777
                                                0x04773779
                                                0x00000000
                                                0x00000000
                                                0x04773782
                                                0x04773787
                                                0x04773789
                                                0x04773790
                                                0x04773790
                                                0x0477378b
                                                0x0477378b
                                                0x0477378b
                                                0x04773792
                                                0x04773795
                                                0x04773795
                                                0x04773798
                                                0x04773798
                                                0x0477379b
                                                0x0477379b
                                                0x047191a3
                                                0x047191a9
                                                0x047191b0
                                                0x047191b4
                                                0x047191b4
                                                0x047191bb
                                                0x047191c0
                                                0x047191c5
                                                0x047191c7
                                                0x047737da
                                                0x047191cd
                                                0x047191cd
                                                0x047191cd
                                                0x047191d2
                                                0x047191d5
                                                0x04719239
                                                0x04719239
                                                0x047191d7
                                                0x047191db
                                                0x047191e1
                                                0x047191e7
                                                0x047191fd
                                                0x04719203
                                                0x0471921e
                                                0x04719223
                                                0x00000000
                                                0x04719223
                                                0x04719205
                                                0x04719208
                                                0x0471920c
                                                0x04719214
                                                0x04719214
                                                0x047191e9
                                                0x047191e9
                                                0x047191ee
                                                0x047191f3
                                                0x047191f3
                                                0x047191f3
                                                0x047191e7
                                                0x00000000
                                                0x047191db
                                                0x04719187
                                                0x04719168

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0cfc94778f9dd9e9b09b84f4a691462cd42bdde23a34d6e61136a01cfa546f03
                                                • Instruction ID: 6bc60fe449bad5deaa1b7508344c33d155c65f9600cdd8adcde3eb6bc2b50139
                                                • Opcode Fuzzy Hash: 0cfc94778f9dd9e9b09b84f4a691462cd42bdde23a34d6e61136a01cfa546f03
                                                • Instruction Fuzzy Hash: F531AEF1A10244DFEB21DF6CC4987ACB7B1BB48314F158659CA1467361D334B9C1DB52
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04730050 Relevance: .1, Instructions: 81COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 53%
                                                			E04730050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x480d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04749ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0475B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E047E8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04749702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x480b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}




















                                                0x04730055
                                                0x0473005d
                                                0x04730062
                                                0x0473006c
                                                0x0473006f
                                                0x04730074
                                                0x0473007a
                                                0x0473007a
                                                0x04730080
                                                0x04730080
                                                0x04730087
                                                0x0473008d
                                                0x0473008f
                                                0x04730093
                                                0x04730095
                                                0x0473009b
                                                0x047300f8
                                                0x047300fb
                                                0x047300fc
                                                0x047300ff
                                                0x04730108
                                                0x04730108
                                                0x047300a2
                                                0x047300a6
                                                0x047300b3
                                                0x047300bc
                                                0x047300c5
                                                0x047300ca
                                                0x0477c01e
                                                0x00000000
                                                0x00000000
                                                0x0477c02d
                                                0x047300d5
                                                0x047300d9
                                                0x0477c03d
                                                0x0477c046
                                                0x0477c046
                                                0x047300df
                                                0x047300e2
                                                0x047300ea
                                                0x047300ef
                                                0x047300f2
                                                0x047300f6
                                                0x04730111
                                                0x04730117
                                                0x04730117
                                                0x00000000
                                                0x047300f6
                                                0x047300d0
                                                0x047300d0
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3d5a1ba638ba8c3d54ca10f6d7eaaaab99732cfed1ad95cbcff83ca72343f134
                                                • Instruction ID: 1f26cd867c9bf94f654b2fd93c3075ba7f6e681a3336f03253d3699503dd02a7
                                                • Opcode Fuzzy Hash: 3d5a1ba638ba8c3d54ca10f6d7eaaaab99732cfed1ad95cbcff83ca72343f134
                                                • Instruction Fuzzy Hash: 64319A31601B448FD722CF28C984BAAB3E5FF88719F14496DE59687B90EB75B801CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04796C0A Relevance: .1, Instructions: 79COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 77%
                                                			E04796C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04737D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4807b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04734620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0475F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04737D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04759AE0();
						_t23 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}












                                                0x04796c0a
                                                0x04796c0f
                                                0x04796c10
                                                0x04796c13
                                                0x04796c15
                                                0x04796c19
                                                0x04796c1c
                                                0x04796c21
                                                0x04796c28
                                                0x04796c3a
                                                0x04796c2a
                                                0x04796c33
                                                0x04796c33
                                                0x04796c3f
                                                0x04796c48
                                                0x04796c4d
                                                0x04796c60
                                                0x04796c65
                                                0x04796c69
                                                0x04796c73
                                                0x04796c79
                                                0x04796c7f
                                                0x04796c86
                                                0x04796c90
                                                0x04796c94
                                                0x04796ca6
                                                0x04796cb2
                                                0x04796cbd
                                                0x04796cbd
                                                0x04796cc3
                                                0x04796cc7
                                                0x04796ccb
                                                0x04796cd0
                                                0x04796cd1
                                                0x04796ce2
                                                0x04796ce2
                                                0x04796c69
                                                0x04796ced

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 15252dc17a8008b5a075f7eb75f7b116463454417d16e3eeef06c3244eba5137
                                                • Instruction ID: 7980535c336c60a3158978e6ee5bea0ff9abdac0e70c0dd4f8e1953fc747e70f
                                                • Opcode Fuzzy Hash: 15252dc17a8008b5a075f7eb75f7b116463454417d16e3eeef06c3244eba5137
                                                • Instruction Fuzzy Hash: 53219AB1A00644ABDB15DB68E884E2AB7A8FF48704F04416AF904CB791D634FD10CBA4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047590AF Relevance: .1, Instructions: 76COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 82%
                                                			E047590AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0476D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0474E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04734620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0475F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0474A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}


























                                                0x047590af
                                                0x047590b8
                                                0x047590bb
                                                0x047590bf
                                                0x047590c2
                                                0x047590c2
                                                0x047590c8
                                                0x047590cb
                                                0x047590cd
                                                0x047914d7
                                                0x047914eb
                                                0x047914eb
                                                0x00000000
                                                0x047914eb
                                                0x047914db
                                                0x047914e6
                                                0x00000000
                                                0x047914f2
                                                0x047914e8
                                                0x00000000
                                                0x047914e8
                                                0x047590d8
                                                0x047590da
                                                0x047590dd
                                                0x047590e5
                                                0x00000000
                                                0x04759139
                                                0x047590fa
                                                0x047590fe
                                                0x04759142
                                                0x00000000
                                                0x04759142
                                                0x04759104
                                                0x04759107
                                                0x0475910b
                                                0x04759110
                                                0x04759118
                                                0x04759147
                                                0x04759148
                                                0x0475914f
                                                0x04759150
                                                0x04759151
                                                0x04759152
                                                0x04759156
                                                0x0475915d
                                                0x04759160
                                                0x04759168
                                                0x0475916c
                                                0x047591bc
                                                0x047591be
                                                0x00000000
                                                0x047591be
                                                0x0475916e
                                                0x04759173
                                                0x04759176
                                                0x00000000
                                                0x00000000
                                                0x0475917c
                                                0x04759180
                                                0x047591b5
                                                0x00000000
                                                0x047591b5
                                                0x04759182
                                                0x04759185
                                                0x04759189
                                                0x00000000
                                                0x00000000
                                                0x0475918e
                                                0x04759190
                                                0x04759198
                                                0x00000000
                                                0x00000000
                                                0x047591a0
                                                0x00000000
                                                0x047591ad
                                                0x047591ad
                                                0x047591b0
                                                0x047591b1
                                                0x00000000
                                                0x04759185
                                                0x0475911a
                                                0x0475911c
                                                0x0475911f
                                                0x04759125
                                                0x04759127
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                                • Instruction ID: 89b0a30af67f53c2962ebe907584defc4be610bbe72d274558faaf6be7b4d60d
                                                • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                                • Instruction Fuzzy Hash: 952156B5A00219EFEB21DF55D444A5AF7F8EB44354F14886AEE499B310D370FD50CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04743B7A Relevance: .1, Instructions: 75COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 59%
                                                			E04743B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x48084c4; // 0x0
				_v12 = 1;
				_v8 =  *0x48084c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x48084c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0475AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0475FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x48084c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x48084c4; // 0x0
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}












                                                0x04743b89
                                                0x04743b96
                                                0x04743ba1
                                                0x04743bab
                                                0x04743bb5
                                                0x04743bb9
                                                0x04786298
                                                0x04743bbf
                                                0x04743bc2
                                                0x04743bc3
                                                0x04743bc9
                                                0x04743bca
                                                0x04743bcc
                                                0x04743bcd
                                                0x04743bd4
                                                0x04743bd6
                                                0x04743bdb
                                                0x04743bea
                                                0x04743bf7
                                                0x04743bfb
                                                0x04743bff
                                                0x04743c09
                                                0x04743c0a
                                                0x04743c0b
                                                0x04743c0f
                                                0x04743c14
                                                0x04743c18
                                                0x04743c18
                                                0x04743bfb
                                                0x04743c1b
                                                0x04743c30
                                                0x04743c30
                                                0x04743c3d

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7f6dc86b68ae2004c7826a2c5f49440d86bbabb8297633821625fbacaf006ae0
                                                • Instruction ID: 4185b0800502bdf64e734adaf3ef48e0ce868bde660c3cd01440e68888e28a54
                                                • Opcode Fuzzy Hash: 7f6dc86b68ae2004c7826a2c5f49440d86bbabb8297633821625fbacaf006ae0
                                                • Instruction Fuzzy Hash: CD21BE72A00508AFDB04DF58CD81F6AB7BDFB40308F150468E908AB352D375BD55CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04796CF0 Relevance: .1, Instructions: 74COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 80%
                                                			E04796CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04737D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04737D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x46f5c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0474F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0474F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E04797016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04732400( &_v52);
								}
								_t21 = L04732400( &_v28);
							}
						}
					}
				}
				return _t21;
			}



















                                                0x04796cfb
                                                0x04796d00
                                                0x04796d02
                                                0x04796d06
                                                0x04796d0a
                                                0x04796d0e
                                                0x04796d19
                                                0x04796d2b
                                                0x04796d1b
                                                0x04796d24
                                                0x04796d24
                                                0x04796d33
                                                0x04796d39
                                                0x04796d46
                                                0x04796d4f
                                                0x04796d61
                                                0x04796d51
                                                0x04796d5a
                                                0x04796d5a
                                                0x04796d69
                                                0x04796d6b
                                                0x04796d6d
                                                0x04796d6f
                                                0x04796d6f
                                                0x04796d74
                                                0x04796d79
                                                0x04796d7a
                                                0x04796d7f
                                                0x04796d82
                                                0x04796d88
                                                0x04796d89
                                                0x04796d90
                                                0x04796d94
                                                0x04796da7
                                                0x04796db1
                                                0x04796db1
                                                0x04796dbb
                                                0x04796dbb
                                                0x04796d90
                                                0x04796d69
                                                0x04796d46
                                                0x04796dc6

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 750a40c1694d3000bf4a8d20774564b2160a576522e30327277548a43bde8092
                                                • Instruction ID: e18301a4d9d417a92903259abbb17dcd30ba10407a6520085077a80c3a20d0bf
                                                • Opcode Fuzzy Hash: 750a40c1694d3000bf4a8d20774564b2160a576522e30327277548a43bde8092
                                                • Instruction Fuzzy Hash: 7E21D0725046449BDF11DF29E948B6BB7ECAF81794F080656F95087351E734ED08C6E2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E2EF7 Relevance: .1, Instructions: 72COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 35%
                                                			E047E2EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x480d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E0475D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E0475D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E04732280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x480b1e0();
						 *( *(_t106 + 0x30) ^  *0x4806110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x480b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x4806110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E0472FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E0475B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x46fac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x46fac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}






































                                                0x047e2efc
                                                0x047e2efd
                                                0x047e2eff
                                                0x047e2f03
                                                0x047e2f0a
                                                0x047e2f0c
                                                0x047e2f15
                                                0x047e2fba
                                                0x047e2fbb
                                                0x047e2fc5
                                                0x047e2fcd
                                                0x047e2fcf
                                                0x047e2fd3
                                                0x047e2fd4
                                                0x047e2fd5
                                                0x047e2fd7
                                                0x047e2fda
                                                0x047e2fdb
                                                0x047e2fdd
                                                0x047e2fe0
                                                0x047e2fe2
                                                0x047e2ffc
                                                0x047e2fe4
                                                0x047e2fe4
                                                0x047e2fea
                                                0x047e2fed
                                                0x047e2fef
                                                0x047e2ff6
                                                0x047e2ff1
                                                0x047e2ff1
                                                0x047e2ff1
                                                0x047e2fef
                                                0x047e2fff
                                                0x047e3001
                                                0x047e301b
                                                0x047e3003
                                                0x047e3003
                                                0x047e300e
                                                0x047e3015
                                                0x047e3010
                                                0x047e3010
                                                0x047e3010
                                                0x047e3010
                                                0x047e300e
                                                0x047e302c
                                                0x047e3035
                                                0x047e303c
                                                0x047e3046
                                                0x047e304e
                                                0x047e3056
                                                0x047e305a
                                                0x047e305e
                                                0x047e3063
                                                0x047e3067
                                                0x047e306b
                                                0x047e306f
                                                0x047e3072
                                                0x047e30af
                                                0x047e30b5
                                                0x047e30c1
                                                0x047e30c9
                                                0x047e30c9
                                                0x047e30c9
                                                0x00000000
                                                0x047e3074
                                                0x047e3081
                                                0x047e3089
                                                0x047e308b
                                                0x047e308d
                                                0x047e3093
                                                0x047e309a
                                                0x047e30ce
                                                0x047e30d1
                                                0x047e30d5
                                                0x047e30d5
                                                0x047e30d5
                                                0x047e308d
                                                0x047e30db
                                                0x047e30e6
                                                0x047e30e7
                                                0x047e30e8
                                                0x047e30e9
                                                0x047e30f3
                                                0x047e2f27
                                                0x047e2f29
                                                0x047e2f2b
                                                0x047e2f2d
                                                0x047e2f36
                                                0x047e2f3d
                                                0x047e2f4c
                                                0x047e2f58
                                                0x047e2fad
                                                0x047e2fb7
                                                0x047e2fb7

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 829cbc4a0504ac713264a336d605be66d84f3cbe7c3b7266e40bac531c76d064
                                                • Instruction ID: db40436402b68de1eb672c4994d2ea1352aaa56ecc0b53316f484e90cb620e59
                                                • Opcode Fuzzy Hash: 829cbc4a0504ac713264a336d605be66d84f3cbe7c3b7266e40bac531c76d064
                                                • Instruction Fuzzy Hash: F721D2A12142501BD704CF5AC8A45B6BFE5EFCA12234BC1E6E8CCCB356E524D806C7A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E070D Relevance: .1, Instructions: 72COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 67%
                                                			E047E070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E047E07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E047DAFDE( &_v8,  &_v12);
					E047E1293(_t38, _v28, _t60);
					if(E04737D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E047D14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}













                                                0x047e071b
                                                0x047e0724
                                                0x047e0734
                                                0x047e0738
                                                0x047e074b
                                                0x047e074b
                                                0x047e0753
                                                0x047e0753
                                                0x047e0759
                                                0x047e075d
                                                0x047e0774
                                                0x047e0779
                                                0x047e077d
                                                0x047e0789
                                                0x047e0795
                                                0x047e07a7
                                                0x047e0797
                                                0x047e07a0
                                                0x047e07a0
                                                0x047e07af
                                                0x047e07c4
                                                0x047e07cd
                                                0x047e07cd
                                                0x047e07af
                                                0x047e07dc

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                                • Instruction ID: 4416fb21f58d6c271bb608dec8c25717457775c535d87cac7a696b4756ccd9dd
                                                • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                                • Instruction Fuzzy Hash: C12146363042409FDB05DF19C884B6ABBA9FFC8310F048669F9948B381DB70E809CB91
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473AE73 Relevance: .1, Instructions: 70COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 96%
                                                			E0473AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04737D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04737D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04737D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04737D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E04797794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}













                                                0x0473ae78
                                                0x0473ae7c
                                                0x0473ae7e
                                                0x0473ae81
                                                0x0473ae86
                                                0x0473ae8d
                                                0x04782691
                                                0x0473ae93
                                                0x0473ae93
                                                0x0473ae93
                                                0x0473ae98
                                                0x0473ae9d
                                                0x047826a2
                                                0x047826b4
                                                0x047826a4
                                                0x047826ad
                                                0x047826ad
                                                0x047826b9
                                                0x00000000
                                                0x047826bb
                                                0x00000000
                                                0x047826bb
                                                0x0473aea3
                                                0x0473aea3
                                                0x0473aea3
                                                0x0473aeaa
                                                0x047826c0
                                                0x047826c9
                                                0x047826c9
                                                0x0473aeb3
                                                0x047826d4
                                                0x047826e1
                                                0x00000000
                                                0x00000000
                                                0x047826e7
                                                0x047826ee
                                                0x047826f0
                                                0x047826f9
                                                0x047826f9
                                                0x04782702
                                                0x04782708
                                                0x04782708
                                                0x0478270b
                                                0x0478270f
                                                0x04782711
                                                0x04782711
                                                0x04782725
                                                0x04782725
                                                0x00000000
                                                0x0473aeb9
                                                0x0473aeb9
                                                0x0473aebf
                                                0x0473aebf
                                                0x0473aeb3

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                                • Instruction ID: fc35bf682cb5c2087616c0e13e8ab0872aa38c00ee4be1b1f1db7c7f77182d66
                                                • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                                • Instruction Fuzzy Hash: 8521F3B1745684DFEB26AB29C949B2577E8EF44356F1900E5DD048BBA3E738FC40C6A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E1FF1 Relevance: .1, Instructions: 70COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 77%
                                                			E047E1FF1(void* __ecx, intOrPtr __edx, signed int _a4) {
				intOrPtr _v8;
				signed int _t22;
				signed int _t34;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				signed int _t44;
				signed int _t54;
				signed int _t55;

				_t44 = _a4;
				_v8 = __edx;
				_t3 = _t44 + 0x1007; // 0x1007
				_t41 = _t3 & 0xfffff000;
				_t54 = ( *_t44 ^  *0x4806110 ^ _t44) >> 0x00000001 & 0x00007fff;
				if(_t41 - _t44 < _t54 << 3) {
					_t42 = _t41 + 0xfffffff0;
					_t34 = _t42 - _t44 >> 3;
					_t55 = _t54 - _t34;
					 *_t44 =  *_t44 ^ (_t34 + _t34 ^  *_t44 ^  *0x4806110 ^ _t44) & 0x0000fffe;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_t22 = ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff) + ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff);
					 *_t42 = _t22;
					_t38 = _t42 + _t55 * 8;
					 *_t42 = _t22 ^  *0x4806110 ^ _t42;
					if(_t38 < _v8 + (( *(_v8 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t38 =  *_t38 ^ (_t55 << 0x00000010 ^  *0x4806110 ^ _t38 ^  *_t38) & 0x7fff0000;
					}
				} else {
					_t42 = 0;
				}
				return _t42;
			}












                                                0x047e1ff9
                                                0x047e1ffc
                                                0x047e2001
                                                0x047e200d
                                                0x047e201b
                                                0x047e2028
                                                0x047e202e
                                                0x047e2035
                                                0x047e2038
                                                0x047e204c
                                                0x047e2052
                                                0x047e2053
                                                0x047e2054
                                                0x047e2055
                                                0x047e2069
                                                0x047e206c
                                                0x047e206e
                                                0x047e2079
                                                0x047e2087
                                                0x047e209c
                                                0x047e209c
                                                0x047e202a
                                                0x047e202a
                                                0x047e202a
                                                0x047e20a5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 39c5d336f6bd9b82fd967ff7f4357a1ccdc2221ee7c57fc3ece997e7cc335279
                                                • Instruction ID: 15388a3f8ffb0c803101309fd00536f3c28cb200b86fd40342801bc5eb932a2d
                                                • Opcode Fuzzy Hash: 39c5d336f6bd9b82fd967ff7f4357a1ccdc2221ee7c57fc3ece997e7cc335279
                                                • Instruction Fuzzy Hash: 1221A233A204159F9B58CF7DC805566F7E6EFCC31032A4A7AD812EB2A5EA70BD51C680
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04797794 Relevance: .1, Instructions: 70COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 82%
                                                			E04797794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4807b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0475F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04737D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04759AE0();
					_t24 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}













                                                0x04797799
                                                0x0479779a
                                                0x0479779b
                                                0x047977a3
                                                0x047977ab
                                                0x047977ae
                                                0x047977b1
                                                0x047977b1
                                                0x047977bf
                                                0x047977c4
                                                0x047977c8
                                                0x047977ce
                                                0x047977d4
                                                0x047977e0
                                                0x047977e0
                                                0x047977d6
                                                0x047977d6
                                                0x047977de
                                                0x00000000
                                                0x00000000
                                                0x047977de
                                                0x047977e5
                                                0x047977f0
                                                0x047977f3
                                                0x047977f6
                                                0x047977fd
                                                0x04797800
                                                0x0479780c
                                                0x04797818
                                                0x0479782b
                                                0x0479781a
                                                0x04797823
                                                0x04797823
                                                0x04797830
                                                0x04797831
                                                0x04797838
                                                0x0479783d
                                                0x0479783e
                                                0x0479784f
                                                0x0479784f
                                                0x0479785a

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e0cad9da3e8371b3c278179600a05d4c939b7921160919275a3955b279ac57f9
                                                • Instruction ID: c88bc06e9f1dccab5592e910bdb807ab57393325ee109fb1bcfc474b6bde81f0
                                                • Opcode Fuzzy Hash: e0cad9da3e8371b3c278179600a05d4c939b7921160919275a3955b279ac57f9
                                                • Instruction Fuzzy Hash: 69219F72510604EBCB29DF69D894E6BB7ECEF48340F10456DE90AC7760E634ED00CBA4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474FD9B Relevance: .1, Instructions: 69COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 93%
                                                			E0474FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E047276E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}










