Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ziraat Bankasi Swift Mesaji.exe

Overview

General Information

Sample Name:Ziraat Bankasi Swift Mesaji.exe
Analysis ID:635281
MD5:d891e26c0707977398e963d6076eeae1
SHA1:039457a2c4d73c24ef410a7665a04e9d456019e7
SHA256:2979a77144d0df70f4dff084420d8e034eb6f751027fa44d158de924960f2a6a
Tags:exeFormbookgeoTURZiraatBank
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Self deletion via cmd or bat file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Ziraat Bankasi Swift Mesaji.exe (PID: 6344 cmdline: "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe" MD5: D891E26C0707977398E963D6076EEAE1)
    • Ziraat Bankasi Swift Mesaji.exe (PID: 6572 cmdline: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe MD5: D891E26C0707977398E963D6076EEAE1)
      • explorer.exe (PID: 3808 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • control.exe (PID: 4708 cmdline: C:\Windows\SysWOW64\control.exe MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)
          • cmd.exe (PID: 3736 cmdline: /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • explorer.exe (PID: 1388 cmdline: explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.wwohead.com/ah6m/"], "decoy": ["saudeybeleza.com", "ethereumtiger.business", "thesoupproject.net", "cedarwoodtownhomesnp.com", "gyascool.com", "gosourcecap.com", "womeninnetworking.net", "nahade-gostar.com", "dcman900.com", "mirrorparcel.com", "lamowlettu.xyz", "glencoreprocurement.com", "codsini.com", "thripear.space", "movierepository.com", "51cdfang.com", "hananiabeauty.store", "mortgagemanuas.com", "remotingpeople.com", "myimpressivefashion.com", "northhamptonapartments.com", "lostinsmokemint.xyz", "sebhbr.xyz", "hummingbirdfeederhat.com", "maplebakers.com", "unwrapmelingerie.com", "felipekamakura.com", "stringm.com", "ukgdimensions.red", "shopofplaythings.com", "jinlebao.com", "alenapolozkova.com", "aerialdatainc.com", "metaverseiop.com", "yuh-gal-p.xyz", "thebluejaybuilder.com", "my-mallorca.estate", "experteee.com", "difan-mobile.com", "postalhistoryworld.com", "codifyrear.xyz", "cankiribelediyespor.net", "alizandracloset.com", "everythingmandab.com", "africabet365.bet", "ww223343.com", "xpresslinkshippement.com", "xiaochunge.top", "parkerbeautyfragrance.com", "makerthejackets.com", "souldig.xyz", "irstaxbenfits.com", "audiopilot.xyz", "theguaranteedadmissions.com", "nontradebulkcement.online", "alltinyildiz.com", "celestialtherapy.net", "11milliondreams.com", "matadorbet182.com", "gabimejia.com", "planet-ideam.com", "os00hpaeo4hu726fp.life", "etudier-medecine-roumanie.com", "zilong88.top"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x18839:$sqlite3step: 68 34 1C 7B E1
    • 0x1894c:$sqlite3step: 68 34 1C 7B E1
    • 0x18868:$sqlite3text: 68 38 2A 90 C5
    • 0x1898d:$sqlite3text: 68 38 2A 90 C5
    • 0x1887b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
    0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 33 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
      • 0x4f7eb:$s1: file:///
      • 0x4f6fb:$s2: {11111-22222-10009-11112}
      • 0x4f77b:$s3: {11111-22222-50001-00000}
      • 0x4cc15:$s4: get_Module
      • 0x4d05b:$s5: Reverse
      • 0x4f02a:$s6: BlockCopy
      • 0x4ee6e:$s7: ReadByte
      • 0x4f7fd:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
      0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
        • 0x80d9b:$s1: file:///
        • 0x80cab:$s2: {11111-22222-10009-11112}
        • 0x80d2b:$s3: {11111-22222-50001-00000}
        • 0x7e1c5:$s4: get_Module
        • 0x7e60b:$s5: Reverse
        • 0x805da:$s6: BlockCopy
        • 0x8041e:$s7: ReadByte
        • 0x80dad:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
        0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0xc2ed8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0xc3142:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0xcec75:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0xce761:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0xced77:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0xceeef:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0xc3b5a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0xcd9dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xc4853:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0xd4ee7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0xd5eea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0xd1e09:$sqlite3step: 68 34 1C 7B E1
        • 0xd1f1c:$sqlite3step: 68 34 1C 7B E1
        • 0xd1e38:$sqlite3text: 68 38 2A 90 C5
        • 0xd1f5d:$sqlite3text: 68 38 2A 90 C5
        • 0xd1e4b:$sqlite3blob: 68 53 D8 7F 8C
        • 0xd1f73:$sqlite3blob: 68 53 D8 7F 8C
        Click to see the 31 entries