                                                0x0474fd9b
                                                0x0474fda0
                                                0x0474fda1
                                                0x0474fdab
                                                0x0474fdad
                                                0x0474fdb0
                                                0x0474fdb8
                                                0x0474fe0f
                                                0x0474fde6
                                                0x0474fde9
                                                0x0474fdec
                                                0x0478c0c0
                                                0x0474fdfe
                                                0x0474fe06
                                                0x0474fe06
                                                0x0478c0c8
                                                0x0474fe2d
                                                0x0474fe2d
                                                0x00000000
                                                0x0474fe2d
                                                0x0478c0d1
                                                0x0478c0e0
                                                0x0478c0e5
                                                0x0478c0e5
                                                0x0478c0e8
                                                0x00000000
                                                0x0478c0e8
                                                0x0474fdf4
                                                0x00000000
                                                0x00000000
                                                0x0474fdf6
                                                0x0474fdfa
                                                0x0474fe1a
                                                0x0474fe1f
                                                0x0474fe1f
                                                0x0474fdfc
                                                0x00000000
                                                0x0474fdfc
                                                0x0474fdcc
                                                0x0474fdd0
                                                0x0474fe26
                                                0x00000000
                                                0x0474fe26
                                                0x0474fdd8
                                                0x0474fddb
                                                0x0474fddd
                                                0x0474fde0
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                                • Instruction ID: 183a0ff88e285cfe4860858d7b9856574e4ad104a8cd6d877acbf2af0ce76041
                                                • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                                • Instruction Fuzzy Hash: 05219572A40A44DFD735CF0ACA40A72B7E5EB84B11F21846EE9498BB15E730AD00DFA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472841F Relevance: .1, Instructions: 64COMMONCrypto
                                                Download Yara Rule
                                                C-Code - Quality: 80%
                                                			E0472841F(signed int __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _t43;
				signed int _t46;
				signed int _t50;
				signed int _t57;
				signed int _t64;

				_v16 = __ecx;
				_t43 =  *0x7ffe0004;
				_v8 = _t43;
				_t57 =  *0x7ffe0014 ^  *( *[fs:0x18] + 0x24) ^  *( *[fs:0x18] + 0x20) ^  *0x7ffe0018;
				_v12 = 0x7ffe0014;
				if(_t43 < 0x1000000) {
					while(1) {
						_t46 =  *0x7ffe0324;
						_t50 =  *0x7FFE0320;
						if(_t46 ==  *0x7FFE0328) {
							break;
						}
						asm("pause");
					}
					_t57 = _v12;
					_t64 = ((_t50 * _v8 >> 0x00000020 << 0x00000020 | _t50 * _v8) >> 0x18) + (_t46 << 8) * _v8;
				} else {
					_t64 = ( *0x7ffe0320 * _t43 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t43) >> 0x18;
				}
				_push(0);
				_push( &_v24);
				E04759810();
				return _t64 ^ _v20 ^ _v24 ^ _t57 ^ _v16;
			}













                                                0x0472842f
                                                0x04728448
                                                0x0472844e
                                                0x04728459
                                                0x0472845b
                                                0x04728464
                                                0x04779ac3
                                                0x04779ac3
                                                0x04779ac5
                                                0x04779acb
                                                0x00000000
                                                0x00000000
                                                0x04779acd
                                                0x04779acd
                                                0x04779ad1
                                                0x04779ae9
                                                0x0472846a
                                                0x04728475
                                                0x04728479
                                                0x0472847c
                                                0x04728481
                                                0x04728482
                                                0x0472849a

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
                                                • Instruction ID: 510e3078879c178315b08c621d192cd2d46fd430ee8c79799d25aaa5da85235f
                                                • Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
                                                • Instruction Fuzzy Hash: 8D2190B2E01119CBDB14CFA9C58068AF3F5FB88350FA64565EA08B7344C630BE04CBD0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04719240 Relevance: .1, Instructions: 63COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 77%
                                                			E04719240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x47ef708);
				E0476D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E047595D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E047595D0();
				_t33 =  *0x48084c4; // 0x0
				L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x48084c4; // 0x0
				L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x48084c4; // 0x0
				E04732280(L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x48086b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E047595D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E047595D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04719325();
					_t50 =  *0x48084c4; // 0x0
					return E0476D0D1(L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}















                                                0x04719240
                                                0x04719242
                                                0x04719247
                                                0x0471924c
                                                0x0471924e
                                                0x04719255
                                                0x04719257
                                                0x0471925a
                                                0x0471925f
                                                0x0471925f
                                                0x04719266
                                                0x04719271
                                                0x04719276
                                                0x04719279
                                                0x0471927e
                                                0x04719295
                                                0x0471929a
                                                0x047192b1
                                                0x047192b6
                                                0x047192d7
                                                0x047192dc
                                                0x047192e0
                                                0x047192e6
                                                0x047192e8
                                                0x047192ee
                                                0x04719332
                                                0x04719333
                                                0x04719337
                                                0x04719338
                                                0x0471933a
                                                0x0471933a
                                                0x0471933d
                                                0x04719342
                                                0x04719342
                                                0x04719345
                                                0x04719349
                                                0x0471934e
                                                0x04719352
                                                0x04719357
                                                0x047192f4
                                                0x047192f4
                                                0x047192f6
                                                0x047192f9
                                                0x04719300
                                                0x04719306
                                                0x04719324
                                                0x04719324

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: dcb95fd9b4693acf679056c8d8f8229b42e5dde37f06d194441ba28a5c8132dc
                                                • Instruction ID: 93aae375f79b70e3a874beff59027142a92d953724e1b7220c586382e7b976d2
                                                • Opcode Fuzzy Hash: dcb95fd9b4693acf679056c8d8f8229b42e5dde37f06d194441ba28a5c8132dc
                                                • Instruction Fuzzy Hash: D32159B1151A00DFD765EF28CA14F19B7B9FF08708F044968E10A967B2CB34FA82CB44
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474B390 Relevance: .1, Instructions: 63COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 54%
                                                			E0474B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04732280(_t12, 0x4808608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E047500C2(0x4808608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}











                                                0x0474b395
                                                0x0474b3a2
                                                0x0474b3a5
                                                0x0474b3aa
                                                0x0474b3b2
                                                0x0474b3ba
                                                0x0474b3bd
                                                0x0474b3c0
                                                0x0474b3c4
                                                0x0474b3c9
                                                0x0478a3e9
                                                0x0478a3ed
                                                0x0478a3f0
                                                0x0478a3ff
                                                0x0478a403
                                                0x0478a409
                                                0x00000000
                                                0x00000000
                                                0x0478a40b
                                                0x0478a40b
                                                0x0478a40f
                                                0x0478a415
                                                0x0478a423
                                                0x0478a423
                                                0x0478a415
                                                0x0474b3d1
                                                0x0474b3e8
                                                0x0474b3e8
                                                0x0474b3d9

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9f3f91a70151cbfafdc28bba50adf520c7cf4ae8400058f2f57d657173d509ef
                                                • Instruction ID: 323de690b58b0cf08a62406b444e801c73e6d81aa40f566b93aabc427cd69b82
                                                • Opcode Fuzzy Hash: 9f3f91a70151cbfafdc28bba50adf520c7cf4ae8400058f2f57d657173d509ef
                                                • Instruction Fuzzy Hash: 251148333111109BDB18AA168D81A2B736AEBC5730B25453DEE26D7780DA31FC02C690
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047A4257 Relevance: .1, Instructions: 60COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 90%
                                                			E047A4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x47f08d0);
				E0476D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E047A41E8(__ebx, __edi, __ecx, _t39);
				E0472EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x48087e4;
					_t18 =  *0x48087e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4805cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x48087e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x48087e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04717055(_t31 + 0xfffffff8);
								_t24 =  *0x48087e0; // 0x0
								_t18 = _t24 - 1;
								 *0x48087e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4805cd0;
				if( *0x4805cd0 <= 0) {
					L04717055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x48087e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x48087e8 = _t30;
						 *0x48087e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0476D0D1(L047A4320());
			}















                                                0x047a4257
                                                0x047a4257
                                                0x047a4257
                                                0x047a4259
                                                0x047a425e
                                                0x047a4263
                                                0x047a4265
                                                0x047a4273
                                                0x047a4278
                                                0x047a427c
                                                0x047a427f
                                                0x047a4281
                                                0x047a4287
                                                0x047a42d7
                                                0x047a42d7
                                                0x047a42da
                                                0x047a428d
                                                0x047a428d
                                                0x047a428f
                                                0x047a4292
                                                0x047a4297
                                                0x047a429c
                                                0x047a42a0
                                                0x047a42a6
                                                0x047a42a8
                                                0x047a42ae
                                                0x047a42b3
                                                0x00000000
                                                0x047a42ba
                                                0x047a42ba
                                                0x047a42bf
                                                0x047a42c5
                                                0x047a42ca
                                                0x047a42cf
                                                0x047a42d0
                                                0x00000000
                                                0x047a42d0
                                                0x047a42b3
                                                0x00000000
                                                0x047a42a6
                                                0x047a429c
                                                0x047a42dc
                                                0x047a42dc
                                                0x047a42e3
                                                0x047a4309
                                                0x047a42e5
                                                0x047a42e5
                                                0x047a42e8
                                                0x047a42ee
                                                0x047a42f0
                                                0x00000000
                                                0x047a42f2
                                                0x047a42f2
                                                0x047a42f4
                                                0x047a42f7
                                                0x047a42f9
                                                0x047a4300
                                                0x047a4300
                                                0x047a42f0
                                                0x047a430e
                                                0x047a431f

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5ab9b924b25f9de134b983154012e89b01a21efa247c40851667c3aab31a7e38
                                                • Instruction ID: 9cc3138eb813370b4d980a9e7d1695b6eaba4b56fb18a961580d302b4a300a25
                                                • Opcode Fuzzy Hash: 5ab9b924b25f9de134b983154012e89b01a21efa247c40851667c3aab31a7e38
                                                • Instruction Fuzzy Hash: 28216D71611600CFDB64EF65D50461477F1FBCA318B608B6AC1058B398E7B6E8D1CF00
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047946A7 Relevance: .1, Instructions: 59COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 93%
                                                			E047946A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0475F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0474D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L047377F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}











                                                0x047946b7
                                                0x047946ba
                                                0x047946c5
                                                0x047946c8
                                                0x047946d0
                                                0x047946d4
                                                0x047946e6
                                                0x047946e9
                                                0x047946f4
                                                0x047946ff
                                                0x04794705
                                                0x04794706
                                                0x0479470c
                                                0x04794713
                                                0x0479471b
                                                0x04794723
                                                0x04794725
                                                0x047946d6
                                                0x047946d9
                                                0x047946db
                                                0x047946db
                                                0x04794732

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                                • Instruction ID: 9d233a30dbc9371ee7ef78220d6a0ae301d53d3e6bed2d52f15db672a81c5126
                                                • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                                • Instruction Fuzzy Hash: D8112572504208BBDB059F5CE8808BEB7B9EF85304F1080AEF984CB351DA319D51D7A4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04742397 Relevance: .1, Instructions: 59COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 34%
                                                			E04742397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x480848c != 0) {
					L0473FAD0(0x4808610);
					if( *0x480848c == 0) {
						E0473FA00(0x4808610, _t19, _t27, 0x4808610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04742581(0x4808610, 0x46f50a0, _t26, _t27, _t28);
						E0473FA00(0x4808610, 0x46f50a0, _t27, 0x4808610);
					}
				} else {
					L1:
					_t11 =  *0x4808614; // 0x0
					if(_t11 == 0) {
						_t11 = E04754886(0x46f1088, 1, 0x4808614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04742581(0x4808610, (_t11 << 4) + 0x46f5070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}















                                                0x047423b0
                                                0x047423b6
                                                0x04742409
                                                0x04742415
                                                0x04785ae9
                                                0x00000000
                                                0x0474241b
                                                0x0474241b
                                                0x0474241d
                                                0x04742427
                                                0x0474242e
                                                0x04742430
                                                0x04742430
                                                0x047423b8
                                                0x047423b8
                                                0x047423b8
                                                0x047423bf
                                                0x047423fc
                                                0x047423fc
                                                0x047423c1
                                                0x047423c3
                                                0x047423d0
                                                0x047423d8
                                                0x047423d8
                                                0x047423dc
                                                0x047423de
                                                0x047423e1
                                                0x047423e1
                                                0x047423ec

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2b03c0dc336601979b6f103deb18f1f57d886b7908e17cba78701e2c5ad98438
                                                • Instruction ID: c3565eec28d41dcccc547850d80c2d6cc5e587755f9f17494165b43edcb1cb69
                                                • Opcode Fuzzy Hash: 2b03c0dc336601979b6f103deb18f1f57d886b7908e17cba78701e2c5ad98438
                                                • Instruction Fuzzy Hash: D4110C31704300A7F730AA2A9C84B25B798EBD0794F144856FA02A7392DBB4FC909655
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047537F5 Relevance: .1, Instructions: 57COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 87%
                                                			E047537F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04732280(_t6, 0x4808550);
				}
				_t29 = E0475387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0472FFB0(0x4808550, _t27, 0x4808550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}











                                                0x047537fa
                                                0x047537fc
                                                0x04753805
                                                0x04753808
                                                0x04753808
                                                0x04753814
                                                0x04753818
                                                0x04753846
                                                0x04753848
                                                0x0475384b
                                                0x0475384b
                                                0x04753852
                                                0x00000000
                                                0x04753854
                                                0x04753856
                                                0x00000000
                                                0x00000000
                                                0x04753863
                                                0x00000000
                                                0x04753863
                                                0x0475381a
                                                0x0475381a
                                                0x0475381f
                                                0x0475386e
                                                0x0475386e
                                                0x04753871
                                                0x04753873
                                                0x04753873
                                                0x04753868
                                                0x00000000
                                                0x04753868
                                                0x04753821
                                                0x04753826
                                                0x00000000
                                                0x00000000
                                                0x04753828
                                                0x0475382a
                                                0x04753841
                                                0x00000000
                                                0x04753841

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e024ba43c0a5fcabae1b7b21e5d5e64685937ee386e34b77febcdcdc14200e37
                                                • Instruction ID: 568b28645305eb6aae97b785b65b6c9457cf964fc27e280a340e06fc8c80be50
                                                • Opcode Fuzzy Hash: e024ba43c0a5fcabae1b7b21e5d5e64685937ee386e34b77febcdcdc14200e37
                                                • Instruction Fuzzy Hash: E10126B2A01A509BD33F8B5AD900E26BBA6DF85B917154069EC058F331DB70F800C7A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471C962 Relevance: .1, Instructions: 57COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 42%
                                                			E0471C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x480d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0472EEF0(0x48070a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E0479F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0472EB70(_t29, 0x48070a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0475B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E0479F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x48070c0; // 0x0
					while(_t38 != 0x48070c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x480b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}


















                                                0x0471c96a
                                                0x0471c974
                                                0x0471c988
                                                0x0471c98a
                                                0x04787c9d
                                                0x04787c9f
                                                0x04787ca4
                                                0x04787cae
                                                0x04787cf0
                                                0x04787cf5
                                                0x04787cfa
                                                0x0471c992
                                                0x0471c996
                                                0x0471c997
                                                0x0471c998
                                                0x0471c9a3
                                                0x0471c9a3
                                                0x04787cb0
                                                0x04787cb7
                                                0x04787cbb
                                                0x00000000
                                                0x00000000
                                                0x04787cbd
                                                0x04787ce8
                                                0x04787cc5
                                                0x04787cc8
                                                0x04787cca
                                                0x04787cd0
                                                0x04787cd6
                                                0x04787cde
                                                0x04787ce4
                                                0x04787ce4
                                                0x04787cd0
                                                0x00000000
                                                0x04787ce8
                                                0x0471c990
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 96aca653c0ca56d66339f79582993b56fccccb6ac885830d2fc968d5e01b3ef6
                                                • Instruction ID: f2cbc021ad02b4146a0a767f5e3623072e5fe58dc5ee3582c728f4d50254892a
                                                • Opcode Fuzzy Hash: 96aca653c0ca56d66339f79582993b56fccccb6ac885830d2fc968d5e01b3ef6
                                                • Instruction Fuzzy Hash: B71125327106029BD754BF69DC85A2B77E9FB94214B100A2CE842C3750EB64FC44D7C1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474002D Relevance: .1, Instructions: 55COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0474002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04737D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04737D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04737D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04737D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}








                                                0x04740032
                                                0x04740037
                                                0x04740043
                                                0x04784b3a
                                                0x04740049
                                                0x04740049
                                                0x04740049
                                                0x0474004e
                                                0x04740053
                                                0x04784b48
                                                0x04784b5a
                                                0x04784b4a
                                                0x04784b53
                                                0x04784b53
                                                0x04784b5f
                                                0x00000000
                                                0x04784b61
                                                0x00000000
                                                0x04784b61
                                                0x04740059
                                                0x04740059
                                                0x04740060
                                                0x04784b6f
                                                0x04784b6f
                                                0x04740069
                                                0x04784b83
                                                0x00000000
                                                0x00000000
                                                0x04784b90
                                                0x04784b9b
                                                0x04784b9b
                                                0x04784ba4
                                                0x00000000
                                                0x00000000
                                                0x04784baa
                                                0x00000000
                                                0x0474006f
                                                0x0474006f
                                                0x00000000
                                                0x0474006f
                                                0x04740069

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                                • Instruction ID: 12bef137b18ae2224a8cea25d85e69e3a51b3e257bdc5aa7a48fc3b353dc24b7
                                                • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                                • Instruction Fuzzy Hash: DD1108723416C28FE722AB29CD48B353BD4AFC0758F0904A4DE04877A2F368F841D250
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472766D Relevance: .1, Instructions: 54COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 94%
                                                			E0472766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0474F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0474F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04734620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}










                                                0x04727672
                                                0x0472767f
                                                0x04727689
                                                0x047276de
                                                0x047276de
                                                0x0472768b
                                                0x04727691
                                                0x04727693
                                                0x04727697
                                                0x00000000
                                                0x04727699
                                                0x047276a8
                                                0x00000000
                                                0x047276aa
                                                0x047276ad
                                                0x047276b1
                                                0x00000000
                                                0x047276b3
                                                0x047276b3
                                                0x047276b5
                                                0x047276ba
                                                0x047276bc
                                                0x047276bc
                                                0x047276c0
                                                0x00000000
                                                0x047276c2
                                                0x047276ce
                                                0x047276ce
                                                0x047276c0
                                                0x047276b1
                                                0x047276a8
                                                0x04727697
                                                0x047276d9

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                                • Instruction ID: ce9d8833e1749c395979cfafa48302928c261e9068df395d92b59ce3cb9320bc
                                                • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                                • Instruction Fuzzy Hash: F4018432700129AFD724AE9ECF85E6B77ADEB84760F240564B918DB350DA30EE1197A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047AC450 Relevance: .1, Instructions: 53COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 46%
                                                			E047AC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04759910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E047595B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E047595D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E047595D0();
				return L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}






                                                0x047ac458
                                                0x047ac45d
                                                0x047ac466
                                                0x047ac468
                                                0x047ac469
                                                0x047ac46a
                                                0x047ac46b
                                                0x047ac46e
                                                0x047ac46f
                                                0x047ac471
                                                0x047ac476
                                                0x047ac476
                                                0x047ac47c
                                                0x047ac47e
                                                0x047ac480
                                                0x047ac480
                                                0x047ac483
                                                0x047ac484
                                                0x047ac486
                                                0x047ac488
                                                0x047ac48f
                                                0x047ac491
                                                0x047ac493
                                                0x047ac493
                                                0x047ac48f
                                                0x047ac498
                                                0x047ac49e
                                                0x047ac4ad
                                                0x047ac4ad
                                                0x047ac4b2
                                                0x047ac4b4
                                                0x047ac4cd

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                                • Instruction ID: 99cadee17fede3105eb20f781fe31f483f820d539a83c82f3f6b092ef60dc44a
                                                • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                                • Instruction Fuzzy Hash: 270180B2140609FFE626AF65CC84E62BB6DFB94395F004525F614566A0CB61BCA0CAE4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04719080 Relevance: .1, Instructions: 53COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 69%
                                                			E04719080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x48085ec;
				E04732280(_t48, 0x48085ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0472FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x480538c; // 0x776f68c8
					if( *_t84 != 0x4805388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x47ef6e8);
						E0476D0E8(0x48085ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E047E88F5(_t80, _t85, 0x4805388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x48086c0; // 0x2ac07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x48086b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04732280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E047E88F5(0x48085ec, _t85, 0x4805388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0475AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x480b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x48084c0;
																			if(_t82 >=  *0x48084c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E047E9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0471922A(_t99);
										_t64 = E04737D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E047E8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x48086c0; // 0x2ac07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x48086b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x48086bc;
													_t87 = 0x48086b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04719240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x48086c4;
												_t87 = 0x48086c0;
												L27:
												E04749B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0476D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4805388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x480538c = _t51;
						goto L6;
					}
				}
			}




