        Sigma Signatures

        ⊘No Sigma rule has matched

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Found malware configuration
        Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.wwohead.com/ah6m/"], "decoy": ["saudeybeleza.com", "ethereumtiger.business", "thesoupproject.net", "cedarwoodtownhomesnp.com", "gyascool.com", "gosourcecap.com", "womeninnetworking.net", "nahade-gostar.com", "dcman900.com", "mirrorparcel.com", "lamowlettu.xyz", "glencoreprocurement.com", "codsini.com", "thripear.space", "movierepository.com", "51cdfang.com", "hananiabeauty.store", "mortgagemanuas.com", "remotingpeople.com", "myimpressivefashion.com", "northhamptonapartments.com", "lostinsmokemint.xyz", "sebhbr.xyz", "hummingbirdfeederhat.com", "maplebakers.com", "unwrapmelingerie.com", "felipekamakura.com", "stringm.com", "ukgdimensions.red", "shopofplaythings.com", "jinlebao.com", "alenapolozkova.com", "aerialdatainc.com", "metaverseiop.com", "yuh-gal-p.xyz", "thebluejaybuilder.com", "my-mallorca.estate", "experteee.com", "difan-mobile.com", "postalhistoryworld.com", "codifyrear.xyz", "cankiribelediyespor.net", "alizandracloset.com", "everythingmandab.com", "africabet365.bet", "ww223343.com", "xpresslinkshippement.com", "xiaochunge.top", "parkerbeautyfragrance.com", "makerthejackets.com", "souldig.xyz", "irstaxbenfits.com", "audiopilot.xyz", "theguaranteedadmissions.com", "nontradebulkcement.online", "alltinyildiz.com", "celestialtherapy.net", "11milliondreams.com", "matadorbet182.com", "gabimejia.com", "planet-ideam.com", "os00hpaeo4hu726fp.life", "etudier-medecine-roumanie.com", "zilong88.top"]}
        Multi AV Scanner detection for submitted file
        Source: Ziraat Bankasi Swift Mesaji.exeReversingLabs: Detection: 21%
        Yara detected FormBook
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Antivirus detection for URL or domain
        Source: www.wwohead.com/ah6m/Avira URL Cloud: Label: malware
        Source: http://www.wwohead.com/ah6m/Avira URL Cloud: Label: malware
        Source: http://www.wwohead.com/ah6m/www.51cdfang.comAvira URL Cloud: Label: malware
        Source: http://www.stringm.com/ah6m/Avira URL Cloud: Label: malware
        Source: http://www.stringm.com/ah6m/www.yuh-gal-p.xyzAvira URL Cloud: Label: malware
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
        Source: Binary string: control.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512357918.0000000001900000.00000040.10000000.00040000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511820567.0000000001549000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.406485483.00000000017EE000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513084585.0000000001A9F000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512556950.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.404458480.0000000001647000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.512780050.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.510727580.0000000004AF3000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.406485483.00000000017EE000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513084585.0000000001A9F000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512556950.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.404458480.0000000001647000.00000004.00000800.00020000.00000000.sdmp, control.exe, control.exe, 0000000B.00000003.512780050.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.510727580.0000000004AF3000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\FRJeWenFHc\src\obj\x86\Debug\CallingConvent.pdb source: Ziraat Bankasi Swift Mesaji.exe, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000000.401671865.0000000000D72000.00000002.00000001.01000000.00000003.sdmp, control.exe, 0000000B.00000002.666266960.000000000535F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000000.615015403.00000000069EF000.00000004.80000000.00040000.00000000.sdmp
        Source: Binary string: control.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512357918.0000000001900000.00000040.10000000.00040000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511820567.0000000001549000.00000004.00000020.00020000.00000000.sdmp