                                                0x04719082
                                                0x04719083
                                                0x04719084
                                                0x04719085
                                                0x04719087
                                                0x04719096
                                                0x04719098
                                                0x04719098
                                                0x0471909e
                                                0x047190a8
                                                0x047190e7
                                                0x047190e7
                                                0x047190aa
                                                0x047190b0
                                                0x047190b7
                                                0x047190bd
                                                0x047190dd
                                                0x047190e6
                                                0x047190bf
                                                0x047190bf
                                                0x047190c7
                                                0x047190cf
                                                0x047190f1
                                                0x047190f2
                                                0x047190f4
                                                0x047190f5
                                                0x047190f6
                                                0x047190f7
                                                0x047190f8
                                                0x047190f9
                                                0x047190fa
                                                0x047190fb
                                                0x047190fc
                                                0x047190fd
                                                0x047190fe
                                                0x047190ff
                                                0x04719100
                                                0x04719102
                                                0x04719107
                                                0x0471910c
                                                0x04719110
                                                0x04719113
                                                0x04719115
                                                0x04719136
                                                0x0471913f
                                                0x04719143
                                                0x047737e4
                                                0x047737e4
                                                0x04719117
                                                0x04719117
                                                0x0471911d
                                                0x00000000
                                                0x0471911f
                                                0x0471911f
                                                0x04719125
                                                0x00000000
                                                0x04719127
                                                0x0471912d
                                                0x04719130
                                                0x04719134
                                                0x04719158
                                                0x0471915d
                                                0x04719161
                                                0x04719168
                                                0x04773715
                                                0x0471916e
                                                0x0471916e
                                                0x04719175
                                                0x04719177
                                                0x0471917e
                                                0x0471917f
                                                0x04719182
                                                0x04719182
                                                0x04719187
                                                0x04719187
                                                0x0471918a
                                                0x0471918d
                                                0x0471918f
                                                0x04719192
                                                0x04719195
                                                0x04719198
                                                0x04719198
                                                0x04719198
                                                0x0471919a
                                                0x00000000
                                                0x00000000
                                                0x0477371f
                                                0x04773721
                                                0x04773727
                                                0x0477372f
                                                0x04773733
                                                0x04773735
                                                0x04773738
                                                0x0477373b
                                                0x0477373d
                                                0x04773740
                                                0x00000000
                                                0x04773746
                                                0x04773746
                                                0x04773749
                                                0x00000000
                                                0x0477374f
                                                0x0477374f
                                                0x04773751
                                                0x04773757
                                                0x04773759
                                                0x0477375c
                                                0x0477375c
                                                0x0477375e
                                                0x0477375e
                                                0x04773761
                                                0x04773764
                                                0x00000000
                                                0x00000000
                                                0x04773766
                                                0x04773768
                                                0x047737a3
                                                0x047737a3
                                                0x047737a5
                                                0x047737a7
                                                0x047737ad
                                                0x047737b0
                                                0x047737b2
                                                0x047737bc
                                                0x047737c2
                                                0x047737c2
                                                0x047737b2
                                                0x04719187
                                                0x04719187
                                                0x0471918a
                                                0x0471918d
                                                0x0471918f
                                                0x04719192
                                                0x04719195
                                                0x00000000
                                                0x04719195
                                                0x00000000
                                                0x0477376a
                                                0x0477376a
                                                0x0477376a
                                                0x0477376c
                                                0x0477376c
                                                0x0477376f
                                                0x04773775
                                                0x00000000
                                                0x00000000
                                                0x04773777
                                                0x04773779
                                                0x04773782
                                                0x04773787
                                                0x04773789
                                                0x04773790
                                                0x04773790
                                                0x0477378b
                                                0x0477378b
                                                0x0477378b
                                                0x04773792
                                                0x04773795
                                                0x00000000
                                                0x04773795
                                                0x00000000
                                                0x04773779
                                                0x04773798
                                                0x00000000
                                                0x04773798
                                                0x00000000
                                                0x04773768
                                                0x0477379b
                                                0x0477379b
                                                0x04773751
                                                0x04773749
                                                0x00000000
                                                0x04773740
                                                0x047191a0
                                                0x047191a3
                                                0x047191a9
                                                0x047191b0
                                                0x00000000
                                                0x047191b0
                                                0x04719187
                                                0x047191b4
                                                0x047191b4
                                                0x047191bb
                                                0x047191c0
                                                0x047191c5
                                                0x047191c7
                                                0x047737da
                                                0x047191cd
                                                0x047191cd
                                                0x047191cd
                                                0x047191d2
                                                0x047191d5
                                                0x04719239
                                                0x04719239
                                                0x047191d7
                                                0x047191db
                                                0x047191e1
                                                0x047191e7
                                                0x047191fd
                                                0x04719203
                                                0x0471921e
                                                0x04719223
                                                0x00000000
                                                0x04719205
                                                0x04719205
                                                0x04719208
                                                0x0471920c
                                                0x04719214
                                                0x04719214
                                                0x0471920c
                                                0x047191e9
                                                0x047191e9
                                                0x047191ee
                                                0x047191f3
                                                0x047191f3
                                                0x047191f3
                                                0x047191e7
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04719134
                                                0x04719125
                                                0x0471911d
                                                0x0471914e
                                                0x047190d1
                                                0x047190d1
                                                0x047190d3
                                                0x047190d6
                                                0x047190d8
                                                0x00000000
                                                0x047190d8
                                                0x047190cf

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5602a31bf75bdf80b86cf416265b6bb9e75355923a23265f06f0d41b733fd1bc
                                                • Instruction ID: f6c4e6d1934b87fc3bf73919c4343e4a9b083f62f7e0993c9edd980f07a23b80
                                                • Opcode Fuzzy Hash: 5602a31bf75bdf80b86cf416265b6bb9e75355923a23265f06f0d41b733fd1bc
                                                • Instruction Fuzzy Hash: BE01D1F26112059FE3149F0CD840B2177A9EF46724F224866E205DB7A1C274FC82CBA0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E4015 Relevance: .0, Instructions: 49COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 86%
                                                			E047E4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04732280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04732280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x48086ac);
					E0471F900(0x48086d4, _t28);
					E0472FFB0(0x48086ac, _t28, 0x48086ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0472FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}







                                                0x047e401a
                                                0x047e401e
                                                0x047e4023
                                                0x047e4028
                                                0x047e4029
                                                0x047e402b
                                                0x047e402f
                                                0x047e4043
                                                0x047e4046
                                                0x047e4051
                                                0x047e4057
                                                0x047e405f
                                                0x047e4062
                                                0x047e4067
                                                0x047e406f
                                                0x047e407c
                                                0x047e407c
                                                0x047e408c
                                                0x047e408c
                                                0x047e4097

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4440291e6c11942e4ed0c5c103d76cd4770ca020f3842df71f2a17ef3a71b88e
                                                • Instruction ID: c83e3e8696bf01ad20484e15e9c94ceb0f36a1d7bfb1aa4fb401c502d7ba89a3
                                                • Opcode Fuzzy Hash: 4440291e6c11942e4ed0c5c103d76cd4770ca020f3842df71f2a17ef3a71b88e
                                                • Instruction Fuzzy Hash: F4018F72201A457FE351BB69CE88E13B7ACFB49668B010A65F508C7B52CB24FC51CAE4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D14FB Relevance: .0, Instructions: 48COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 61%
                                                			E047D14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x480d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0475FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04737D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0475B640(E04759AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                                0x047d14fb
                                                0x047d14fb
                                                0x047d150a
                                                0x047d1514
                                                0x047d1519
                                                0x047d151b
                                                0x047d1526
                                                0x047d152c
                                                0x047d1534
                                                0x047d1537
                                                0x047d153a
                                                0x047d1545
                                                0x047d1557
                                                0x047d1547
                                                0x047d1550
                                                0x047d1550
                                                0x047d1562
                                                0x047d1563
                                                0x047d1565
                                                0x047d156a
                                                0x047d157f

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 78986b3b928cb7a65c742f49e1c1559eec40d6172df2cb1d65b910b815775012
                                                • Instruction ID: e9820561f360b02de9465da70065a12d9e658e3ae14caca4fd194cd8d62f527e
                                                • Opcode Fuzzy Hash: 78986b3b928cb7a65c742f49e1c1559eec40d6172df2cb1d65b910b815775012
                                                • Instruction Fuzzy Hash: DF019271E10248AFDB14DFA9D845EAEB7B8EF44710F404056F905EB390D674EA00CB94
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D138A Relevance: .0, Instructions: 48COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 61%
                                                			E047D138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x480d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0475FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04737D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0475B640(E04759AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                                0x047d138a
                                                0x047d138a
                                                0x047d1399
                                                0x047d13a3
                                                0x047d13a8
                                                0x047d13aa
                                                0x047d13b5
                                                0x047d13bb
                                                0x047d13c3
                                                0x047d13c6
                                                0x047d13c9
                                                0x047d13d4
                                                0x047d13e6
                                                0x047d13d6
                                                0x047d13df
                                                0x047d13df
                                                0x047d13f1
                                                0x047d13f2
                                                0x047d13f4
                                                0x047d13f9
                                                0x047d140e

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 469b7e5e5e506363a1da0ad11e2c479a6e76dbf565855530e2fde7ebf3141f5c
                                                • Instruction ID: 6ff4c8303273afbf5187c085c76ff773bbe63cd8a90523ddc064002dea11801b
                                                • Opcode Fuzzy Hash: 469b7e5e5e506363a1da0ad11e2c479a6e76dbf565855530e2fde7ebf3141f5c
                                                • Instruction Fuzzy Hash: 15015271E10258AFDB14DFA9D845EAEB7B8EF44710F404056F904EB390E674AA41C795
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047158EC Relevance: .0, Instructions: 47COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 91%
                                                			E047158EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x480d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x46f5c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E04715943() != 0 &&  *0x4805320 > 5) {
					E04797B5E( &_v44, _t27);
					_t22 =  &_v28;
					E04797B5E( &_v28, _t28);
					_t11 = E04797B9C(0x4805320, 0x46fbf15,  &_v28, _t22, 4,  &_v76);
				}
				return E0475B640(_t11, _t17, _v8 ^ _t29, 0x46fbf15, _t27, _t28);
			}















                                                0x047158fb
                                                0x047158fe
                                                0x04715906
                                                0x0471590a
                                                0x0471593c
                                                0x0471593c
                                                0x0471590c
                                                0x0471590c
                                                0x04715911
                                                0x00000000
                                                0x04715913
                                                0x04715913
                                                0x04715913
                                                0x04715911
                                                0x0471591d
                                                0x04771035
                                                0x0477103c
                                                0x0477103f
                                                0x04771056
                                                0x04771056
                                                0x0471593b

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a902ef98eec52e40753cd558beac1bba3ecea24c132bef725cbbdd1b47d88257
                                                • Instruction ID: 4bcbd903ca8b7f8ffeae9f02ed8abbf250cdfaf912c5c7b1047d5f928b741185
                                                • Opcode Fuzzy Hash: a902ef98eec52e40753cd558beac1bba3ecea24c132bef725cbbdd1b47d88257
                                                • Instruction Fuzzy Hash: 1D018471A10104EBEB1CDE6DDC049AE77E8EB80634F9540699905A7360EE20FD05C691
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047CFE3F Relevance: .0, Instructions: 46COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 59%
                                                			E047CFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x480d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0475FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04737D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0475B640(E04759AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                0x047cfe3f
                                                0x047cfe3f
                                                0x047cfe4e
                                                0x047cfe58
                                                0x047cfe5d
                                                0x047cfe5f
                                                0x047cfe6a
                                                0x047cfe72
                                                0x047cfe75
                                                0x047cfe78
                                                0x047cfe83
                                                0x047cfe95
                                                0x047cfe85
                                                0x047cfe8e
                                                0x047cfe8e
                                                0x047cfea0
                                                0x047cfea1
                                                0x047cfea3
                                                0x047cfea8
                                                0x047cfebd

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 987c3e75ca4884664d24c0214b346660e8db9726954046136504c3744523fe65
                                                • Instruction ID: 447747574a36d0371825fe343eeb5b6306149f846b29e6a1779b0a303c214a78
                                                • Opcode Fuzzy Hash: 987c3e75ca4884664d24c0214b346660e8db9726954046136504c3744523fe65
                                                • Instruction Fuzzy Hash: 58018471E00258ABDB14DFA9D845FAEB7B8EF44714F00406AF900EB391DA74AA01C7A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047CFEC0 Relevance: .0, Instructions: 46COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 59%
                                                			E047CFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x480d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0475FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04737D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0475B640(E04759AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                0x047cfec0
                                                0x047cfec0
                                                0x047cfecf
                                                0x047cfed9
                                                0x047cfede
                                                0x047cfee0
                                                0x047cfeeb
                                                0x047cfef3
                                                0x047cfef6
                                                0x047cfef9
                                                0x047cff04
                                                0x047cff16
                                                0x047cff06
                                                0x047cff0f
                                                0x047cff0f
                                                0x047cff21
                                                0x047cff22
                                                0x047cff24
                                                0x047cff29
                                                0x047cff3e

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4584b9838e1df9beea9a7f9c78318839408ed34e7ec5ca913f3e42f12d70ee97
                                                • Instruction ID: bfe4f0242a4a2f16270d306a81d20fa8e5daba2287259e5c8fc1603766bfe4ae
                                                • Opcode Fuzzy Hash: 4584b9838e1df9beea9a7f9c78318839408ed34e7ec5ca913f3e42f12d70ee97
                                                • Instruction Fuzzy Hash: 9F018471E00208ABDB14DBA9D845FAEB7B8EF45714F40406AF900EB390EA74AA01C795
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E1074 Relevance: .0, Instructions: 46COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047E1074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E047E165E(__ebx, 0x4808ae4, (__edx -  *0x4808b04 >> 0x14) + (__edx -  *0x4808b04 >> 0x14), __edi, __ecx, (__edx -  *0x4808b04 >> 0x14) + (__edx -  *0x4808b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E047DAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04737D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E047CFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}











                                                0x047e1074
                                                0x047e1080
                                                0x047e1082
                                                0x047e108a
                                                0x047e108f
                                                0x047e1093
                                                0x047e10ab
                                                0x047e10ab
                                                0x047e10c3
                                                0x047e10cf
                                                0x047e10e1
                                                0x047e10d1
                                                0x047e10da
                                                0x047e10da
                                                0x047e10e9
                                                0x047e10f5
                                                0x047e10f5
                                                0x047e10fe

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: eca7e5e2316a0d9caa3416279f4dc4fde59ef5a9ff240fca748cffe16b69f7fc
                                                • Instruction ID: 91085c7eca49a426a1e0464f62f557a0ac23a0bfc9e4baecf34f4aa95ea5c573
                                                • Opcode Fuzzy Hash: eca7e5e2316a0d9caa3416279f4dc4fde59ef5a9ff240fca748cffe16b69f7fc
                                                • Instruction Fuzzy Hash: E60124726047459BD710EB2AC845B2A77E5EB88314F44CA29F88593790EE34F984CB92
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472B02A Relevance: .0, Instructions: 46COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0472B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04737D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E04797016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}







                                                0x0472b037
                                                0x0472b039
                                                0x0472b03b
                                                0x0472b040
                                                0x0477a60e
                                                0x00000000
                                                0x00000000
                                                0x0477a61d
                                                0x0472b04b
                                                0x0472b04e
                                                0x0477a627
                                                0x0477a634
                                                0x00000000
                                                0x00000000
                                                0x0477a641
                                                0x0477a653
                                                0x0477a643
                                                0x0477a64c
                                                0x0477a64c
                                                0x0477a65b
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0477a66c
                                                0x0472b057
                                                0x0472b057
                                                0x0472b057
                                                0x0472b046
                                                0x0472b046
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                                • Instruction ID: 496277a4545eec8f2f2a905c517301b270ab97375dd01bb97fd8c64d7db19d47
                                                • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                                • Instruction Fuzzy Hash: 47017171300584DFE726CB5DC988F6A77E8EB45754F0944A1E915CB751E628FC40C621
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8ED6 Relevance: .0, Instructions: 44COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 54%
                                                			E047E8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x480d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04737D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0475B640(E04759AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}


















                                                0x047e8ed6
                                                0x047e8ee5
                                                0x047e8eed
                                                0x047e8ef0
                                                0x047e8efa
                                                0x047e8f03
                                                0x047e8f0c
                                                0x047e8f15
                                                0x047e8f24
                                                0x047e8f27
                                                0x047e8f31
                                                0x047e8f43
                                                0x047e8f33
                                                0x047e8f3c
                                                0x047e8f3c
                                                0x047e8f4e
                                                0x047e8f4f
                                                0x047e8f51
                                                0x047e8f56
                                                0x047e8f69

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d47435ebbbbcc80166216f89f23135fe42c6163743018946854c92f6d1d82048
                                                • Instruction ID: 54bdd75ff97755106c2de664c3b4c2cf8c6d673e00d68bd16d6e7b84161a3b78
                                                • Opcode Fuzzy Hash: d47435ebbbbcc80166216f89f23135fe42c6163743018946854c92f6d1d82048
                                                • Instruction Fuzzy Hash: BC1112B0E002099FD704DFA9D445BADF7F4FF08300F0442AAE918EB351E634A940CB90
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8A62 Relevance: .0, Instructions: 44COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 54%
                                                			E047E8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x480d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04737D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0475B640(E04759AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                0x047e8a62
                                                0x047e8a71
                                                0x047e8a79
                                                0x047e8a82
                                                0x047e8a85
                                                0x047e8a89
                                                0x047e8a8c
                                                0x047e8a8f
                                                0x047e8a92
                                                0x047e8a95
                                                0x047e8a9f
                                                0x047e8ab1
                                                0x047e8aa1
                                                0x047e8aaa
                                                0x047e8aaa
                                                0x047e8abc
                                                0x047e8abd
                                                0x047e8abf
                                                0x047e8ac4
                                                0x047e8ada

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c14f3d9ce3437a72e21b541468de8b57da3ab7eb3545b135737a35e5c1d3f042
                                                • Instruction ID: be2f2748747e6c46e2a46db1ea07768952075300a15a8f8981d4dd37138d7512
                                                • Opcode Fuzzy Hash: c14f3d9ce3437a72e21b541468de8b57da3ab7eb3545b135737a35e5c1d3f042
                                                • Instruction Fuzzy Hash: 94012CB1A0021CAFDB04DFA9D9459AEB7B8EF48310F10405AF904EB351E774A900CBA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471DB60 Relevance: .0, Instructions: 43COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0471DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0471DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0471E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0471E8B0(__ecx, _t14, 0xfff);
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}







                                                0x0471db64
                                                0x0471db66
                                                0x0471db6b
                                                0x0471dbaa
                                                0x0471db71
                                                0x0471db76
                                                0x0471db7a
                                                0x0471dba3
                                                0x0471db7c
                                                0x0471db87
                                                0x0471db8b
                                                0x04774fa1
                                                0x04774fb3
                                                0x04774fb8
                                                0x0471db91
                                                0x0471db96
                                                0x0471db98
                                                0x0471db98
                                                0x0471db8b
                                                0x0471db7a
                                                0x0471db9d
                                                0x0471dba2

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                                • Instruction ID: d9479656f12ac646796931ebc72362cf90f4de9e20671751eb1181772fd71bf9
                                                • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                                • Instruction Fuzzy Hash: 0EF0FC732015229FE7735A5D4884F27B69A8FC1B60F150035F5069B364CA60BC029AD0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471B1E1 Relevance: .0, Instructions: 42COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0471B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04737D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04737D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E04797016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}






                                                0x0471b1e8
                                                0x0471b1ea
                                                0x0471b1f3
                                                0x04774a17
                                                0x0471b1f9
                                                0x0471b1f9
                                                0x0471b1f9
                                                0x0471b201
                                                0x04774a21
                                                0x04774a2e
                                                0x00000000
                                                0x00000000
                                                0x04774a3b
                                                0x04774a4d
                                                0x04774a3d
                                                0x04774a46
                                                0x04774a46
                                                0x04774a55
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0471b20a
                                                0x0471b20a
                                                0x0471b20a
                                                0x0471b20a

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                                • Instruction ID: 9677a54c48d45a1bf70857562e0b78d4fe26032cd431c83cca8921a55b746706
                                                • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                                • Instruction Fuzzy Hash: 55018132300684EBD736976ED908F69BB99EF81754F4A40A2F9148B7B2E679F800D215
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047AFE87 Relevance: .0, Instructions: 38COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 46%
                                                			E047AFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x480d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04737D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0475B640(E04759AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}
















                                                0x047afe96
                                                0x047afe9e
                                                0x047afea1
                                                0x047afead
                                                0x047afeb3
                                                0x047afeb9
                                                0x047afec3
                                                0x047afed5
                                                0x047afec5
                                                0x047afece
                                                0x047afece
                                                0x047afee0
                                                0x047afee1
                                                0x047afee3
                                                0x047afee8
                                                0x047afefb

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8c75cddeec6d7a048018f09ad32f8e378363b503d5b3e60bc34e103f96e86120
                                                • Instruction ID: fdbd01febdbab5fa3fa7c2e53f005951c6abbec06d9f36c18c5974b96e175774
                                                • Opcode Fuzzy Hash: 8c75cddeec6d7a048018f09ad32f8e378363b503d5b3e60bc34e103f96e86120
                                                • Instruction Fuzzy Hash: 38016270A0420CEFCB14DFA8D545A6EB7F4EF04304F14415AE904DB392E635E911CB50
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8F6A Relevance: .0, Instructions: 36COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 48%
                                                			E047E8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x480d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04737D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0475B640(E04759AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                                0x047e8f6a
                                                0x047e8f79
                                                0x047e8f81
                                                0x047e8f84
                                                0x047e8f8b
                                                0x047e8f91
                                                0x047e8f94
                                                0x047e8f9e
                                                0x047e8fb0
                                                0x047e8fa0
                                                0x047e8fa9
                                                0x047e8fa9
                                                0x047e8fbb
                                                0x047e8fbc
                                                0x047e8fbe
                                                0x047e8fc3
                                                0x047e8fd6

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b8f688a222658c70c3582181ee7783a8c9b2d7b50155f959f2f87f388e0b83e9
                                                • Instruction ID: 0a9edfd016ebcd913cc112cb7244041e4746202f6e0f2de665231e87a64fdf31
                                                • Opcode Fuzzy Hash: b8f688a222658c70c3582181ee7783a8c9b2d7b50155f959f2f87f388e0b83e9
                                                • Instruction Fuzzy Hash: F90144B4E0020CAFDB04EFA9D545AAEB7F4EF08300F508459B905EB391EB74EA00CB95
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D131B Relevance: .0, Instructions: 36COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 48%
                                                			E047D131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x480d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04737D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0475B640(E04759AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                                0x047d131b
                                                0x047d132a
                                                0x047d1330
                                                0x047d1336
                                                0x047d133e
                                                0x047d1341
                                                0x047d1344
                                                0x047d134f
                                                0x047d1361
                                                0x047d1351
                                                0x047d135a
                                                0x047d135a
                                                0x047d136c
                                                0x047d136d
                                                0x047d136f
                                                0x047d1374
                                                0x047d1387

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5c0d94f21e5e3fac2fe100084726089ecf0ecd55fdda6759cd773623cdfff984
                                                • Instruction ID: 441f9783c6b896253f7fb21713d89784873862b6589a8837202dc6211ea2be35
                                                • Opcode Fuzzy Hash: 5c0d94f21e5e3fac2fe100084726089ecf0ecd55fdda6759cd773623cdfff984
                                                • Instruction Fuzzy Hash: FF0119B1A11208AFDB04EFA9D549AAEB7F4EF08700F40805AF945EB391E674AA00CB54
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D1608 Relevance: .0, Instructions: 34COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 46%
                                                			E047D1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x480d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E04737D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E0475B640(E04759AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}














                                                0x047d1608
                                                0x047d1617
                                                0x047d161d
                                                0x047d1625
                                                0x047d1628
                                                0x047d162b
                                                0x047d1636
                                                0x047d1648
                                                0x047d1638
                                                0x047d1641
                                                0x047d1641
                                                0x047d1653
                                                0x047d1654
                                                0x047d1656
                                                0x047d165b
                                                0x047d166e

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: ca9bed56a3c44c2c314bb7ceec088916566fa721dd8750e0d32ae07c8682bf34
                                                • Instruction ID: abcc73e9964d462fd7c50477424373010231cca609a9e94660292c75f6fa1d1e
                                                • Opcode Fuzzy Hash: ca9bed56a3c44c2c314bb7ceec088916566fa721dd8750e0d32ae07c8682bf34
                                                • Instruction Fuzzy Hash: 61F062B1E14248EFDB14DFA9D845A6EB7F4EF04300F444069F905EB391EA74A900CB54
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473C577 Relevance: .0, Instructions: 33COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0473C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0473C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x46f11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E047E88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}









                                                0x0473c577
                                                0x0473c57d
                                                0x0473c581
                                                0x0473c5b5
                                                0x0473c5b9
                                                0x0473c5ce
                                                0x0473c5ce
                                                0x0473c5ca
                                                0x00000000
                                                0x0473c5ca
                                                0x0473c5c4
                                                0x0473c5c8
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0473c5ad
                                                0x00000000
                                                0x0473c5af

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 721eb317fe018e04e3ac59bd8cc508d43128659c2f7c4a9a4bfa5adfc4c5427d
                                                • Instruction ID: 86528a7baf1e842df332e1e7118dc667e7f39525bdd2cc1c41540557a256ae58
                                                • Opcode Fuzzy Hash: 721eb317fe018e04e3ac59bd8cc508d43128659c2f7c4a9a4bfa5adfc4c5427d
                                                • Instruction Fuzzy Hash: B2F02EB39152908FE733EF28C008B227BE89B05372F748467D446B3303C2A0F880C261
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8D34 Relevance: .0, Instructions: 32COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 43%
                                                			E047E8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x480d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04737D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0475B640(E04759AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}













                                                0x047e8d34
                                                0x047e8d43
                                                0x047e8d4b
                                                0x047e8d4e
                                                0x047e8d52
                                                0x047e8d5c
                                                0x047e8d6e
                                                0x047e8d5e
                                                0x047e8d67
                                                0x047e8d67
                                                0x047e8d79
                                                0x047e8d7a
                                                0x047e8d7c
                                                0x047e8d81
                                                0x047e8d94

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 06c0f65c1cecedb5d090290ad2e5c389cdf9171749e40810bd9d3d59a364343c
                                                • Instruction ID: 5fd4f73e62d5cf74e6c6b3da2a8f8a8869b8a192e71cb5022a1cc0333fefab69
                                                • Opcode Fuzzy Hash: 06c0f65c1cecedb5d090290ad2e5c389cdf9171749e40810bd9d3d59a364343c
                                                • Instruction Fuzzy Hash: 27F090B0E046089FD714EBA9D445A6EB7B4EB08300F508099E905EB391EA34E900C754
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047D2073 Relevance: .0, Instructions: 32COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 94%
                                                			E047D2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E047CFD22(__ecx);
				_t19 =  *0x480849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4808748; // 0x0
					if(__eflags <= 0) {
						E047D1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4808724 & 0x00000004;
							if(( *0x4808724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4808724; // 0x0
					return E047C8DF1(__ebx, 0xc0000374, 0x4805890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}







                                                0x047d2076
                                                0x047d2078
                                                0x047d207d
                                                0x047d2083
                                                0x047d20a4
                                                0x047d20aa
                                                0x047d20ac
                                                0x047d20b7
                                                0x047d20ba
                                                0x047d20bc
                                                0x047d20c9
                                                0x047d20c9
                                                0x047d20d0
                                                0x047d20d2
                                                0x00000000
                                                0x047d20d2
                                                0x047d20be
                                                0x047d20c3
                                                0x047d20c5
                                                0x047d20c7
                                                0x00000000
                                                0x00000000
                                                0x047d20c7
                                                0x047d20bc
                                                0x047d20d4
                                                0x047d2085
                                                0x047d2085
                                                0x047d20a3
                                                0x047d20a3

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 33b394baa1d3e6a4bd8ab725f73481698303658be5108f9153736ec4be0bdd16
                                                • Instruction ID: 1975b43a67ef0e42aba2b10e7383730d27a042155d94d6695a97d202d1595900
                                                • Opcode Fuzzy Hash: 33b394baa1d3e6a4bd8ab725f73481698303658be5108f9153736ec4be0bdd16
                                                • Instruction Fuzzy Hash: C6F0A02A4361844AEFB2BF2565152E22BE5D745218B0E1CC9D8906770AC638ECC3DB25
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475927A Relevance: .0, Instructions: 32COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 54%
                                                			E0475927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0475FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E047592C6(_t11, _t14);
				}
				return _t11;
			}





                                                0x04759295
                                                0x04759299
                                                0x0475929f
                                                0x047592aa
                                                0x047592ad
                                                0x047592ae
                                                0x047592af
                                                0x047592b0
                                                0x047592b4
                                                0x047592bb
                                                0x047592bb
                                                0x047592c5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                                • Instruction ID: 39a7d49a5a861d4103c3b58d980541d3bccd83842e90883e2d0310c850869b83
                                                • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                                • Instruction Fuzzy Hash: A5E09B723405406BE7219E55DC84F57775DDF82725F044079F9045F352C6E5ED0987A0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0473746D Relevance: .0, Instructions: 31COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 88%
                                                			E0473746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0472EB70(__ecx, 0x48079a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E047595D0();
							L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}









                                                0x0473746d
                                                0x0473746d
                                                0x0473746d
                                                0x04737471
                                                0x04737488
                                                0x0477f92d
                                                0x0473748e
                                                0x04737491
                                                0x04737495
                                                0x0477f937
                                                0x0477f93a
                                                0x0477f94e
                                                0x0477f953
                                                0x0477f956
                                                0x0477f956
                                                0x04737495
                                                0x00000000
                                                0x04737488
                                                0x04737473
                                                0x04737478
                                                0x0473747d
                                                0x04737481
                                                0x00000000
                                                0x04737481
                                                0x0473747d
                                                0x0473747a
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0cc1e2fbb8665764be3df14c109b8173884bab21e357d033633e03a4abaaab83
                                                • Instruction ID: e3124b8ae3706aa6e42b11d5286e7fcc63fcbbcdcc357db74b8f3ba934a7ed2b
                                                • Opcode Fuzzy Hash: 0cc1e2fbb8665764be3df14c109b8173884bab21e357d033633e03a4abaaab83
                                                • Instruction Fuzzy Hash: 91F0B4B4600184AADF099B68C940B79BB61AF04316F448615D861AF363F765B8008BC5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8CD6 Relevance: .0, Instructions: 31COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 36%
                                                			E047E8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x480d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04737D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0475B640(E04759AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                                0x047e8ce5
                                                0x047e8ced
                                                0x047e8cf0
                                                0x047e8cfb
                                                0x047e8d0d
                                                0x047e8cfd
                                                0x047e8d06
                                                0x047e8d06
                                                0x047e8d18
                                                0x047e8d19
                                                0x047e8d1b
                                                0x047e8d20
                                                0x047e8d33

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: ce5f61dad692b3f5603f0ff5b385c0b965d2220e93e0e196850bac3dca7d7f50
                                                • Instruction ID: 18458ea26f81143a6202c7e41c80e801a43fca24818e24603316d82b434a6b3f
                                                • Opcode Fuzzy Hash: ce5f61dad692b3f5603f0ff5b385c0b965d2220e93e0e196850bac3dca7d7f50
                                                • Instruction Fuzzy Hash: 68F082B0A04208AFDB04EBB9E949E6E77B4EF08304F514199E915EB391EA34F900C755
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04714F2E Relevance: .0, Instructions: 31COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04714F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E047E88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0473C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x46f1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}









                                                0x04714f2e
                                                0x04714f34
                                                0x04714f38
                                                0x04770b85
                                                0x04770b85
                                                0x04770b89
                                                0x04770b9a
                                                0x04770b9a
                                                0x04770b9f
                                                0x00000000
                                                0x04770b9f
                                                0x04770b94
                                                0x04770b98
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x04770b98
                                                0x04714f3e
                                                0x04714f48
                                                0x00000000
                                                0x04714f6e
                                                0x00000000
                                                0x04714f70

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0daa6a9be1b76be5c74c7088779dd58f1f0290d5e3c24c626788d79ad66d3b59
                                                • Instruction ID: 4023a1542ddeecd79e0b1d3d111a2deb349538ab8ee102612933eb111877f125
                                                • Opcode Fuzzy Hash: 0daa6a9be1b76be5c74c7088779dd58f1f0290d5e3c24c626788d79ad66d3b59
                                                • Instruction Fuzzy Hash: B1F0E2325216D4CFEB71DB18C984B22B7D8AB047B8F854479D80587B71C724FD40C680
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047E8B58 Relevance: .0, Instructions: 31COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 36%
                                                			E047E8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x480d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04737D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0475B640(E04759AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                                0x047e8b67
                                                0x047e8b6f
                                                0x047e8b72
                                                0x047e8b7d
                                                0x047e8b8f
                                                0x047e8b7f
                                                0x047e8b88
                                                0x047e8b88
                                                0x047e8b9a
                                                0x047e8b9b
                                                0x047e8b9d
                                                0x047e8ba2
                                                0x047e8bb5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 07251ceac62cb7fd5a005dc416c4000ddd61cfc591c340ed2a0052218cf0ae87
                                                • Instruction ID: 4f808540cf27ac29393cfcda1f121cec34994b55f0526d4eaf1a2409649dbcd5
                                                • Opcode Fuzzy Hash: 07251ceac62cb7fd5a005dc416c4000ddd61cfc591c340ed2a0052218cf0ae87
                                                • Instruction Fuzzy Hash: B9F082B0A14258ABEB14EBA9D90AE7EB3B4EF08304F450559BA05DF391FB74F900C795
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474A44B Relevance: .0, Instructions: 29COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0474A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4807b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0475FA60(_t17, 0, _t15 << 2);
				return _t17;
			}







                                                0x0474a44b
                                                0x0474a453
                                                0x0474a472
                                                0x0474a476
                                                0x00000000
                                                0x0474a493
                                                0x0474a47a
                                                0x0474a47f
                                                0x0474a486
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: ad01516f161f1d3fea594ea4f1b00fdf3c68d2d9c800ac8ca6f239ec31779ab2
                                                • Instruction ID: f73d1e79d17514e7be0872c0f78fca1dc1a75bf1b22bbacf4f1cd43869d531dc
                                                • Opcode Fuzzy Hash: ad01516f161f1d3fea594ea4f1b00fdf3c68d2d9c800ac8ca6f239ec31779ab2
                                                • Instruction Fuzzy Hash: 8EE09272A41421ABE2215E1CAC00F6A739DDBD5655F094435E904C7320D668ED01C7E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471F358 Relevance: .0, Instructions: 28COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 79%
                                                			E0471F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0474F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04734620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}






                                                0x0471f35d
                                                0x0471f361
                                                0x0471f367
                                                0x0471f372
                                                0x0471f38c
                                                0x0471f38c
                                                0x0471f394

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                                • Instruction ID: 2e58bd61740da3ac83c16be08cd0d3abf734d2361b8eb7f4de91418325692ddc
                                                • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                                • Instruction Fuzzy Hash: B0E0D832A40118FBDB319ADD9D06F6ABBACDB44B61F000155F904D7260D560AD40D6D0
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472FF60 Relevance: .0, Instructions: 22COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0472FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x46f11a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E047E88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04730050(_t14);
				}
			}










                                                0x0472ff66
                                                0x0472ff6b
                                                0x00000000
                                                0x0472ff8f
                                                0x00000000
                                                0x0472ff8f

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f962ba18382d7003e66680657a046fd2e6a315412723ea6a6d19dd7476d3d061
                                                • Instruction ID: bd2062d9daf009a1b876852831c642b4c0f8d7e6d3e2df707c9a8c8d5e375791
                                                • Opcode Fuzzy Hash: f962ba18382d7003e66680657a046fd2e6a315412723ea6a6d19dd7476d3d061
                                                • Instruction Fuzzy Hash: 45E026B0209254DFE734DF52D364F2537BCBF52725F1A841EE8084B302C621FA81E206
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047A41E8 Relevance: .0, Instructions: 21COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 82%
                                                			E047A41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x47f08f0);
				_t5 = E0476D08C(__ebx, __edi, __esi);
				if( *0x48087ec == 0) {
					E0472EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x48087ec == 0) {
						 *0x48087f0 = 0x48087ec;
						 *0x48087ec = 0x48087ec;
						 *0x48087e8 = 0x48087e4;
						 *0x48087e4 = 0x48087e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L047A4248();
				}
				return E0476D0D1(_t5);
			}





                                                0x047a41e8
                                                0x047a41ea
                                                0x047a41ef
                                                0x047a41fb
                                                0x047a4206
                                                0x047a420b
                                                0x047a4216
                                                0x047a421d
                                                0x047a4222
                                                0x047a422c
                                                0x047a4231
                                                0x047a4231
                                                0x047a4236
                                                0x047a423d
                                                0x047a423d
                                                0x047a4247

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5dcde75bce14905dfdcf6bce99ee33dedec1daecb70b5d41fdf09f3f06452990
                                                • Instruction ID: 5dad9238eb9ecd2ed3935f6b98e5074e003570ee20ab63878515618e77aae894
                                                • Opcode Fuzzy Hash: 5dcde75bce14905dfdcf6bce99ee33dedec1daecb70b5d41fdf09f3f06452990
                                                • Instruction Fuzzy Hash: B4F01C74930700CFEBE1FF669A0470436A4F789319F404A15811087388C77868C4CF05
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047CD380 Relevance: .0, Instructions: 21COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047CD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0471E8B0(__ecx, _a4, 0xfff);
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}




                                                0x047cd38a
                                                0x047cd39b
                                                0x047cd3b1
                                                0x00000000
                                                0x047cd3b6
                                                0x00000000

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                                • Instruction ID: c640c7c4c8dcf2c492dd231efadb60213848bc66e86ba2707541ba33acb76b0b
                                                • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                                • Instruction Fuzzy Hash: E2E0C231281208FBEB325E44CC00F69BB1ADB407A5F104039FE085A7A0C675BD91E6C4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0474A185 Relevance: .0, Instructions: 20COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0474A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x48067e4 >= 0xa) {
					if(_t5 < 0x4806800 || _t5 >= 0x4806900) {
						return L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04730010(0x48067e0, _t5);
				}
			}





                                                0x0474a190
                                                0x0474a1a6
                                                0x0474a1c2
                                                0x00000000
                                                0x00000000
                                                0x00000000
                                                0x0474a192
                                                0x0474a192
                                                0x0474a19f
                                                0x0474a19f

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2fbe1f83eb361ec0807fd422d561e2d3e8b8caf9f582b6770aa2fb7ad74d9ebc
                                                • Instruction ID: c78a7e284e22a4136f8a197dc280d34e32e694ce9284c4cd1d2d463feba6a904
                                                • Opcode Fuzzy Hash: 2fbe1f83eb361ec0807fd422d561e2d3e8b8caf9f582b6770aa2fb7ad74d9ebc
                                                • Instruction Fuzzy Hash: 87D05E715B10405AF66D6710AD58B352266E7C9719F308E0DF207AABE6FBA4FCF8D108
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047416E0 Relevance: .0, Instructions: 17COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047416E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04741710(0x48067e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04734620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}





                                                0x047416e8
                                                0x047416ef
                                                0x047416f3
                                                0x047416fe
                                                0x00000000
                                                0x04741700
                                                0x0474170d
                                                0x0474170d
                                                0x047416f2
                                                0x047416f2
                                                0x047416f2
                                                0x047416f2

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 1a513a5232ec59192d8ae760aa3e01cf0465231f94714fbcc79a0fa5a02e8174
                                                • Instruction ID: 5752f77f85725ca140fee5fe4bbca445dc22763f6bc9384a4455e46390888d61
                                                • Opcode Fuzzy Hash: 1a513a5232ec59192d8ae760aa3e01cf0465231f94714fbcc79a0fa5a02e8174
                                                • Instruction Fuzzy Hash: B7D0A73110010092FA2D6B149C0CB242255DBC0789F78005CF207596C1CFA0FCE2E449
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047953CA Relevance: .0, Instructions: 16COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047953CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0472EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}








                                                0x047953ca
                                                0x047953ce
                                                0x047953d9
                                                0x047953de
                                                0x047953e1
                                                0x047953e1
                                                0x047953e6
                                                0x047953f3
                                                0x00000000
                                                0x047953f8
                                                0x047953fb

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                                • Instruction ID: 11998a9eb0f4aa50c1bf7c94a4eab70322389e6399d3102686012f03f0b83919
                                                • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                                • Instruction Fuzzy Hash: 65E0E272A44684ABDF17EB99CA94F5EBBF9FB84B44F190458A4086B761C664BD00CB40
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047435A1 Relevance: .0, Instructions: 12COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047435A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0472EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}






                                                0x047435a1
                                                0x047435a1
                                                0x047435a5
                                                0x047435ab
                                                0x047435ab
                                                0x047435b5
                                                0x00000000
                                                0x047435c1
                                                0x047435b7

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                                • Instruction ID: b62e43b7695672d8188818f38c690a6446cfa1eabcef32b5997cfcf2f382023f
                                                • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                                • Instruction Fuzzy Hash: D8D0C9327511849AEB51BB74C218B78B7B2BB80318F582065984A26B56C33A6A5AD601
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0472AAB0 Relevance: .0, Instructions: 12COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0472AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}




                                                0x0472aab6
                                                0x0472aabb
                                                0x0477a442
                                                0x00000000
                                                0x0477a448
                                                0x0477a454
                                                0x0477a454
                                                0x0472aac1
                                                0x0472aac1
                                                0x0472aac6
                                                0x0472aac6

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                                • Instruction ID: 82e53766f49d3616c8f896405ae872f54917f11e8ad7c14585e9d87de555eb60
                                                • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                                • Instruction Fuzzy Hash: 4ED0E935352990DFDB26CF1DC554B1573B5BB44B84FC50490E501CBB61E62DE944CA00
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0479A537 Relevance: .0, Instructions: 11COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0479A537(intOrPtr _a4, intOrPtr _a8) {

				return L04738E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}



                                                0x0479a553

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                                • Instruction ID: d51e3425cb6ba75af6bbcde36109e0ab82f3946dde9f1e43d406eab4c23301d9
                                                • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                                • Instruction Fuzzy Hash: 26C08C33080248BBCB127F82CC00F067F6AFB94B60F018010FA080B671C632E970EB84
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471DB40 Relevance: .0, Instructions: 11COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0471DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04734620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}





                                                0x0471db4d
                                                0x0471db54
                                                0x0471db5f
                                                0x0471db56
                                                0x0471db56
                                                0x0471db5c
                                                0x0471db5c

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                                • Instruction ID: ab58a3c4c9a1b4774305aa42a22d695fbae6fb7f3802519c62f2e4e9b0f4674e
                                                • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                                • Instruction Fuzzy Hash: 54C08C30280A00AAEB361F24CD01F0036A0BB00B06F4400A06301DA0F0DB78FC02EA00
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0471AD30 Relevance: .0, Instructions: 10COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E0471AD30(intOrPtr _a4) {

				return L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}



                                                0x0471ad49

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                                • Instruction ID: b93c3a339ad827fcac6367b1a2d7ba125afe76e4936f834bd186f7e1cd327344
                                                • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                                • Instruction Fuzzy Hash: AAC08C32080248BBC7126A45CD00F017B2DE790B60F004020B6040A6628932E860D588
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047276E2 Relevance: .0, Instructions: 10COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047276E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L047377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}




                                                0x047276e4
                                                0x00000000
                                                0x047276f8
                                                0x047276fd

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                                • Instruction ID: 81a9b3c7c913c067caa5e3f8ade99f973a56dd39b96ad496ce1a00de0777ab95
                                                • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                                • Instruction Fuzzy Hash: 8BC08CB01421845AEB2E6B09CF24B203654AB08709F48019CAA02096A2C368B902C208
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047436CC Relevance: .0, Instructions: 10COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E047436CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04734620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}



                                                0x047436d2
                                                0x047436e8
                                                0x047436d4
                                                0x047436e5
                                                0x047436e5

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                                • Instruction ID: a1df75f30d2d3ecbb52890e288d5e7e82f3684369a4ff4a5075279fb5e7e075d
                                                • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                                • Instruction Fuzzy Hash: 7CC02B70250840FBF7191F30CD01F247254F740A22F6403547220496F0D629BC00D500
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04733A1C Relevance: .0, Instructions: 10COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04733A1C(intOrPtr _a4) {
				void* _t5;

				return L04734620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}




                                                0x04733a35

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                                • Instruction ID: 6c7cc2a28278a8a8205d2af80bed54d0e649a3c12ed56f7e0329fd28be31fb96
                                                • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                                • Instruction Fuzzy Hash: 6CC08C32080648BBC7126E41DC00F017B29E790B60F000020B6040A6618532EC60D988
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04737D50 Relevance: .0, Instructions: 7COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04737D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}




                                                0x04737d56
                                                0x04737d5b
                                                0x04737d60
                                                0x04737d5d
                                                0x04737d5d
                                                0x04737d5d