        Networking

        barindex
        C2 URLs / IPs found in malware configuration
        Source: Malware configuration extractorURLs: www.wwohead.com/ah6m/
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
        Source: explorer.exe, 00000004.00000000.463834252.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.442686652.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.411056762.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.498956126.00000000026D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobY
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.51cdfang.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.51cdfang.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.51cdfang.com/ah6m/www.theguaranteedadmissions.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.51cdfang.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aerialdatainc.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aerialdatainc.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aerialdatainc.com/ah6m/www.planet-ideam.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aerialdatainc.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alltinyildiz.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alltinyildiz.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alltinyildiz.com/ah6m/www.xiaochunge.top
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alltinyildiz.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.difan-mobile.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.difan-mobile.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.difan-mobile.com/ah6m/www.nontradebulkcement.online
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.difan-mobile.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.everythingmandab.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.everythingmandab.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.everythingmandab.com/ah6m/www.stringm.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.everythingmandab.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gabimejia.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gabimejia.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gabimejia.com/ah6m/www.wwohead.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gabimejia.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.glencoreprocurement.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.glencoreprocurement.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.glencoreprocurement.com/ah6m/www.thesoupproject.net
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.glencoreprocurement.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.hummingbirdfeederhat.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.hummingbirdfeederhat.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.hummingbirdfeederhat.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nontradebulkcement.online
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nontradebulkcement.online/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nontradebulkcement.online/ah6m/www.hummingbirdfeederhat.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nontradebulkcement.onlineReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planet-ideam.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planet-ideam.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planet-ideam.com/ah6m/www.glencoreprocurement.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planet-ideam.comReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.stringm.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.stringm.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.stringm.com/ah6m/www.yuh-gal-p.xyz
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.stringm.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theguaranteedadmissions.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theguaranteedadmissions.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theguaranteedadmissions.com/ah6m/www.aerialdatainc.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theguaranteedadmissions.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.thesoupproject.net
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.thesoupproject.net/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.thesoupproject.net/ah6m/www.everythingmandab.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.thesoupproject.netReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wwohead.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wwohead.com/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wwohead.com/ah6m/www.51cdfang.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wwohead.comReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xiaochunge.top
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xiaochunge.top/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xiaochunge.top/ah6m/www.difan-mobile.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xiaochunge.topReferer:
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yuh-gal-p.xyz
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yuh-gal-p.xyz/ah6m/
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yuh-gal-p.xyz/ah6m/www.alltinyildiz.com
        Source: explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yuh-gal-p.xyzReferer:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
        Source: Ziraat Bankasi Swift Mesaji.exeString found in binary or memory: https://github.com
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000000.359661923.0000000000EB2000.00000002.00000001.01000000.00000003.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000000.401671865.0000000000D72000.00000002.00000001.01000000.00000003.sdmp, control.exe, 0000000B.00000002.666266960.000000000535F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000000.615015403.00000000069EF000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/dcoetzee/plants-vs-zombies-user-file-editor
        Source: unknownDNS traffic detected: queries for: www.gabimejia.com