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                • Instruction ID: c83fdf50d62a5b22888ab807798b44ef10bf28cdc51016c1a12db7364971d632
                                                • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                • Instruction Fuzzy Hash: B2B092743119408FCF1ADF18C080B1533E4BB44A40B8440D0E400CBA21D329F8008900
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04742ACB Relevance: .0, Instructions: 5COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 100%
                                                			E04742ACB() {
				void* _t5;

				return E0472EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}




                                                0x04742adc

                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                                • Instruction ID: 9f4f3d849012ef8be65ed95e8f282363978f7c1409ee920a96261e0ecdb42b60
                                                • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                                • Instruction Fuzzy Hash: 4AB01233C10450CFCF02EF44C710F197331FB00750F0544A0900127A30C228BC01CB40
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759560 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 10cc333b68e6849b04fbf33f2cde73b3d9e07d0d9b3687317fe47df5ca5abc62
                                                • Instruction ID: d09a46b883edc63771273e76e6a8ef5ff479d753080c2885de37cbe93e538283
                                                • Opcode Fuzzy Hash: 10cc333b68e6849b04fbf33f2cde73b3d9e07d0d9b3687317fe47df5ca5abc62
                                                • Instruction Fuzzy Hash: 17900265331004062155A55A060450B0446A7DA395391C025F54175A0CCA61D8697361
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475AD30 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 104d7cf67870b5ff7a23fb81a4f4bbc7065ed9dd5d0d60eb065188bf1c086ff7
                                                • Instruction ID: af5b6e416db0a65075d1dc57cd0ea6ec597107b14a67fe825ddb65d9d09d8953
                                                • Opcode Fuzzy Hash: 104d7cf67870b5ff7a23fb81a4f4bbc7065ed9dd5d0d60eb065188bf1c086ff7
                                                • Instruction Fuzzy Hash: 67900271B1500416B150715A48146464007A7E4785B55C021A4515564C8D94DA5973E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 779465c39c3a02682081a2aab15630514bd1b31477280b2ef4797d83617494fb
                                                • Instruction ID: 4c956140aec3d9a24fce536207d5ba3a1716622eb8cc552999aa6f191c4a4541
                                                • Opcode Fuzzy Hash: 779465c39c3a02682081a2aab15630514bd1b31477280b2ef4797d83617494fb
                                                • Instruction Fuzzy Hash: 879002E1311144966510A25A8404B0A450697E4245B51C026E5055570CC965D855B175
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047595F0 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8c40f66e53d95a051e35ec4f36d9019d8748cdcc08fb15efbfcfd3b7046dbb6a
                                                • Instruction ID: 1bdba9634b4a448a07716cfc19de04f9813d990fedcf91251329aded928a4c45
                                                • Opcode Fuzzy Hash: 8c40f66e53d95a051e35ec4f36d9019d8748cdcc08fb15efbfcfd3b7046dbb6a
                                                • Instruction Fuzzy Hash: 1A90027131100C06F114615A4804686000697D4345F51C021AA025665E9AA5D8957171
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759650 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: da9dcf8873577b03234c07129e17e96ffbfaf8a7f9ed308a9d573d0cbb21f64f
                                                • Instruction ID: 53fecf189c9f5cbb6b41d45e83161033062439836178fe0a27051c54243a343d
                                                • Opcode Fuzzy Hash: da9dcf8873577b03234c07129e17e96ffbfaf8a7f9ed308a9d573d0cbb21f64f
                                                • Instruction Fuzzy Hash: 1A90027131504C46F150715A4404A46001697D4349F51C021A40656A4D9A65DD59B6A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759610 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 3a6f0513a97a7455db7955688cd70a5bfb6917d0ba8a5add753bb2121ac40ca4
                                                • Instruction ID: db57e33db4079fece842fdc6b4bc31e2d2e43bf09637f63ee21a595254e6a7b3
                                                • Opcode Fuzzy Hash: 3a6f0513a97a7455db7955688cd70a5bfb6917d0ba8a5add753bb2121ac40ca4
                                                • Instruction Fuzzy Hash: AA90027171500C06F160715A4414746000697D4345F51C021A4025664D8B95DA5976E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047596D0 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9c0e3f1d5725a0fba6df355203a44baada1c788351917e14bd931ed149272a1b
                                                • Instruction ID: 61d79103e2cac6066c4750d4117cee459af1ff068cba5cc0245e0f53686e6898
                                                • Opcode Fuzzy Hash: 9c0e3f1d5725a0fba6df355203a44baada1c788351917e14bd931ed149272a1b
                                                • Instruction Fuzzy Hash: 9B90027131100C46F110615A4404B46000697E4345F51C026A4125664D8A55D8557561
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759770 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 215ee26fe2c9bcf884619b1a6ee52b4e0fd05596ea5ebe64652ae95ae95affff
                                                • Instruction ID: 159b0929231de10c3defaee96ea16662101f12d20f866d5525faacb1a3728bc6
                                                • Opcode Fuzzy Hash: 215ee26fe2c9bcf884619b1a6ee52b4e0fd05596ea5ebe64652ae95ae95affff
                                                • Instruction Fuzzy Hash: 6690026131504846F110655A5408A06000697D4249F51D021A50655A5DCA75D855B171
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475A770 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b9f421b66b95c8e5f84d86620d72eea503c3f140cb583674f9a9826249fcb021
                                                • Instruction ID: 5e40314fdc554a6a0a17e9f0ab4906a5c29ee9bc37e87bbc198dce585187020e
                                                • Opcode Fuzzy Hash: b9f421b66b95c8e5f84d86620d72eea503c3f140cb583674f9a9826249fcb021
                                                • Instruction Fuzzy Hash: 7090027531504846F510655A5804A87000697D4349F51D421A44255ACD8A94D865B161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759760 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 44f3b983e2219671b622a4115dd851d0eace2238787366ad5804c3f91bfa082f
                                                • Instruction ID: 44f54b5d7a0308ba9d4a91fe078bfa967a801a3133377e8f878596913e7c8d95
                                                • Opcode Fuzzy Hash: 44f3b983e2219671b622a4115dd851d0eace2238787366ad5804c3f91bfa082f
                                                • Instruction Fuzzy Hash: D990027131100807F110615A5508707000697D4245F51D421A4425568DDA96D8557161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759730 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 9ab3574aa43ea6886b74ae020b11522d44051bcd91b257a73ad11638d152ddb0
                                                • Instruction ID: 43a1e12ca0e80de679907ae12722aaa524ef5ef6553e07a3d968942cc8dfa169
                                                • Opcode Fuzzy Hash: 9ab3574aa43ea6886b74ae020b11522d44051bcd91b257a73ad11638d152ddb0
                                                • Instruction Fuzzy Hash: 5C90026171500806F150715A5418706001697D4245F51D021A4025564DCA99DA5976E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475A710 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0da19865d1901bacffec716a1cfab07141050017589dcbe532f01ea94f500f68
                                                • Instruction ID: 4042e6764acea00995cc44d621dab94173119585e4b2baf7842993b1f6f66ed1
                                                • Opcode Fuzzy Hash: 0da19865d1901bacffec716a1cfab07141050017589dcbe532f01ea94f500f68
                                                • Instruction Fuzzy Hash: 8090027131100456B510A69A5804A4A410697F4345B51D025A8015564C8994D8657161
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475B040 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b43a3148cd69186dbc8edd2c61032f2a22ca68159d079ecc72f02c7e58076817
                                                • Instruction ID: 36680d14d8021e8f451a57cd38bde164317456ea4dbc9312218cca1e1d2a99be
                                                • Opcode Fuzzy Hash: b43a3148cd69186dbc8edd2c61032f2a22ca68159d079ecc72f02c7e58076817
                                                • Instruction Fuzzy Hash: 579002A1711144476550B15A48044065016A7E5345391C131A4455570C8AA8D859B2A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759820 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 4a8a1225c906be928fae6df7aa0ccba3f9493381ca2cab7b95328e7ce687a63b
                                                • Instruction ID: b753b48aa39444a81fec01a8a776e025460c9662b5d5bce747cc912b2fbdb2e8
                                                • Opcode Fuzzy Hash: 4a8a1225c906be928fae6df7aa0ccba3f9493381ca2cab7b95328e7ce687a63b
                                                • Instruction Fuzzy Hash: 1E90027135100806F151715A4404606000AA7D4285F91C022A4425564E8A95DA5ABAA1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047598A0 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: abfadf458796c50a95f2bdb457d5f3d8e3d2482aae1dcd164cd7f65c70e929a3
                                                • Instruction ID: 2ff791c43190ac881a43dca645f0879e484b7eeace1b1164f5785c8b5da51fb1
                                                • Opcode Fuzzy Hash: abfadf458796c50a95f2bdb457d5f3d8e3d2482aae1dcd164cd7f65c70e929a3
                                                • Instruction Fuzzy Hash: A590026131100806F112615A4414606000AD7D5389F91C022E5425565D8A65D957B172
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759950 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8a8e40e226887875e8ef170ed71dac0913529330302389c57cdf417d25ce0bcf
                                                • Instruction ID: df25099d0dd85bf894c80eaf500510805e25cc4dc769d11765106f6f2836a0fd
                                                • Opcode Fuzzy Hash: 8a8e40e226887875e8ef170ed71dac0913529330302389c57cdf417d25ce0bcf
                                                • Instruction Fuzzy Hash: 569002A131140807F150655A4804607000697D4346F51C021A6065565E8E69DC557175
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047599D0 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e02d413f94b08ec4fc5c3e71506d2f31d0af3e9016c71ad7f92264f101577229
                                                • Instruction ID: 8873f9e586812b221c1af3a546d97986d25d33fe9b2b473620c41fc843b243ca
                                                • Opcode Fuzzy Hash: e02d413f94b08ec4fc5c3e71506d2f31d0af3e9016c71ad7f92264f101577229
                                                • Instruction Fuzzy Hash: BF9002A132100446F114615A4404706004697E5245F51C022A6155564CC969DC657165
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759A10 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 23a94110365f60350eb570f655d7a8591a9ecbb30cfe2d4e8197a1cc4d7967e3
                                                • Instruction ID: 811180109ac3e070e14b3311f710c06d4d463095e73a1e910ea9f05a4163a190
                                                • Opcode Fuzzy Hash: 23a94110365f60350eb570f655d7a8591a9ecbb30cfe2d4e8197a1cc4d7967e3
                                                • Instruction Fuzzy Hash: EC90027131140806F110615A4808747000697D4346F51C021A9165565E8AA5D8957571
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759A80 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c38264a187a2006ba8443e2a9fa15e84ed4bde97069f81c98b413c6ce349a369
                                                • Instruction ID: 764fd230db607d02603f86e07b0d147ce803051c58e8baa61db89f5f98d89bfd
                                                • Opcode Fuzzy Hash: c38264a187a2006ba8443e2a9fa15e84ed4bde97069f81c98b413c6ce349a369
                                                • Instruction Fuzzy Hash: 6D90026131144846F150625A4804B0F410697E5246F91C029A8157564CCD55D8597761
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759B00 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 20b010e2b82d8234141d70fe5ca78cccdbd4aafaa3c4ff57bc8f11d9fbf82dec
                                                • Instruction ID: 57add02a957d195b987636dc4755c061f5022fa45ecf08189ead5750a9eee4c4
                                                • Opcode Fuzzy Hash: 20b010e2b82d8234141d70fe5ca78cccdbd4aafaa3c4ff57bc8f11d9fbf82dec
                                                • Instruction Fuzzy Hash: EF90026135100C06F150715A84147070007D7D4645F51C021A4025564D8A56D96976F1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0475A3B0 Relevance: .0, Instructions: 4COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 08d8d95b443530bff6fe8d8a1ec1cc7b91e3031caaedc8ea8b371cd20f0c61ef
                                                • Instruction ID: ead62e411fce4859f104e26355f4ee28c792a992f99858f5289c66b1b558cc90
                                                • Opcode Fuzzy Hash: 08d8d95b443530bff6fe8d8a1ec1cc7b91e3031caaedc8ea8b371cd20f0c61ef
                                                • Instruction Fuzzy Hash: B890027131144406F150715A844460B5006A7E4345F51C421E4426564C8A55D85AB261
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04759670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                • Instruction ID: ad377784d53b7c44321347dc3d8e4e154d3d362da629dd0e3ab4eb517fdd2e5f
                                                • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                • Instruction Fuzzy Hash:
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 047AFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 53%
                                                			E047AFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0475CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E047A5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E047A5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                                0x047afdda
                                                0x047afde2
                                                0x047afde5
                                                0x047afdec
                                                0x047afdfa
                                                0x047afdff
                                                0x047afe0a
                                                0x047afe0f
                                                0x047afe17
                                                0x047afe1e
                                                0x047afe19
                                                0x047afe19
                                                0x047afe19
                                                0x047afe20
                                                0x047afe21
                                                0x047afe22
                                                0x047afe25
                                                0x047afe40

                                                APIs
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 047AFDFA
                                                Strings
                                                • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 047AFE2B
                                                • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 047AFE01
                                                Memory Dump Source
                                                • Source File: 00000007.00000002.552336636.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: true
                                                • Associated: 00000007.00000002.552685863.000000000480B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000007.00000002.552731025.000000000480F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_7_2_46f0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                                • API String ID: 885266447-3903918235
                                                • Opcode ID: 13831c8b1363ca1a50530aaf7084545a6cb4d6f6b22ee476055599a78b9a0d45
                                                • Instruction ID: b0aac374681ad7d79af7d0ab5b7179693dc2c87350de9ff901109a7490d8b1da
                                                • Opcode Fuzzy Hash: 13831c8b1363ca1a50530aaf7084545a6cb4d6f6b22ee476055599a78b9a0d45
                                                • Instruction Fuzzy Hash: FFF0C272204601BFEA211A55DC0AF23BB5AEB84730F244355F628562E1EA62B83096A4
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Execution Graph

                                                Execution Coverage:0.7%
                                                Dynamic/Decrypted Code Coverage:100%
                                                Signature Coverage:0%
                                                Total number of Nodes:1389
                                                Total number of Limit Nodes:82
                                                execution_graph 14229 430fab0 14230 430fac2 14229->14230 14231 430fb14 14229->14231 14265 42eeef0 14230->14265 14233 430facd 14234 430fadf 14233->14234 14238 430fb18 14233->14238 14280 42eeb70 14234->14280 14237 430fafa GetPEB 14237->14231 14239 430fb09 14237->14239 14244 434bdcb 14238->14244 14270 42e6d90 14238->14270 14286 42eff60 14239->14286 14243 42e76e2 GetPEB 14250 430fc4b 14243->14250 14247 434be19 14244->14247 14261 434bea7 14244->14261 14306 42db150 14244->14306 14245 430fba7 14249 430fbe4 14245->14249 14245->14250 14294 430fd22 14245->14294 14247->14261 14309 42e75ce 14247->14309 14249->14250 14252 434bf17 14249->14252 14253 430fc47 14249->14253 14252->14250 14254 430fd22 GetPEB 14252->14254 14253->14250 14255 430fd22 GetPEB 14253->14255 14257 434bf22 14254->14257 14258 430fcb2 14255->14258 14256 434be54 14256->14250 14259 434be92 14256->14259 14313 42e76e2 14256->14313 14257->14250 14262 430fd9b 3 API calls 14257->14262 14258->14250 14298 430fd9b 14258->14298 14259->14261 14264 42e76e2 GetPEB 14259->14264 14261->14243 14261->14250 14262->14250 14264->14261 14266 42eef0c 14265->14266 14267 42eef21 14265->14267 14266->14233 14268 42eef29 14267->14268 14317 42eef40 14267->14317 14268->14233 14271 42e6dba 14270->14271 14274 42e6da4 14270->14274 14645 4312e1c 14271->14645 14273 42e6dbf 14275 42eeef0 27 API calls 14273->14275 14274->14244 14274->14245 14274->14250 14276 42e6dca 14275->14276 14277 42e6dde 14276->14277 14650 42ddb60 14276->14650 14279 42eeb70 33 API calls 14277->14279 14279->14274 14281 42eeb9e 14280->14281 14282 42eeb81 14280->14282 14281->14231 14281->14237 14282->14281 14284 42eebac 14282->14284 14768 436ff10 14282->14768 14284->14281 14762 42d4dc0 14284->14762 14287 42eff6d 14286->14287 14288 42eff99 14286->14288 14287->14288 14290 42eff80 GetPEB 14287->14290 14289 43a88f5 33 API calls 14288->14289 14291 42eff94 14289->14291 14290->14288 14292 42eff8f 14290->14292 14291->14231 14867 42f0050 14292->14867 14295 430fd3a 14294->14295 14297 430fd31 _vswprintf_s 14294->14297 14295->14297 14901 42e7608 14295->14901 14297->14249 14299 430fdba GetPEB 14298->14299 14300 430fdcc 14298->14300 14299->14300 14301 430fdf2 14300->14301 14302 434c0bd 14300->14302 14305 430fdfc 14300->14305 14303 42e76e2 GetPEB 14301->14303 14301->14305 14304 434c0d3 GetPEB 14302->14304 14302->14305 14303->14305 14304->14305 14305->14250 14307 42db171 _vswprintf_s 12 API calls 14306->14307 14308 42db16e 14307->14308 14308->14247 14310 42e75eb 14309->14310 14311 42e75db 14309->14311 14310->14256 14311->14310 14312 42e7608 GetPEB 14311->14312 14312->14310 14314 42e76fd 14313->14314 14315 42e76e6 14313->14315 14314->14259 14315->14314 14316 42e76ec GetPEB 14315->14316 14316->14314 14318 42ef0bd 14317->14318 14321 42eef5d 14317->14321 14318->14321 14355 42d9080 14318->14355 14322 42ef042 14321->14322 14323 42ef071 14321->14323 14325 42d2d8a 14321->14325 14322->14323 14324 42ef053 GetPEB 14322->14324 14323->14266 14324->14323 14327 42d2db8 14325->14327 14342 42d2df1 _vswprintf_s 14325->14342 14326 42d2de7 14326->14342 14365 4301624 14326->14365 14327->14326 14327->14342 14361 42d2e9f 14327->14361 14328 432f9d0 GetPEB 14331 432f9e3 GetPEB 14328->14331 14331->14342 14335 42d2e5a 14336 42d2e61 14335->14336 14341 42d2e99 _vswprintf_s 14335->14341 14337 42d2e69 14336->14337 14338 42f7d50 GetPEB 14336->14338 14337->14321 14340 432fa76 14338->14340 14344 432fa8a 14340->14344 14345 432fa7a GetPEB 14340->14345 14343 42d2ece 14341->14343 14408 43195d0 LdrInitializeThunk 14341->14408 14342->14328 14342->14331 14342->14335 14359 42f7d50 GetPEB 14342->14359 14372 436fe87 14342->14372 14379 436fdda 14342->14379 14385 436ffb9 14342->14385 14393 4365720 14342->14393 14343->14321 14344->14337 14348 432fa97 GetPEB 14344->14348 14345->14344 14348->14337 14349 432faaa 14348->14349 14350 42f7d50 GetPEB 14349->14350 14351 432faaf 14350->14351 14352 432fac3 14351->14352 14353 432fab3 GetPEB 14351->14353 14352->14337 14396 4357016 14352->14396 14353->14352 14356 42d909e GetPEB 14355->14356 14357 42d9098 14355->14357 14358 42d90aa 14356->14358 14357->14356 14358->14321 14360 42f7d5d 14359->14360 14360->14342 14362 42d2ebb _vswprintf_s 14361->14362 14364 42d2ece 14362->14364 14409 43195d0 LdrInitializeThunk 14362->14409 14364->14326 14410 43016e0 14365->14410 14367 4301630 14371 4301691 14367->14371 14414 43016c7 14367->14414 14370 430165a 14370->14371 14421 430a185 14370->14421 14371->14342 14373 42f7d50 GetPEB 14372->14373 14374 436fec1 14373->14374 14375 436fec5 GetPEB 14374->14375 14376 436fed5 _vswprintf_s 14374->14376 14375->14376 14452 431b640 14376->14452 14378 436fef8 14378->14342 14380 436fdff __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 14379->14380 14381 4365720 _vswprintf_s 12 API calls 14380->14381 14382 436fe0f 14381->14382 14383 4365720 _vswprintf_s 12 API calls 14382->14383 14384 436fe39 14383->14384 14384->14342 14386 436ffc8 _vswprintf_s 14385->14386 14599 430e730 14386->14599 14388 4370067 14389 432d130 _vswprintf_s 12 API calls 14388->14389 14392 437009a 14389->14392 14390 436ffd5 14390->14388 14391 4360c30 _vswprintf_s 12 API calls 14390->14391 14391->14388 14392->14342 14605 42db171 14393->14605 14397 4357052 14396->14397 14398 4357073 GetPEB 14397->14398 14403 4357084 14397->14403 14398->14403 14399 4357125 GetPEB 14400 4357136 14399->14400 14401 431b640 _vswprintf_s 12 API calls 14400->14401 14402 4357147 14401->14402 14402->14337 14403->14400 14404 42f7d50 GetPEB 14403->14404 14406 4357101 _vswprintf_s 14403->14406 14405 43570ec 14404->14405 14405->14406 14407 43570f0 GetPEB 14405->14407 14406->14399 14406->14400 14407->14406 14408->14343 14409->14364 14411 43016ed 14410->14411 14412 43016f3 GetPEB 14411->14412 14413 43016f1 14411->14413 14412->14413 14413->14367 14415 43455f4 14414->14415 14416 43016da 14414->14416 14426 438bbf0 14415->14426 14416->14370 14419 434560a 14423 430a1a0 14421->14423 14424 430a192 14421->14424 14422 430a1b0 GetPEB 14425 430a1c1 14422->14425 14423->14422 14423->14424 14424->14371 14425->14371 14427 438bc12 14426->14427 14428 43455fb 14427->14428 14434 438c08a 14427->14434 14428->14419 14430 438bf33 14428->14430 14431 438bf4c 14430->14431 14433 438bf97 14431->14433 14447 438be9b 14431->14447 14433->14419 14435 438c0c6 14434->14435 14437 438c104 _vswprintf_s 14435->14437 14438 438bfdb 14435->14438 14437->14428 14439 438bfef 14438->14439 14441 438bfeb 14438->14441 14439->14441 14442 438bdfa 14439->14442 14441->14437 14443 438be17 14442->14443 14445 438be6d 14443->14445 14446 4319660 LdrInitializeThunk 14443->14446 14445->14441 14446->14445 14449 438beb3 14447->14449 14448 438bf08 14448->14433 14449->14448 14451 4319660 LdrInitializeThunk 14449->14451 14451->14448 14453 431b648 14452->14453 14454 431b64b 14452->14454 14453->14378 14457 438b590 14454->14457 14456 431b74a _vswprintf_s 14456->14378 14460 438b260 14457->14460 14459 438b5a3 14459->14456 14518 432d08c 14460->14518 14462 438b26c GetPEB 14463 438b279 GetPEB 14462->14463 14465 438b293 14463->14465 14466 438b54b 14465->14466 14467 438b2ba 14465->14467 14468 438b48b 14465->14468 14474 438b56b _vswprintf_s 14466->14474 14519 4360c30 14466->14519 14470 438b414 14467->14470 14471 438b2c6 14467->14471 14469 4365720 _vswprintf_s 10 API calls 14468->14469 14472 438b49e 14469->14472 14473 4365720 _vswprintf_s 10 API calls 14470->14473 14475 438b32d 14471->14475 14476 438b2ce 14471->14476 14482 4365720 _vswprintf_s 10 API calls 14472->14482 14477 438b427 14473->14477 14474->14459 14484 438b396 14475->14484 14490 438b34d 14475->14490 14516 438b2eb 14475->14516 14479 438b2da 14476->14479 14480 438b2f3 14476->14480 14483 4365720 _vswprintf_s 10 API calls 14477->14483 14485 4365720 _vswprintf_s 10 API calls 14479->14485 14481 4365720 _vswprintf_s 10 API calls 14480->14481 14486 438b302 14481->14486 14487 438b4c2 14482->14487 14489 438b43e 14483->14489 14488 4365720 _vswprintf_s 10 API calls 14484->14488 14485->14516 14492 4365720 _vswprintf_s 10 API calls 14486->14492 14493 438b4cc 14487->14493 14503 438b320 14487->14503 14494 438b3aa 14488->14494 14495 4365720 _vswprintf_s 10 API calls 14489->14495 14496 4365720 _vswprintf_s 10 API calls 14490->14496 14491 4365720 _vswprintf_s 10 API calls 14497 438b4fd 14491->14497 14499 438b311 14492->14499 14500 4365720 _vswprintf_s 10 API calls 14493->14500 14501 438b38f 14494->14501 14502 438b3b6 14494->14502 14495->14503 14504 438b361 14496->14504 14498 438b519 14497->14498 14505 4365720 _vswprintf_s 10 API calls 14497->14505 14506 4365720 _vswprintf_s 10 API calls 14498->14506 14507 4365720 _vswprintf_s 10 API calls 14499->14507 14500->14516 14513 4365720 _vswprintf_s 10 API calls 14501->14513 14508 4365720 _vswprintf_s 10 API calls 14502->14508 14509 4365720 _vswprintf_s 10 API calls 14503->14509 14503->14516 14504->14501 14510 438b371 14504->14510 14505->14498 14511 438b528 14506->14511 14507->14503 14512 438b3c5 14508->14512 14509->14516 14514 4365720 _vswprintf_s 10 API calls 14510->14514 14511->14466 14517 4365720 _vswprintf_s 10 API calls 14511->14517 14515 4365720 _vswprintf_s 10 API calls 14512->14515 14513->14516 14514->14516 14515->14516 14516->14491 14517->14466 14518->14462 14520 4360c50 14519->14520 14522 4360c49 14519->14522 14529 436193b 14520->14529 14522->14474 14523 4360c5e 14523->14522 14535 4361c76 14523->14535 14530 4361967 _vswprintf_s 14529->14530 14531 436194c 14529->14531 14530->14523 14552 4361c49 14531->14552 14533 4361951 _vswprintf_s 14533->14530 14534 4361c49 _vswprintf_s LdrInitializeThunk 14533->14534 14534->14533 14555 4319670 14535->14555 14553 4319670 _vswprintf_s LdrInitializeThunk 14552->14553 14554 4361c65 14553->14554 14554->14533 14556 431967a _vswprintf_s LdrInitializeThunk 14555->14556 14600 4319670 _vswprintf_s LdrInitializeThunk 14599->14600 14601 430e747 14600->14601 14602 430e74b 14601->14602 14603 430e784 GetPEB 14601->14603 14602->14390 14604 430e7a8 14603->14604 14604->14390 14606 42db180 _vswprintf_s 14605->14606 14607 42db1b0 GetPEB 14606->14607 14614 42db1c0 _vswprintf_s 14606->14614 14607->14614 14608 432d130 _vswprintf_s 10 API calls 14609 42db1de 14608->14609 14609->14342 14611 4334904 GetPEB 14612 42db1d1 _vswprintf_s 14611->14612 14612->14608 14614->14611 14614->14612 14615 431e2d0 14614->14615 14618 431e2ed 14615->14618 14617 431e2e8 14617->14614 14619 431e2fb 14618->14619 14620 431e30f 14618->14620 14627 431b58e 14619->14627 14622 431e332 14620->14622 14623 431e31e 14620->14623 14632 4322440 14622->14632 14625 431b58e _vswprintf_s 12 API calls 14623->14625 14626 431e307 _vswprintf_s 14625->14626 14626->14617 14628 42db150 _vswprintf_s 12 API calls 14627->14628 14629 431b627 14628->14629 14630 431b640 _vswprintf_s 12 API calls 14629->14630 14631 431b632 14630->14631 14631->14626 14633 432249a 14632->14633 14634 43224af 14632->14634 14635 431b58e _vswprintf_s 12 API calls 14633->14635 14636 43224b7 14634->14636 14644 43224cc __aulldvrm _vswprintf_s 14634->14644 14638 43224a4 14635->14638 14637 431b58e _vswprintf_s 12 API calls 14636->14637 14637->14638 14639 431b640 _vswprintf_s 12 API calls 14638->14639 14640 4322d6e 14639->14640 14640->14626 14641 4322d4f 14643 431b58e _vswprintf_s 12 API calls 14641->14643 14642 43258ee 12 API calls __cftof 14642->14644 14643->14638 14644->14638 14644->14641 14644->14642 14646 4312e32 14645->14646 14647 4312e57 14646->14647 14658 4319840 LdrInitializeThunk 14646->14658 14647->14273 14649 434df2e 14651 42ddb6d 14650->14651 14657 42ddb91 14650->14657 14651->14657 14659 42ddb40 GetPEB 14651->14659 14653 42ddb76 14653->14657 14661 42de7b0 14653->14661 14655 42ddb87 14656 4334fa6 GetPEB 14655->14656 14655->14657 14656->14657 14657->14277 14658->14649 14660 42ddb52 14659->14660 14660->14653 14662 42de7e0 14661->14662 14663 42de7ce 14661->14663 14664 42de7e8 14662->14664 14666 42db150 _vswprintf_s 12 API calls 14662->14666 14663->14664 14669 42e3d34 14663->14669 14668 42de7f6 14664->14668 14708 42ddca4 14664->14708 14666->14664 14668->14655 14670 4338213 14669->14670 14671 42e3d6c 14669->14671 14674 433822b GetPEB 14670->14674 14689 42e4068 14670->14689 14724 42e1b8f 14671->14724 14673 42e3d81 14673->14670 14675 42e3d89 14673->14675 14674->14689 14676 42e1b8f 2 API calls 14675->14676 14677 42e3d9e 14676->14677 14678 42e3dba 14677->14678 14679 42e3da2 GetPEB 14677->14679 14680 42e1b8f 2 API calls 14678->14680 14679->14678 14681 42e3dd2 14680->14681 14683 42e3deb GetPEB 14681->14683 14681->14689 14698 42e3e91 14681->14698 14682 4338344 GetPEB 14686 42e407a 14682->14686 14694 42e3dfc _vswprintf_s 14683->14694 14684 42e1b8f 2 API calls 14687 42e3ea9 14684->14687 14685 42e4085 14685->14662 14686->14685 14688 4338363 GetPEB 14686->14688 14687->14689 14690 42e3ec2 GetPEB 14687->14690 14702 42e3f6a 14687->14702 14688->14685 14689->14682 14689->14686 14692 42e3ed3 _vswprintf_s 14690->14692 14691 42e1b8f 2 API calls 14693 42e3f82 14691->14693 14692->14689 14700 42e3f3b GetPEB 14692->14700 14701 42e3f4d 14692->14701 14693->14689 14695 42e3f9b GetPEB 14693->14695 14694->14689 14696 42e3e62 GetPEB 14694->14696 14697 42e3e74 14694->14697 14707 42e3fac _vswprintf_s 14695->14707 14696->14697 14697->14698 14699 42e3e81 GetPEB 14697->14699 14698->14684 14699->14698 14700->14701 14701->14702 14703 42e3f5a GetPEB 14701->14703 14702->14691 14703->14702 14704 42e404f 14704->14689 14706 42e4058 GetPEB 14704->14706 14705 4338324 GetPEB 14705->14689 14706->14689 14707->14689 14707->14704 14707->14705 14709 42ddd6f _vswprintf_s 14708->14709 14714 42ddcfd 14708->14714 14712 4334ff2 14709->14712 14717 42ddfae 14709->14717 14720 42ddfc2 14709->14720 14746 42de375 14709->14746 14751 43195d0 LdrInitializeThunk 14709->14751 14710 42ddd47 14739 42ddbb1 14710->14739 14712->14712 14714->14710 14714->14720 14730 42de620 14714->14730 14717->14720 14752 43195d0 LdrInitializeThunk 14717->14752 14719 431b640 _vswprintf_s 12 API calls 14721 42ddfe4 14719->14721 14720->14719 14721->14668 14727 42e1ba9 _vswprintf_s 14724->14727 14729 42e1c05 14724->14729 14725 433701a GetPEB 14726 42e1c21 14725->14726 14726->14673 14727->14726 14728 42e1bf4 GetPEB 14727->14728 14727->14729 14728->14729 14729->14725 14729->14726 14731 4335503 14730->14731 14732 42de644 14730->14732 14732->14731 14753 42df358 14732->14753 14734 42de661 _vswprintf_s 14735 42de725 14734->14735 14757 43195d0 LdrInitializeThunk 14734->14757 14737 42de729 GetPEB 14735->14737 14738 42de73b 14735->14738 14737->14738 14738->14710 14758 42e766d 14739->14758 14741 42ddbcf 14741->14709 14742 42ddbf1 14741->14742 14743 42ddc05 14742->14743 14744 42e766d GetPEB 14743->14744 14745 42ddc22 14744->14745 14745->14709 14747 42de3a3 14746->14747 14748 431b640 _vswprintf_s 12 API calls 14747->14748 14750 4335306 14747->14750 14749 42de400 14748->14749 14749->14709 14751->14709 14752->14720 14754 42df370 14753->14754 14755 42df379 GetPEB 14754->14755 14756 42df38c 14754->14756 14755->14756 14756->14734 14757->14735 14760 42e7687 14758->14760 14759 42e76d3 14759->14741 14760->14759 14761 42e76c2 GetPEB 14760->14761 14761->14759 14763 42d4dfa 14762->14763 14765 42d4dd1 14762->14765 14764 42d2e9f LdrInitializeThunk 14763->14764 14764->14765 14767 42d4df3 14765->14767 14781 42d4f2e 14765->14781 14767->14281 14866 432d0e8 14768->14866 14770 436ff1c GetPEB 14771 436ff43 GetPEB 14770->14771 14772 436ff2b 14770->14772 14774 436ff4f 14771->14774 14779 436ff6e 14771->14779 14772->14771 14773 436ffb1 14772->14773 14775 432d130 _vswprintf_s 12 API calls 14773->14775 14776 4365720 _vswprintf_s 12 API calls 14774->14776 14778 436ffb6 14775->14778 14776->14779 14777 430e730 2 API calls 14780 436ff7d 14777->14780 14778->14284 14779->14777 14780->14284 14782 4330b85 14781->14782 14785 42d4f3e 14781->14785 14783 4330b8b GetPEB 14782->14783 14784 4330b9a 14782->14784 14783->14784 14786 4330b9f 14783->14786 14790 43a88f5 14784->14790 14785->14782 14788 42d4f5b GetPEB 14785->14788 14788->14782 14789 42d4f6e 14788->14789 14789->14767 14791 43a8901 _vswprintf_s 14790->14791 14796 42dcc50 14791->14796 14793 43a891f 14794 432d130 _vswprintf_s 12 API calls 14793->14794 14795 43a8946 14794->14795 14795->14786 14797 42dcc79 14796->14797 14801 42dcc7e 14797->14801 14802 430b230 14797->14802 14798 431b640 _vswprintf_s 12 API calls 14799 42dcc89 14798->14799 14799->14793 14801->14798 14803 430b26a 14802->14803 14804 434a2f6 14802->14804 14803->14804 14806 430b2ab _vswprintf_s 14803->14806 14807 434a2fd 14803->14807 14805 431b640 _vswprintf_s 12 API calls 14808 430b2d0 14805->14808 14810 430b2b5 14806->14810 14812 42dccc0 14806->14812 14807->14810 14820 43a5ba5 14807->14820 14808->14801 14810->14804 14810->14805 14813 42dcd04 14812->14813 14814 42db150 _vswprintf_s 12 API calls 14813->14814 14819 42dcd95 14813->14819 14815 4334e0a 14814->14815 14816 42db150 _vswprintf_s 12 API calls 14815->14816 14817 4334e14 14816->14817 14818 42db150 _vswprintf_s 12 API calls 14817->14818 14818->14819 14819->14810 14821 43a5bb4 _vswprintf_s 14820->14821 14825 43a5c2a _vswprintf_s 14821->14825 14828 43a5c10 14821->14828 14831 43a4c56 14821->14831 14822 432d130 _vswprintf_s 12 API calls 14824 43a63e5 14822->14824 14824->14810 14825->14828 14829 43a60cf GetPEB 14825->14829 14830 4319710 LdrInitializeThunk 14825->14830 14835 4316de6 14825->14835 14828->14822 14829->14825 14830->14825 14832 43a4c62 _vswprintf_s 14831->14832 14833 432d130 _vswprintf_s 12 API calls 14832->14833 14834 43a4caa 14833->14834 14834->14825 14836 4316e03 14835->14836 14837 4316e73 14835->14837 14836->14837 14839 4316e53 14836->14839 14841 4316ebe 14836->14841 14837->14825 14839->14837 14849 4306a60 14839->14849 14842 42eeef0 27 API calls 14841->14842 14848 4316eeb 14842->14848 14843 42eeb70 33 API calls 14847 4316f48 14843->14847 14844 4316f0d 14844->14843 14847->14836 14848->14844 14854 4317742 14848->14854 14860 43884e0 14848->14860 14850 4348025 14849->14850 14851 4306a8d _vswprintf_s 14849->14851 14851->14850 14852 431b640 _vswprintf_s 12 API calls 14851->14852 14853 4306b66 14852->14853 14853->14837 14855 4317827 14854->14855 14857 4317768 _vswprintf_s 14854->14857 14855->14848 14856 4319660 _vswprintf_s LdrInitializeThunk 14856->14857 14857->14855 14857->14856 14858 42eeef0 27 API calls 14857->14858 14859 42eeb70 33 API calls 14857->14859 14858->14857 14859->14857 14861 4388511 14860->14861 14862 42eeb70 33 API calls 14861->14862 14864 4388556 14862->14864 14863 42eeef0 27 API calls 14865 43885f1 14863->14865 14864->14863 14865->14848 14866->14770 14868 42f0074 14867->14868 14869 42f009d GetPEB 14868->14869 14870 42f00ef 14868->14870 14871 433c01b 14869->14871 14872 42f00d0 14869->14872 14873 431b640 _vswprintf_s 12 API calls 14870->14873 14871->14872 14874 433c024 GetPEB 14871->14874 14876 42f00df 14872->14876 14877 433c037 14872->14877 14875 42f0105 14873->14875 14874->14872 14875->14291 14881 4309702 14876->14881 14885 43a8a62 14877->14885 14880 433c04b 14880->14880 14882 4309720 14881->14882 14884 4309784 14882->14884 14892 43a8214 14882->14892 14884->14870 14886 42f7d50 GetPEB 14885->14886 14887 43a8a9d 14886->14887 14888 43a8aa1 GetPEB 14887->14888 14889 43a8ab1 _vswprintf_s 14887->14889 14888->14889 14890 431b640 _vswprintf_s 12 API calls 14889->14890 14891 43a8ad7 14890->14891 14891->14880 14894 43a823b 14892->14894 14893 43a82c0 14893->14884 14894->14893 14896 4303b7a GetPEB 14894->14896 14900 4303bb5 _vswprintf_s 14896->14900 14897 4346298 14898 4303c1b GetPEB 14899 4303c35 14898->14899 14899->14893 14900->14897 14900->14898 14900->14900 14902 42e7620 14901->14902 14903 42e766d GetPEB 14902->14903 14904 42e7632 14903->14904 14904->14297 14935 43135b1 14936 43135f2 14935->14936 14937 43135ca 14935->14937 14937->14936 14938 42e7608 GetPEB 14937->14938 14938->14936 14906 4319670 14908 431967a 14906->14908 14909 431968f LdrInitializeThunk 14908->14909 14910 4319681 14908->14910 14939 439bbbb 14940 439bbde 14939->14940 14945 439bd54 14940->14945 14942 439bc3c 14946 439bc04 14945->14946 14947 439bd63 14945->14947 14946->14942 14949 439f9a1 14946->14949 14959 4304e70 14947->14959 14950 439f9d6 14949->14950 14974 43a022c 14950->14974 14952 439f9e1 14953 439f9e7 14952->14953 14954 439fa16 14952->14954 14980 43a05ac 14952->14980 14953->14942 14957 439fa1a _vswprintf_s 14954->14957 14996 43a070d 14954->14996 14957->14953 15010 43a0a13 14957->15010 14960 4304e94 14959->14960 14964 4304ec0 14959->14964 14961 431b640 _vswprintf_s 12 API calls 14960->14961 14962 4304eac 14961->14962 14962->14946 14964->14960 14965 4388df1 14964->14965 14973 432d0e8 14965->14973 14967 4388dfd GetPEB 14968 4388e10 14967->14968 14969 4365720 _vswprintf_s 12 API calls 14968->14969 14970 4388e2f 14968->14970 14969->14970 14971 432d130 _vswprintf_s 12 API calls 14970->14971 14972 4388ebd 14971->14972 14972->14960 14973->14967 14975 43a0278 14974->14975 14977 43a02c2 14975->14977 15018 43a0ea5 14975->15018 14978 43a02e9 14977->14978 15045 432cf85 14977->15045 14978->14952 14984 43a05d1 14980->14984 14981 43a06db 14981->14954 14982 43a0652 14983 439a854 33 API calls 14982->14983 14986 43a0672 14983->14986 14984->14981 14984->14982 14985 439a80d 28 API calls 14984->14985 14985->14982 14986->14981 15286 43a1293 14986->15286 14989 42f7d50 GetPEB 14990 43a069c 14989->14990 14991 43a06b0 14990->14991 14992 43a06a0 GetPEB 14990->14992 14991->14981 14993 43a06ba GetPEB 14991->14993 14992->14991 14993->14981 14994 43a06c9 14993->14994 14995 439138a 14 API calls 14994->14995 14995->14981 14997 43a0734 14996->14997 14998 43a07d2 14997->14998 14999 439afde 33 API calls 14997->14999 14998->14957 15000 43a0782 14999->15000 15001 43a1293 33 API calls 15000->15001 15002 43a078e 15001->15002 15003 42f7d50 GetPEB 15002->15003 15004 43a0793 15003->15004 15005 43a07a7 15004->15005 15006 43a0797 GetPEB 15004->15006 15005->14998 15007 43a07b1 GetPEB 15005->15007 15006->15005 15007->14998 15008 43a07c0 15007->15008 15290 43914fb 15008->15290 15011 43a0a3c 15010->15011 15298 43a0392 15011->15298 15014 432cf85 33 API calls 15015 43a0aec 15014->15015 15016 43a0b19 15015->15016 15017 43a1074 35 API calls 15015->15017 15016->14953 15017->15016 15049 439ff69 15018->15049 15020 43a105b 15043 43a1055 15020->15043 15093 43a1074 15020->15093 15021 43a0f32 15059 439a854 15021->15059 15024 43a0f50 15024->15020 15027 43a0fab 15024->15027 15067 43a15b5 15024->15067 15025 43a0ecb 15025->15020 15025->15021 15055 439a80d 15025->15055 15029 42f7d50 GetPEB 15027->15029 15030 43a0fcf 15029->15030 15031 43a0fe3 15030->15031 15032 43a0fd3 GetPEB 15030->15032 15033 43a100e 15031->15033 15034 43a0fed GetPEB 15031->15034 15032->15031 15036 42f7d50 GetPEB 15033->15036 15034->15033 15035 43a0ffc 15034->15035 15071 439138a 15035->15071 15038 43a1013 15036->15038 15039 43a1027 15038->15039 15040 43a1017 GetPEB 15038->15040 15041 43a1041 15039->15041 15079 438fec0 15039->15079 15040->15039 15041->15043 15087 43952f8 15041->15087 15043->14977 15047 432cf98 15045->15047 15046 432cfb1 15046->14978 15047->15046 15048 43952f8 33 API calls 15047->15048 15048->15046 15052 439ff9f 15049->15052 15054 439ffd1 15049->15054 15050 439a854 33 API calls 15051 439fff1 15050->15051 15051->15025 15053 439a80d 28 API calls 15052->15053 15052->15054 15053->15054 15054->15050 15056 439a81c 15055->15056 15057 439a84e 15055->15057 15105 438ff41 15056->15105 15057->15021 15060 439a8c0 15059->15060 15061 439a941 15059->15061 15060->15061 15178 439f021 15060->15178 15063 439aa00 15061->15063 15182 43953d9 15061->15182 15065 431b640 _vswprintf_s 12 API calls 15063->15065 15066 439aa10 15065->15066 15066->15024 15068 43a15d0 15067->15068 15070 43a15d7 15067->15070 15069 43a165e LdrInitializeThunk 15068->15069 15069->15070 15070->15024 15072 43913af _vswprintf_s 15071->15072 15073 42f7d50 GetPEB 15072->15073 15074 43913d2 15073->15074 15075 43913d6 GetPEB 15074->15075 15076 43913e6 _vswprintf_s 15074->15076 15075->15076 15077 431b640 _vswprintf_s 12 API calls 15076->15077 15078 439140b 15077->15078 15078->15033 15080 438fee5 _vswprintf_s 15079->15080 15081 42f7d50 GetPEB 15080->15081 15082 438ff02 15081->15082 15083 438ff06 GetPEB 15082->15083 15084 438ff16 _vswprintf_s 15082->15084 15083->15084 15085 431b640 _vswprintf_s 12 API calls 15084->15085 15086 438ff3b 15085->15086 15086->15041 15088 4395321 15087->15088 15089 43953c7 15087->15089 15090 4357b9c 33 API calls 15088->15090 15091 431b640 _vswprintf_s 12 API calls 15089->15091 15090->15089 15092 43953d5 15091->15092 15092->15043 15094 43a10b0 15093->15094 15095 43a1095 15093->15095 15244 439afde 15094->15244 15096 43a165e LdrInitializeThunk 15095->15096 15096->15094 15099 42f7d50 GetPEB 15100 43a10cd 15099->15100 15101 43a10e1 15100->15101 15102 43a10d1 GetPEB 15100->15102 15103 43a10fa 15101->15103 15253 438fe3f 15101->15253 15102->15101 15103->15043 15106 438ff4d _vswprintf_s 15105->15106 15107 438ffaf _vswprintf_s 15106->15107 15109 4392073 15106->15109 15107->15057 15119 438fd22 15109->15119 15111 439207d 15112 4392085 15111->15112 15113 43920a4 15111->15113 15114 4388df1 13 API calls 15112->15114 15118 43920be 15113->15118 15122 4391c06 GetPEB 15113->15122 15116 43920a2 15114->15116 15116->15107 15118->15107 15120 4319670 _vswprintf_s LdrInitializeThunk 15119->15120 15121 438fd3d 15120->15121 15121->15111 15123 4391c3d 15122->15123 15124 4391c20 GetPEB 15122->15124 15126 42db150 _vswprintf_s 12 API calls 15123->15126 15125 42db150 _vswprintf_s 12 API calls 15124->15125 15127 4391c3a 15125->15127 15126->15127 15128 42db150 _vswprintf_s 12 API calls 15127->15128 15129 4391c5a GetPEB 15128->15129 15131 4391d04 15129->15131 15132 4391ce7 GetPEB 15129->15132 15134 42db150 _vswprintf_s 12 API calls 15131->15134 15133 42db150 _vswprintf_s 12 API calls 15132->15133 15135 4391d01 15133->15135 15134->15135 15136 42db150 _vswprintf_s 12 API calls 15135->15136 15137 4391d1c 15136->15137 15138 4391d66 15137->15138 15139 4391d27 GetPEB 15137->15139 15142 4391daf 15138->15142 15143 4391d70 GetPEB 15138->15143 15140 4391d4f 15139->15140 15141 4391d32 GetPEB 15139->15141 15145 42db150 _vswprintf_s 12 API calls 15140->15145 15144 42db150 _vswprintf_s 12 API calls 15141->15144 15148 4391db9 GetPEB 15142->15148 15174 4391df8 15142->15174 15146 4391d98 15143->15146 15147 4391d7b GetPEB 15143->15147 15150 4391d4c 15144->15150 15145->15150 15149 42db150 _vswprintf_s 12 API calls 15146->15149 15153 42db150 _vswprintf_s 12 API calls 15147->15153 15151 4391de1 15148->15151 15152 4391dc4 GetPEB 15148->15152 15159 4391d95 15149->15159 15158 42db150 _vswprintf_s 12 API calls 15150->15158 15161 42db150 _vswprintf_s 12 API calls 15151->15161 15160 42db150 _vswprintf_s 12 API calls 15152->15160 15153->15159 15154 4391e0a GetPEB 15156 4391e32 15154->15156 15157 4391e15 GetPEB 15154->15157 15155 4391e52 GetPEB 15166 4391e7a 15155->15166 15167 4391e5d GetPEB 15155->15167 15164 42db150 _vswprintf_s 12 API calls 15156->15164 15162 42db150 _vswprintf_s 12 API calls 15157->15162 15158->15138 15163 42db150 _vswprintf_s 12 API calls 15159->15163 15165 4391dde 15160->15165 15161->15165 15168 4391e2f 15162->15168 15163->15142 15164->15168 15171 42db150 _vswprintf_s 12 API calls 15165->15171 15170 42db150 _vswprintf_s 12 API calls 15166->15170 15169 42db150 _vswprintf_s 12 API calls 15167->15169 15172 42db150 _vswprintf_s 12 API calls 15168->15172 15173 4391e77 15169->15173 15170->15173 15171->15174 15175 4391e4f 15172->15175 15176 42db150 _vswprintf_s 12 API calls 15173->15176 15174->15154 15174->15155 15175->15155 15177 4391e90 GetPEB 15176->15177 15177->15118 15179 439f03a 15178->15179 15196 439ee22 15179->15196 15183 4395552 15182->15183 15184 43953f7 15182->15184 15186 4357b9c 33 API calls 15183->15186 15193 439547c 15183->15193 15185 4395403 15184->15185 15189 43954eb 15184->15189 15187 4395481 15185->15187 15190 439540b 15185->15190 15186->15193 15187->15193 15194 4357b9c 33 API calls 15187->15194 15188 431b640 _vswprintf_s 12 API calls 15191 43955bd 15188->15191 15192 4357b9c 33 API calls 15189->15192 15189->15193 15190->15193 15228 4357b9c 15190->15228 15191->15063 15192->15193 15193->15188 15194->15193 15197 439ee5d 15196->15197 15199 439ee73 15197->15199 15200 439ef09 15197->15200 15198 431b640 _vswprintf_s 12 API calls 15201 439efd4 15198->15201 15206 439eef5 15199->15206 15207 439f607 15199->15207 15200->15206 15212 439f8c5 15200->15212 15201->15061 15206->15198 15210 439f626 15207->15210 15208 439eedd 15208->15206 15211 43196e0 LdrInitializeThunk 15208->15211 15210->15208 15218 43a165e 15210->15218 15211->15206 15213 439f8ea 15212->15213 15214 439f932 15213->15214 15215 439f607 LdrInitializeThunk 15213->15215 15214->15206 15216 439f90f 15215->15216 15216->15214 15227 43196e0 LdrInitializeThunk 15216->15227 15220 43a166a _vswprintf_s 15218->15220 15219 43a1869 _vswprintf_s 15219->15210 15220->15219 15222 43a1d55 15220->15222 15223 43a1d61 _vswprintf_s 15222->15223 15224 43a1fc5 _vswprintf_s 15223->15224 15226 43196e0 LdrInitializeThunk 15223->15226 15224->15220 15226->15224 15227->15214 15231 4311130 15228->15231 15234 431115f 15231->15234 15235 434cd96 15234->15235 15236 43111a8 15234->15236 15236->15235 15237 43111e9 _vswprintf_s 15236->15237 15238 434cd9d 15236->15238 15242 43112bd 15237->15242 15243 42dccc0 _vswprintf_s 12 API calls 15237->15243 15240 43a5ba5 33 API calls 15238->15240 15238->15242 15239 431b640 _vswprintf_s 12 API calls 15241 4311159 15239->15241 15240->15242 15241->15193 15242->15235 15242->15239 15243->15242 15245 439b039 15244->15245 15246 439b00a 15244->15246 15251 439b035 15245->15251 15270 43196e0 LdrInitializeThunk 15245->15270 15246->15245 15247 439b00e 15246->15247 15248 439b026 15247->15248 15261 439f209 15247->15261 15248->15099 15251->15248 15252 43953d9 33 API calls 15251->15252 15252->15248 15254 438fe64 _vswprintf_s 15253->15254 15255 42f7d50 GetPEB 15254->15255 15256 438fe81 15255->15256 15257 438fe85 GetPEB 15256->15257 15258 438fe95 _vswprintf_s 15256->15258 15257->15258 15259 431b640 _vswprintf_s 12 API calls 15258->15259 15260 438feba 15259->15260 15260->15103 15262 439f23b 15261->15262 15263 439f241 15262->15263 15264 439f27a 15262->15264 15271 43196e0 LdrInitializeThunk 15263->15271 15269 439f28f _vswprintf_s 15264->15269 15272 43196e0 LdrInitializeThunk 15264->15272 15268 439f26d 15268->15251 15269->15268 15273 439f7dd 15269->15273 15270->15251 15271->15268 15272->15269 15274 439f803 15273->15274 15279 439f4a1 15274->15279 15278 439f82d 15278->15268 15280 439f4bc 15279->15280 15281 43a165e LdrInitializeThunk 15280->15281 15283 439f4ea 15281->15283 15282 439f51c 15285 43196e0 LdrInitializeThunk 15282->15285 15283->15282 15284 43a165e LdrInitializeThunk 15283->15284 15284->15283 15285->15278 15287 43a0697 15286->15287 15288 43a12b2 15286->15288 15287->14989 15289 43952f8 33 API calls 15288->15289 15289->15287 15291 4391520 _vswprintf_s 15290->15291 15292 42f7d50 GetPEB 15291->15292 15293 4391543 15292->15293 15294 4391547 GetPEB 15293->15294 15295 4391557 _vswprintf_s 15293->15295 15294->15295 15296 431b640 _vswprintf_s 12 API calls 15295->15296 15297 439157c 15296->15297 15297->14998 15300 43a03a0 15298->15300 15299 43a0589 15299->15014 15300->15299 15301 43a070d 36 API calls 15300->15301 15303 437da47 15300->15303 15301->15300 15304 437da51 15303->15304 15308 437da9b 15303->15308 15304->15308 15309 42fc4a0 15304->15309 15308->15300 15326 42fc577 15309->15326 15311 431b640 _vswprintf_s 12 API calls 15313 42fc545 15311->15313 15312 42fc4cc 15319 42fc52c 15312->15319 15334 42fc182 15312->15334 15313->15308 15320 439526e 15313->15320 15315 42fc515 15315->15319 15349 42fdbe9 15315->15349 15316 42fc4f9 15316->15315 15316->15319 15367 42fe180 15316->15367 15319->15311 15321 439528d 15320->15321 15322 43952a4 15320->15322 15324 4357b9c 33 API calls 15321->15324 15323 431b640 _vswprintf_s 12 API calls 15322->15323 15325 43952af 15323->15325 15324->15322 15325->15308 15327 42fc5b5 15326->15327 15328 42fc583 15326->15328 15329 42fc5ce 15327->15329 15330 42fc5bb GetPEB 15327->15330 15328->15327 15333 42fc59e GetPEB 15328->15333 15332 43a88f5 33 API calls 15329->15332 15330->15329 15331 42fc5ad 15330->15331 15331->15312 15332->15331 15333->15327 15333->15331 15335 42fc1c4 15334->15335 15348 42fc1a2 15334->15348 15336 42f7d50 GetPEB 15335->15336 15337 42fc1dc 15336->15337 15338 4342d65 GetPEB 15337->15338 15339 42fc1e4 15337->15339 15340 4342d78 15338->15340 15339->15340 15342 42fc1f2 15339->15342 15393 43a8d34 15340->15393 15342->15348 15370 42fbb2d 15342->15370 15345 42fbb2d 28 API calls 15346 42fc227 15345->15346 15375 42fb944 15346->15375 15348->15316 15350 42fdc05 15349->15350 15351 42fdc54 15350->15351 15423 42d4510 15350->15423 15352 42f7d50 GetPEB 15351->15352 15354 42fdd10 15352->15354 15356 42fdd18 15354->15356 15357 4343aff GetPEB 15354->15357 15359 4343b12 15356->15359 15360 42fdd29 15356->15360 15357->15359 15358 42dcc50 33 API calls 15358->15351 15431 43a8ed6 15359->15431 15414 42fdd82 15360->15414 15362 4343b1b 15362->15362 15364 42fdd3b 15365 42fb944 17 API calls 15364->15365 15366 42fdd45 15365->15366 15366->15319 15368 42fc577 35 API calls 15367->15368 15369 42fe198 15368->15369 15369->15315 15371 42fbb33 15370->15371 15372 439a80d 28 API calls 15371->15372 15374 42fbb92 15371->15374 15373 4342d06 15372->15373 15374->15345 15376 42fbadd 15375->15376 15379 42fb980 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 15375->15379 15378 42f7d50 GetPEB 15376->15378 15390 42fbab7 15376->15390 15377 431b640 _vswprintf_s 12 API calls 15380 42fbad9 15377->15380 15381 42fbaee 15378->15381 15384 42f7d50 GetPEB 15379->15384 15379->15390 15380->15348 15382 42fbaf6 15381->15382 15383 4342caf GetPEB 15381->15383 15382->15390 15400 43a8cd6 15382->15400 15387 4342cc2 GetPEB 15383->15387 15385 42fbaa1 15384->15385 15385->15387 15388 42fbaa9 15385->15388 15389 4342cd5 15387->15389 15388->15389 15388->15390 15407 43a8f6a 15389->15407 15390->15377 15392 4342ce2 15392->15392 15394 42f7d50 GetPEB 15393->15394 15395 43a8d5a 15394->15395 15396 43a8d5e GetPEB 15395->15396 15397 43a8d6e _vswprintf_s 15395->15397 15396->15397 15398 431b640 _vswprintf_s 12 API calls 15397->15398 15399 43a8d91 15398->15399 15399->15348 15401 42f7d50 GetPEB 15400->15401 15402 43a8cf9 15401->15402 15403 43a8cfd GetPEB 15402->15403 15404 43a8d0d _vswprintf_s 15402->15404 15403->15404 15405 431b640 _vswprintf_s 12 API calls 15404->15405 15406 43a8d30 15405->15406 15406->15390 15408 42f7d50 GetPEB 15407->15408 15409 43a8f9c 15408->15409 15410 43a8fa0 GetPEB 15409->15410 15411 43a8fb0 _vswprintf_s 15409->15411 15410->15411 15412 431b640 _vswprintf_s 12 API calls 15411->15412 15413 43a8fd3 15412->15413 15413->15392 15415 42fddbc 15414->15415 15416 42eeef0 27 API calls 15415->15416 15421 42fde19 15415->15421 15417 42fded7 15416->15417 15418 42fdf1f 15417->15418 15419 42eeb70 33 API calls 15417->15419 15418->15364 15420 42fdf0b 15419->15420 15420->15421 15438 42fdf70 15420->15438 15421->15364 15424 42d4523 15423->15424 15425 42d458f 15423->15425 15424->15425 15426 42db150 _vswprintf_s 12 API calls 15424->15426 15425->15358 15427 43308f7 15426->15427 15428 42db150 _vswprintf_s 12 API calls 15427->15428 15429 4330901 15428->15429 15430 42db150 _vswprintf_s 12 API calls 15429->15430 15430->15425 15432 42f7d50 GetPEB 15431->15432 15433 43a8f2f 15432->15433 15434 43a8f33 GetPEB 15433->15434 15435 43a8f43 _vswprintf_s 15433->15435 15434->15435 15436 431b640 _vswprintf_s 12 API calls 15435->15436 15437 43a8f66 15436->15437 15437->15362 15439 42fdf7c _vswprintf_s 15438->15439 15440 42fdfbf 15439->15440 15441 42fdfba 15439->15441 15442 42fdfe5 15439->15442 15479 42fe090 15440->15479 15460 42ee510 15441->15460 15446 42fe07c 15442->15446 15447 42fdff2 15442->15447 15445 42fdfdf _vswprintf_s 15445->15421 15557 430f8f2 15446->15557 15448 42fdffb 15447->15448 15449 42fe075 15447->15449 15488 4300075 15448->15488 15543 43036e9 15449->15543 15453 42fe000 15453->15440 15454 4343b30 15453->15454 15456 42fe01e 15453->15456 15572 4355510 15454->15572 15456->15440 15516 42db1e1 15456->15516 15580 42eb02a GetPEB 15460->15580 15462 42ee95a 15462->15440 15464 42ee904 15467 42ee90c 15464->15467 15469 42db1e1 19 API calls 15464->15469 15465 42ee8d0 15470 42eb02a 20 API calls 15465->15470 15478 42ee8ec 15465->15478 15467->15440 15468 42ee57e 15468->15462 15472 433b7e9 15468->15472 15474 42ee8b4 15468->15474 15475 42ee783 15468->15475 15468->15478 15592 432cdfa 15468->15592 15471 433b98c 15469->15471 15470->15478 15473 4355510 12 API calls 15472->15473 15472->15478 15473->15478 15474->15478 15596 42e8794 15474->15596 15476 4355510 12 API calls 15475->15476 15475->15478 15476->15478 15478->15464 15620 43197a0 LdrInitializeThunk 15478->15620 15480 4343b90 15479->15480 15481 42fe099 15479->15481 15482 42db1e1 19 API calls 15480->15482 15483 42fe0e1 15481->15483 15485 42eeef0 27 API calls 15481->15485 15484 4343ba6 15482->15484 15483->15445 15484->15484 15486 42fe0bc 15485->15486 15487 42eeb70 33 API calls 15486->15487 15487->15483 15489 43000d9 15488->15489 15505 43000ea _vswprintf_s 15488->15505 15489->15505 15730 42fc07f 15489->15730 15492 4300223 15494 43002ba 15492->15494 15495 430022f 15492->15495 15740 430f99e 15494->15740 15710 430002d 15495->15710 15498 430023c 15503 4344c11 15498->15503 15504 430024a 15498->15504 15509 42dad30 GetPEB 15503->15509 15507 43002d6 GetPEB 15504->15507 15505->15492 15621 42ffda0 15505->15621 15645 42ea8c0 15505->15645 15650 43002f3 15505->15650 15658 43002d6 15505->15658 15662 43003e2 15505->15662 15744 42dad30 GetPEB 15505->15744 15511 430026a 15507->15511 15510 4344c1a 15509->15510 15510->15510 15512 4300274 15511->15512 15736 430b390 15511->15736 15513 431b640 _vswprintf_s 12 API calls 15512->15513 15515 4300287 15513->15515 15515->15453 15517 42f7d50 GetPEB 15516->15517 15518 42db1f1 15517->15518 15519 42db1f9 15518->15519 15520 4334a0e GetPEB 15518->15520 15521 4334a21 GetPEB 15519->15521 15522 42db207 15519->15522 15520->15521 15521->15522 15523 4334a34 15521->15523 15529 42daa16 15522->15529 15524 42f7d50 GetPEB 15523->15524 15525 4334a39 15524->15525 15526 4334a4d 15525->15526 15527 4334a3d GetPEB 15525->15527 15526->15522 15528 4357016 16 API calls 15526->15528 15527->15526 15528->15522 15530 4334458 GetPEB 15529->15530 15531 42daa42 15529->15531 15533 42daa52 _vswprintf_s 15530->15533 15531->15530 15531->15533 15532 431b640 _vswprintf_s 12 API calls 15534 42daa71 15532->15534 15540 42daa64 15533->15540 15769 4305e50 15533->15769 15534->15440 15537 43344e6 15538 43344ee GetPEB 15537->15538 15537->15540 15538->15540 15539 430b230 33 API calls 15541 43344db 15539->15541 15540->15532 15775 42df7a0 15541->15775 15778 42e6a3a 15543->15778 15546 4303792 15548 43003e2 233 API calls 15546->15548 15549 43037a5 15546->15549 15547 43002f3 53 API calls 15554 4303760 15547->15554 15548->15549 15550 43037b9 15549->15550 15551 42dad30 GetPEB 15549->15551 15552 431b640 _vswprintf_s 12 API calls 15550->15552 15551->15550 15553 43037cc 15552->15553 15553->15453 15554->15546 15555 43037d0 15554->15555 15556 430f99e 64 API calls 15555->15556 15556->15549 15558 430f948 15557->15558 15559 430f952 15558->15559 15560 430f97e 15558->15560 15562 430f99e 64 API calls 15559->15562 15793 42e6b6b 15560->15793 15570 430f959 15562->15570 15564 430f967 15566 431b640 _vswprintf_s 12 API calls 15564->15566 15565 434bdad 15568 42dad30 GetPEB 15565->15568 15569 430f97a 15566->15569 15567 43003e2 233 API calls 15567->15570 15571 434bdb6 15568->15571 15569->15453 15570->15564 15570->15565 15571->15571 15573 4355543 15572->15573 15574 4355612 15573->15574 15802 4355767 15573->15802 15575 431b640 _vswprintf_s 12 API calls 15574->15575 15576 435561f 15575->15576 15576->15440 15579 42db171 _vswprintf_s 12 API calls 15579->15574 15581 433a60b 15580->15581 15582 42eb046 15580->15582 15581->15582 15583 433a614 GetPEB 15581->15583 15584 433a627 GetPEB 15582->15584 15585 42eb054 15582->15585 15583->15582 15584->15585 15586 433a63a 15584->15586 15585->15468 15587 42f7d50 GetPEB 15586->15587 15588 433a63f 15587->15588 15589 433a653 15588->15589 15590 433a643 GetPEB 15588->15590 15589->15585 15591 4357016 16 API calls 15589->15591 15590->15589 15591->15585 15594 432ce1e 15592->15594 15593 432cec3 15593->15468 15594->15593 15595 42dc7f9 12 API calls 15594->15595 15595->15594 15597 42e87aa 15596->15597 15598 42e87bd 15596->15598 15599 4319a00 LdrInitializeThunk 15597->15599 15600 42e87d1 15598->15600 15601 42e87fb GetPEB 15598->15601 15613 42e87f2 15598->15613 15599->15598 15602 42e87df 15600->15602 15603 42e849b 19 API calls 15600->15603 15607 42e8826 15601->15607 15604 42e934a 12 API calls 15602->15604 15602->15613 15603->15602 15606 42e87ea 15604->15606 15605 42e88b4 15605->15465 15608 435a9d2 12 API calls 15606->15608 15606->15613 15607->15605 15610 42e8870 15607->15610 15614 42e893d 15607->15614 15609 4339bfe 15608->15609 15611 4355510 12 API calls 15609->15611 15609->15613 15612 42e8a0a 38 API calls 15610->15612 15611->15613 15615 42e887b 15612->15615 15613->15465 15614->15605 15617 43061a0 49 API calls 15614->15617 15615->15605 15616 43061a0 49 API calls 15615->15616 15618 42e891f 15616->15618 15617->15618 15618->15605 15619 43a9d2e 33 API calls 15618->15619 15619->15605 15620->15464 15622 43448e6 15621->15622 15623 42ffdf5 15621->15623 15624 4355510 12 API calls 15622->15624 15625 4301e52 74 API calls 15623->15625 15631 42ffe01 15623->15631 15624->15631 15625->15631 15626 42fffc3 15627 42fffd8 15626->15627 15628 4344b0d 15626->15628 15629 431b640 _vswprintf_s 12 API calls 15627->15629 15630 4355510 12 API calls 15628->15630 15632 42fffe7 15629->15632 15634 4344b29 15630->15634 15631->15626 15633 42e6c0d GetPEB 15631->15633 15643 42ffe9a 15631->15643 15632->15505 15633->15643 15635 42fff7f 15636 42fff8d 15635->15636 15638 4344a3b 15635->15638 15637 43002d6 GetPEB 15636->15637 15641 42fff95 15637->15641 15638->15626 15640 42db6f0 _vswprintf_s 12 API calls 15638->15640 15639 4363ad9 42 API calls 15639->15643 15640->15626 15641->15626 15642 430002d 6 API calls 15641->15642 15642->15626 15643->15626 15643->15635 15643->15639 15644 42e6a3a 53 API calls 15643->15644 15644->15643 15646 42eaab0 GetPEB GetPEB 15645->15646 15649 42ea8f5 15646->15649 15647 431b640 _vswprintf_s 12 API calls 15648 42ea939 15647->15648 15648->15505 15649->15647 15654 4300316 15650->15654 15651 430031f 15652 431b640 _vswprintf_s 12 API calls 15651->15652 15653 4300331 15652->15653 15653->15505 15654->15651 15655 43002d6 GetPEB 15654->15655 15656 4344c30 15655->15656 15657 42e6a3a 53 API calls 15656->15657 15657->15651 15659 43002e1 15658->15659 15660 43002e9 15658->15660 15661 42dad30 GetPEB 15659->15661 15660->15505 15661->15660 15663 4300548 49 API calls 15662->15663 15664 4300408 15663->15664 15665 42eb02a 20 API calls 15664->15665 15671 4300457 15664->15671 15667 4300429 15665->15667 15666 4344c84 GetPEB 15668 4344c97 GetPEB 15666->15668 15669 42f7d50 GetPEB 15667->15669 15670 4344caa 15668->15670 15685 430046d 15668->15685 15669->15671 15673 42f7d50 GetPEB 15670->15673 15671->15666 15672 430045f 15671->15672 15672->15668 15672->15685 15674 4344caf 15673->15674 15675 4344cc3 15674->15675 15676 4344cb3 GetPEB 15674->15676 15680 4357016 16 API calls 15675->15680 15675->15685 15676->15675 15677 4300493 15678 4300535 15677->15678 15679 43004ac 15677->15679 15682 435a7ac 34 API calls 15677->15682 15681 431b640 _vswprintf_s 12 API calls 15678->15681 15683 43199a0 _vswprintf_s LdrInitializeThunk 15679->15683 15690 4300524 15679->15690 15680->15685 15684 4300544 15681->15684 15682->15679 15686 43004c5 15683->15686 15684->15505 15685->15677 15687 43569a6 13 API calls 15685->15687 15688 4344d53 15686->15688 15689 43004cf 15686->15689 15687->15685 15692 4353540 50 API calls 15688->15692 15701 4344d6b 15688->15701 15691 42f7d50 GetPEB 15689->15691 15690->15678 15694 43195d0 _vswprintf_s LdrInitializeThunk 15690->15694 15693 43004d4 15691->15693 15692->15701 15695 4344dd8 GetPEB 15693->15695 15696 43004dc 15693->15696 15694->15678 15697 4344deb GetPEB 15695->15697 15696->15697 15708 43004ea 15696->15708 15698 4344dfe 15697->15698 15697->15708 15700 42f7d50 GetPEB 15698->15700 15699 42db1e1 19 API calls 15699->15693 15703 4344e03 15700->15703 15701->15699 15702 4300511 15702->15678 15705 43195d0 _vswprintf_s LdrInitializeThunk 15702->15705 15706 4344e17 15703->15706 15707 4344e07 GetPEB 15703->15707 15704 42e7f65 227 API calls 15704->15702 15705->15690 15706->15708 15709 4357016 16 API calls 15706->15709 15707->15706 15708->15702 15708->15704 15709->15708 15711 42f7d50 GetPEB 15710->15711 15712 4300037 15711->15712 15713 4344b31 GetPEB 15712->15713 15714 4300049 15712->15714 15715 4344b41 15713->15715 15714->15715 15716 4300059 15714->15716 15718 42f7d50 GetPEB 15715->15718 15717 42f7d50 GetPEB 15716->15717 15722 430005e 15717->15722 15719 4344b46 15718->15719 15719->15722 15723 4344b4a GetPEB 15719->15723 15720 4344b66 GetPEB 15724 4344b76 GetPEB 15720->15724 15721 4300066 15721->15724 15728 430006f 15721->15728 15722->15720 15722->15721 15722->15728 15723->15722 15725 4344b89 15724->15725 15724->15728 15726 42f7d50 GetPEB 15725->15726 15727 4344b8e 15726->15727 15727->15728 15729 4344b92 GetPEB 15727->15729 15728->15498 15746 4356dc9 GetPEB 15728->15746 15729->15728 15731 42fc098 _vswprintf_s 15730->15731 15732 432e232 15731->15732 15734 4355510 12 API calls 15731->15734 15735 42fc0a0 15731->15735 15733 4356cf0 20 API calls 15732->15733 15733->15735 15734->15732 15735->15505 15739 430b3aa 15736->15739 15737 430b3d3 15737->15512 15738 430b3dc GetPEB 15738->15737 15739->15737 15739->15738 15741 430f9ba 15740->15741 15742 430fa3f 15741->15742 15743 430fab0 64 API calls 15741->15743 15742->15498 15743->15742 15745 42dad48 15744->15745 15745->15505 15747 4356e09 15746->15747 15748 42f7d50 GetPEB 15747->15748 15762 4356fd8 15747->15762 15749 4356e55 15748->15749 15750 4356e6e _vswprintf_s 15749->15750 15751 4356e5e GetPEB 15749->15751 15752 4356e82 GetPEB 15750->15752 15751->15750 15753 4356e93 15752->15753 15754 435795d 56 API calls 15753->15754 15753->15762 15755 4356eb1 15754->15755 15756 435795d 56 API calls 15755->15756 15755->15762 15757 4356ec8 15756->15757 15758 435795d 56 API calls 15757->15758 15759 4356ed9 15758->15759 15760 435795d 56 API calls 15759->15760 15761 4356eeb GetPEB 15760->15761 15763 4356f06 15761->15763 15762->15498 15763->15762 15764 42f7d50 GetPEB 15763->15764 15765 4356fa1 15764->15765 15766 4356fa5 GetPEB 15765->15766 15767 4356fb4 _vswprintf_s 15765->15767 15766->15767 15768 4356fc7 GetPEB 15767->15768 15768->15762 15770 4305e5d 15769->15770 15771 42ef820 47 API calls 15770->15771 15774 4305e76 15770->15774 15772 4305e70 15771->15772 15773 42dcc50 33 API calls 15772->15773 15772->15774 15773->15774 15774->15537 15774->15539 15776 42df7c0 35 API calls 15775->15776 15777 42df7b5 15776->15777 15777->15537 15779 433914e 15778->15779 15780 42e6a57 15778->15780 15781 4355510 12 API calls 15779->15781 15782 42e6a66 15780->15782 15783 4310adf 53 API calls 15780->15783 15788 42e6a98 _vswprintf_s 15781->15788 15786 42e6c0d GetPEB 15782->15786 15782->15788 15791 42e6ad1 15782->15791 15783->15782 15784 42e6b18 15784->15546 15784->15547 15785 4355510 12 API calls 15787 4339209 15785->15787 15786->15788 15789 42e6b6b 52 API calls 15788->15789 15788->15791 15790 42e6acb 15789->15790 15790->15791 15792 43002d6 GetPEB 15790->15792 15791->15784 15791->15785 15792->15791 15794 42f4120 51 API calls 15793->15794 15795 42e6b99 15794->15795 15798 4339211 15795->15798 15799 42e6ba5 15795->15799 15796 431b640 _vswprintf_s 12 API calls 15797 42e6be5 15796->15797 15797->15567 15797->15570 15800 42dad30 GetPEB 15798->15800 15799->15796 15801 4339219 15800->15801 15801->15801 15803 4355775 15802->15803 15804 43557a9 12 API calls 15803->15804 15805 43555f6 15803->15805 15804->15805 15805->15579 15806 43a2fbd 15807 43a2fe4 15806->15807 15808 431b640 _vswprintf_s 12 API calls 15807->15808 15809 43a30f0 15808->15809 15810 42d0b60 15811 42d0b72 15810->15811 15813 42d0baf 15810->15813 15811->15813 15814 42d0bd0 15811->15814 15815 42d0c66 15814->15815 15820 42d0c05 15814->15820 15816 432e940 15815->15816 15817 432e915 15815->15817 15821 42d0c8d _vswprintf_s 15815->15821 15819 4321700 12 API calls 15816->15819 15816->15821 15817->15821 15823 4321700 15817->15823 15819->15821 15820->15815 15820->15821 15822 4321700 12 API calls 15820->15822 15821->15813 15822->15820 15826 43214e9 15823->15826 15825 432171c 15825->15821 15828 43214fb 15826->15828 15827 431b58e _vswprintf_s 12 API calls 15829 432150e __cftof 15827->15829 15828->15827 15828->15829 15829->15825 15830 43035a1 15831 43035a7 15830->15831 15832 43035b7 15831->15832 15833 43035b8 GetPEB 15831->15833 15834 42eeb70 33 API calls 15833->15834 15834->15832 14918 43a5ba5 14919 43a5bb4 _vswprintf_s 14918->14919 14921 43a4c56 12 API calls 14919->14921 14923 43a5c2a _vswprintf_s 14919->14923 14926 43a5c10 14919->14926 14920 432d130 _vswprintf_s 12 API calls 14922 43a63e5 14920->14922 14921->14923 14925 4316de6 32 API calls 14923->14925 14923->14926 14927 43a60cf GetPEB 14923->14927 14928 4319710 LdrInitializeThunk 14923->14928 14925->14923 14926->14920 14927->14923 14928->14923 15835 439131b 15836 42f7d50 GetPEB 15835->15836 15837 439134d 15836->15837 15838 4391351 GetPEB 15837->15838 15839 4391361 _vswprintf_s 15837->15839 15838->15839 15840 431b640 _vswprintf_s 12 API calls 15839->15840 15841 4391384 15840->15841 15842 435b111 15843 435b143 15842->15843 15844 435b131 15842->15844 15846 43621b7 15844->15846 15849 431e3a0 15846->15849 15852 431e3bd 15849->15852 15851 431e3b8 15851->15843 15853 431e3e3 15852->15853 15854 431e3cc 15852->15854 15856 431b58e _vswprintf_s 12 API calls 15853->15856 15857 431e3d8 _vswprintf_s 15853->15857 15855 431b58e _vswprintf_s 12 API calls 15854->15855 15855->15857 15856->15857 15857->15851 15858 42d1e04 15859 42d1e10 _vswprintf_s 15858->15859 15860 439a80d 28 API calls 15859->15860 15861 42d1e37 _vswprintf_s 15859->15861 15862 432f18b 15860->15862 15863 42d9240 15864 42d924c _vswprintf_s 15863->15864 15865 42d925f 15864->15865 15881 43195d0 LdrInitializeThunk 15864->15881 15882 42d9335 15865->15882 15869 42d9335 LdrInitializeThunk 15870 42d9276 15869->15870 15887 43195d0 LdrInitializeThunk 15870->15887 15872 42d927e GetPEB 15873 42f77f0 15872->15873 15874 42d929a GetPEB 15873->15874 15875 42f77f0 15874->15875 15876 42d92b6 GetPEB 15875->15876 15877 42d92d2 15876->15877 15878 42d9330 15877->15878 15879 42d9305 GetPEB 15877->15879 15880 42d931f _vswprintf_s 15879->15880 15881->15865 15888 43195d0 LdrInitializeThunk 15882->15888 15884 42d9342 15889 43195d0 LdrInitializeThunk 15884->15889 15886 42d926b 15886->15869 15887->15872 15888->15884 15889->15886 14934 4319540 LdrInitializeThunk 15897 438d380 15898 438d393 15897->15898 15899 438d38c 15897->15899 15900 438d3a0 GetPEB 15898->15900 15900->15899 15901 43036cc 15902 43036d4 GetPEB 15901->15902 15903 43036e6 15901->15903 15904 43036e5 15902->15904 15905 42d1190 15906 42d11a0 15905->15906 15908 42d11be 15905->15908 15906->15908 15909 42d11e0 15906->15909 15912 42d1204 15909->15912 15910 431b640 _vswprintf_s 12 API calls 15911 42d1296 15910->15911 15911->15908 15912->15910 15913 43237cc 15914 43237db 15913->15914 15915 43237ea 15914->15915 15917 432590b 15914->15917 15918 4325917 15917->15918 15921 432592d 15917->15921 15919 431b58e _vswprintf_s 12 API calls 15918->15919 15920 4325923 15919->15920 15920->15915 15921->15915

                                                Executed Functions

                                                Function 04319860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 12 4319860-431986c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 9b37a4fbcb5b050a97f1322b25e6eabb7b403ce478a3638f3560885fa3c4cdc3
                                                • Instruction ID: 4a59a143ea55d20b1a90f2d5d7fe082d3a0b2da3e6a95d22b419d15868b1bf61
                                                • Opcode Fuzzy Hash: 9b37a4fbcb5b050a97f1322b25e6eabb7b403ce478a3638f3560885fa3c4cdc3
                                                • Instruction Fuzzy Hash: 9A90027520102413F11161594604707100997D0295FA1E422A4415558D9696D952B1A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 11 4319840-431984c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: e843d44995f5181cce5ca4ae512f898f7550002b428e7d9bd9b0bc0372332f65
                                                • Instruction ID: a7b05ae2b4e810ddb57564046a79f5c7b82121f9f227f66769384bd7b6d42315
                                                • Opcode Fuzzy Hash: e843d44995f5181cce5ca4ae512f898f7550002b428e7d9bd9b0bc0372332f65
                                                • Instruction Fuzzy Hash: F9900275242061527545B15945045075006A7E02957A1E022A5405950C8566E856E6A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 043198F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 13 43198f0-43198fc LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 91d44f3e32955f3bc2004f2a108dd5d7db24fe14ba08a15173ee8d738a881f91
                                                • Instruction ID: 952cd7f45852bfaab623540a5359ecec6a84b72c6374609ea5d0791af6fe9a8e
                                                • Opcode Fuzzy Hash: 91d44f3e32955f3bc2004f2a108dd5d7db24fe14ba08a15173ee8d738a881f91
                                                • Instruction Fuzzy Hash: D090027560102502F10171594504616100A97D0295FA1E032A5015555ECA65D992B1B1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 14 4319910-431991c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 19462d13124dbcf2ae3414793316f29882cd820b41b1820530df7a64179b2446
                                                • Instruction ID: 1991f2b268f70328480027e17e68eee2837d2c9c3052a2307b617739a203b9ff
                                                • Opcode Fuzzy Hash: 19462d13124dbcf2ae3414793316f29882cd820b41b1820530df7a64179b2446
                                                • Instruction Fuzzy Hash: 6A9002B520102402F14071594504746100597D0355F61E021A9055554E8699DDD576E5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 4 4319540-431954c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: a9654db222854ee8b0b659a278db681f87766f937657ffd8704ae6e55f78e86b
                                                • Instruction ID: 5ffe306b3858c0a7c45d594eb4d6b0da52a659fc926f02b6a2f1c1280f286951
                                                • Opcode Fuzzy Hash: a9654db222854ee8b0b659a278db681f87766f937657ffd8704ae6e55f78e86b
                                                • Instruction Fuzzy Hash: D3900279211020032105A5590704507104697D53A5361E031F5006550CD661D86161A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 043199A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 15 43199a0-43199ac LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 497167687e4b8bd1bba301bdde361f554626288f21a06d220872b5c815eb21bd
                                                • Instruction ID: e1a7317230f4650afef0dd785b8a46ee68dc96112888cf7009f2aa9111a2a821
                                                • Opcode Fuzzy Hash: 497167687e4b8bd1bba301bdde361f554626288f21a06d220872b5c815eb21bd
                                                • Instruction Fuzzy Hash: DF9002B534102442F10061594514B061005D7E1355F61E025E5055554D8659DC5271A6
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 043195D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 5 43195d0-43195dc LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: d4fe9534ce3258de1018d8225e401b03a76f59b147cdd4962171fe17e76146a7
                                                • Instruction ID: 8702e08ab237b788c8f8ed126033e26f3d2dfb3401056691d8569bfff326048e
                                                • Opcode Fuzzy Hash: d4fe9534ce3258de1018d8225e401b03a76f59b147cdd4962171fe17e76146a7
                                                • Instruction Fuzzy Hash: 679002B520202003610571594514616500A97E0255B61E031E5005590DC565D89171A5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 17 4319a20-4319a2c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 24e242b071dd60ab76331eaf2167ea68cbcebbe6849ded299fc52d2013961208
                                                • Instruction ID: 3ef267d7438fd8013ac42bf7d5535fbf90e2c1bb0807f89b49f31c20bea6818a
                                                • Opcode Fuzzy Hash: 24e242b071dd60ab76331eaf2167ea68cbcebbe6849ded299fc52d2013961208
                                                • Instruction Fuzzy Hash: 4A900275601020426140716989449065005BBE1265761E131A4989550D8599D86566E5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 16 4319a00-4319a0c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 5124f5eb6804fcfc90740ebf61e02e09491150ef1bc595e593ca6ac3c98e364e
                                                • Instruction ID: bb1a12b3e55ce66fe268281c002a5f2433c99d5fdd84064e0dfc680610ce0662
                                                • Opcode Fuzzy Hash: 5124f5eb6804fcfc90740ebf61e02e09491150ef1bc595e593ca6ac3c98e364e
                                                • Instruction Fuzzy Hash: 8D90027520142402F1006159491470B100597D0356F61E021A5155555D8665D85175F1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 6 4319660-431966c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 1d646701a98eb97ad289e26e76acea0b90fdfa5008530619084f8c54feb5bba7
                                                • Instruction ID: 4c1e8a1168c5dcd4797b3c630f34c36de2397d4ca12647ddee3c938ba6ebc18e
                                                • Opcode Fuzzy Hash: 1d646701a98eb97ad289e26e76acea0b90fdfa5008530619084f8c54feb5bba7
                                                • Instruction Fuzzy Hash: 2D90027520102802F1807159450464A100597D1355FA1E025A4016654DCA55DA5977E1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: cb406fc8827ebcffa055d3ac740e7777e9af46d169f9d2d6f882ced48a56efeb
                                                • Instruction ID: 2d32b04653f684ad140f93717e38755710db993814c463db4dcf01c781bd612d
                                                • Opcode Fuzzy Hash: cb406fc8827ebcffa055d3ac740e7777e9af46d169f9d2d6f882ced48a56efeb
                                                • Instruction Fuzzy Hash: 3F90027521182042F20065694D14B07100597D0357F61E125A4145554CC955D86165A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 043196E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 7 43196e0-43196ec LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 8642ba45c2185337ad40b5bb896df1a43c7a1e8c5ee1ce1f2321fae386414dbe
                                                • Instruction ID: 3843205f6f7dd70f41a46855937d5c86dd80bfabda35d7b61047e5608532ced0
                                                • Opcode Fuzzy Hash: 8642ba45c2185337ad40b5bb896df1a43c7a1e8c5ee1ce1f2321fae386414dbe
                                                • Instruction Fuzzy Hash: D39002752010A802F1106159850474A100597D0355F65E421A8415658D86D5D89171A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 8 4319710-431971c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 70b979d75d39f993fba449e5ca6edd15733df38f676dbae69b1add5966d6895c
                                                • Instruction ID: 602f688eedb47bb5b5b1c1a40c70272a2726ab199cf88f740b57e013861d0d8f
                                                • Opcode Fuzzy Hash: 70b979d75d39f993fba449e5ca6edd15733df38f676dbae69b1add5966d6895c
                                                • Instruction Fuzzy Hash: AC90027520102402F10065995508646100597E0355F61F021A9015555EC6A5D89171B1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 043197A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 10 43197a0-43197ac LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 8ae93a634cc617cf57a605a7df7438b73d0d12f99fb0e7c6a4ec6fdd7717c0f4
                                                • Instruction ID: 97b894b484218beac1b6ef5989c9acc2a145f92f1d4714eb26fe6dd990458578
                                                • Opcode Fuzzy Hash: 8ae93a634cc617cf57a605a7df7438b73d0d12f99fb0e7c6a4ec6fdd7717c0f4
                                                • Instruction Fuzzy Hash: 8290027530102003F140715955186065005E7E1355F61F021E4405554CD955D85662A2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 9 4319780-431978c LdrInitializeThunk
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 9ac56707cddf0c10ca954202d27f3630d31b758fbfccd9a9c261f02e96a662ed
                                                • Instruction ID: cfec5bc272279e7272cc6242818dea7954da5b0dc1863145a5bffb1d5ea99a0d
                                                • Opcode Fuzzy Hash: 9ac56707cddf0c10ca954202d27f3630d31b758fbfccd9a9c261f02e96a662ed
                                                • Instruction Fuzzy Hash: 4190027D21302002F1807159550860A100597D1256FA1F425A4006558CC955D86963A1
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 04319FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 9e04bc6f13ea4c7195b9ca15fab942fbebe269c6418bdfa6607b65aa7f428353
                                                • Instruction ID: 0142ff0a463239e9b29bff7ea229130600e21cd431f1e8f0032c501fdfbd9cd7
                                                • Opcode Fuzzy Hash: 9e04bc6f13ea4c7195b9ca15fab942fbebe269c6418bdfa6607b65aa7f428353
                                                • Instruction Fuzzy Hash: 2590027531116402F11061598504706100597D1255F61E421A4815558D86D5D89171A2
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Function 0431967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 0 431967a-431967f 1 4319681-4319688 0->1 2 431968f-4319696 LdrInitializeThunk 0->2
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: InitializeThunk
                                                • String ID:
                                                • API String ID: 2994545307-0
                                                • Opcode ID: 7728658aa10f3c2b8913c1651bb11dbc2468fbefa0cb5fa094846bc4e59b1bdc
                                                • Instruction ID: 9ff1614067798f366d2aa5130c97bbdeffe9234abe115f32b1373b7e98150c24
                                                • Opcode Fuzzy Hash: 7728658aa10f3c2b8913c1651bb11dbc2468fbefa0cb5fa094846bc4e59b1bdc
                                                • Instruction Fuzzy Hash: 56B09BB19015D5C5F715D760470871779007BD0755F26D061D2020641A4778D091F5F5
                                                Uniqueness

                                                Uniqueness Score: -1.00%

                                                Non-executed Functions

                                                Function 0436FDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                                Download Yara Rule
                                                C-Code - Quality: 53%
                                                			E0436FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0431CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04365720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04365720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                                0x0436fdda
                                                0x0436fde2
                                                0x0436fde5
                                                0x0436fdec
                                                0x0436fdfa
                                                0x0436fdff
                                                0x0436fe0a
                                                0x0436fe0f
                                                0x0436fe17
                                                0x0436fe1e
                                                0x0436fe19
                                                0x0436fe19
                                                0x0436fe19
                                                0x0436fe20
                                                0x0436fe21
                                                0x0436fe22
                                                0x0436fe25
                                                0x0436fe40

                                                APIs
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0436FDFA
                                                Strings
                                                • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0436FE2B
                                                • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0436FE01
                                                Memory Dump Source
                                                • Source File: 00000013.00000002.540531244.00000000042B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 042B0000, based on PE: true
                                                • Associated: 00000013.00000002.540889198.00000000043CB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                • Associated: 00000013.00000002.540918949.00000000043CF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_19_2_42b0000_DpiScaling.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                                • API String ID: 885266447-3903918235
                                                • Opcode ID: 3394c4984cb9d6e7c73a5b9c0d7f8b3a515d95a4b089507c4066a7bb5c86a936
                                                • Instruction ID: a0335960b2d73716fb9b92372c359b02fd9ce5e5b39f23cabb010375a66800f0
                                                • Opcode Fuzzy Hash: 3394c4984cb9d6e7c73a5b9c0d7f8b3a515d95a4b089507c4066a7bb5c86a936
                                                • Instruction Fuzzy Hash: 0BF0F632640602BFE6241A45EC02F23BF5AEF44730F145314F628565E1EA62F83096F8
                                                Uniqueness

                                                Uniqueness Score: -1.00%