        E-Banking Fraud

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.7b70000.9.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.7b70000.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.414265819.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects zgRAT Author: ditekSHen
        Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: Process Memory Space: explorer.exe PID: 1388, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.7b70000.9.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.7b70000.9.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000000.00000002.414265819.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
        Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: Process Memory Space: explorer.exe PID: 1388, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00EB47140_2_00EB4714
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_0322F0710_2_0322F071
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_0322F0800_2_0322F080
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_0322D65C0_2_0322D65C
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_004010302_2_00401030
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_004012FB2_2_004012FB
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041D5C22_2_0041D5C2
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041EDE52_2_0041EDE5
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00402D872_2_00402D87
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00402D902_2_00402D90
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00409E4B2_2_00409E4B
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00409E502_2_00409E50
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041E6132_2_0041E613
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00402FB02_2_00402FB0
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041DFB22_2_0041DFB2
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00D747142_2_00D74714
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6B09011_2_04E6B090
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F1100211_2_04F11002
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6841F11_2_04E6841F
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6D5E011_2_04E6D5E0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8258111_2_04E82581
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F21D5511_2_04F21D55
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E50D2011_2_04E50D20
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7412011_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5F90011_2_04E5F900
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E76E3011_2_04E76E30
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8EBB011_2_04E8EBB0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B92D9011_2_00B92D90
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B92D8711_2_00B92D87
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAEDE511_2_00BAEDE5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAD5C211_2_00BAD5C2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAE61311_2_00BAE613
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B99E5011_2_00B99E50
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B99E4B11_2_00B99E4B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BADFB211_2_00BADFB2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B92FB011_2_00B92FB0
        Source: C:\Windows\SysWOW64\control.exeCode function: String function: 04E5B150 appears 32 times
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A350 NtCreateFile,2_2_0041A350
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A400 NtReadFile,2_2_0041A400
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A480 NtClose,2_2_0041A480
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A530 NtAllocateVirtualMemory,2_2_0041A530
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A34A NtCreateFile,2_2_0041A34A
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A3FA NtReadFile,2_2_0041A3FA
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A3A4 NtReadFile,2_2_0041A3A4
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A47A NtClose,2_2_0041A47A
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041A52A NtAllocateVirtualMemory,2_2_0041A52A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99860 NtQuerySystemInformation,LdrInitializeThunk,11_2_04E99860
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99840 NtDelayExecution,LdrInitializeThunk,11_2_04E99840
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E995D0 NtClose,LdrInitializeThunk,11_2_04E995D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E999A0 NtCreateSection,LdrInitializeThunk,11_2_04E999A0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99540 NtReadFile,LdrInitializeThunk,11_2_04E99540
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99910 NtAdjustPrivilegesToken,LdrInitializeThunk,11_2_04E99910
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E996E0 NtFreeVirtualMemory,LdrInitializeThunk,11_2_04E996E0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E996D0 NtCreateKey,LdrInitializeThunk,11_2_04E996D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99660 NtAllocateVirtualMemory,LdrInitializeThunk,11_2_04E99660
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99A50 NtCreateFile,LdrInitializeThunk,11_2_04E99A50
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99650 NtQueryValueKey,LdrInitializeThunk,11_2_04E99650
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99FE0 NtCreateMutant,LdrInitializeThunk,11_2_04E99FE0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99780 NtMapViewOfSection,LdrInitializeThunk,11_2_04E99780
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99710 NtQueryInformationToken,LdrInitializeThunk,11_2_04E99710
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E998F0 NtReadVirtualMemory,11_2_04E998F0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E998A0 NtWriteVirtualMemory,11_2_04E998A0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9B040 NtSuspendThread,11_2_04E9B040
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99820 NtEnumerateKey,11_2_04E99820
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E995F0 NtQueryInformationFile,11_2_04E995F0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E999D0 NtCreateProcessEx,11_2_04E999D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99560 NtWriteFile,11_2_04E99560
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99950 NtQueueApcThread,11_2_04E99950
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99520 NtWaitForSingleObject,11_2_04E99520
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9AD30 NtSetContextThread,11_2_04E9AD30
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99A80 NtOpenDirectoryObject,11_2_04E99A80
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99670 NtQueryInformationProcess,11_2_04E99670
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99A20 NtResumeThread,11_2_04E99A20
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99A00 NtProtectVirtualMemory,11_2_04E99A00
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99610 NtEnumerateValueKey,11_2_04E99610
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99A10 NtQuerySection,11_2_04E99A10
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E997A0 NtUnmapViewOfSection,11_2_04E997A0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9A3B0 NtGetContextThread,11_2_04E9A3B0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99760 NtOpenProcess,11_2_04E99760
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99770 NtSetInformationFile,11_2_04E99770
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9A770 NtOpenThread,11_2_04E9A770
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99730 NtQueryVirtualMemory,11_2_04E99730
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E99B00 NtSetValueKey,11_2_04E99B00
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9A710 NtOpenProcessToken,11_2_04E9A710
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA350 NtCreateFile,11_2_00BAA350
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA480 NtClose,11_2_00BAA480
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA400 NtReadFile,11_2_00BAA400
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA530 NtAllocateVirtualMemory,11_2_00BAA530
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA3A4 NtReadFile,11_2_00BAA3A4
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA3FA NtReadFile,11_2_00BAA3FA
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA34A NtCreateFile,11_2_00BAA34A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA47A NtClose,11_2_00BAA47A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAA52A NtAllocateVirtualMemory,11_2_00BAA52A
        Source: Ziraat Bankasi Swift Mesaji.exeBinary or memory string: OriginalFilename vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.408614251.0000000003316000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCerbera.dll" vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000000.359661923.0000000000EB2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCallingConvent.exe" vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.414265819.0000000007B70000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exeBinary or memory string: OriginalFilename vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511820567.0000000001549000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCONTROL.EXEj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000000.401671865.0000000000D72000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCallingConvent.exe" vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.406994742.000000000190D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511857898.0000000001570000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCONTROL.EXEj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.404655843.000000000175D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513084585.0000000001A9F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513713382.0000000001C2F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512487847.0000000001905000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCONTROL.EXEj% vs Ziraat Bankasi Swift Mesaji.exe
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
        Source: Ziraat Bankasi Swift Mesaji.exeReversingLabs: Detection: 21%
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
        Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\explorer.exe explorer.exe
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeJump to behavior
        Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"Jump to behavior
        Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{317D06E8-5F24-433D-BDF7-79CE68D8ABC2}\InProcServer32Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji.exe.logJump to behavior
        Source: classification engineClassification label: mal100.troj.evad.winEXE@8/1@2/0
        Source: C:\Windows\explorer.exeFile read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
        Source: Ziraat Bankasi Swift Mesaji.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_01
        Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\explorer.exe
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
        Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: control.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512357918.0000000001900000.00000040.10000000.00040000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511820567.0000000001549000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.406485483.00000000017EE000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513084585.0000000001A9F000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512556950.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.404458480.0000000001647000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.512780050.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.510727580.0000000004AF3000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.406485483.00000000017EE000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.513084585.0000000001A9F000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512556950.0000000001980000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000003.404458480.0000000001647000.00000004.00000800.00020000.00000000.sdmp, control.exe, control.exe, 0000000B.00000003.512780050.0000000004C95000.00000004.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmp, control.exe, 0000000B.00000003.510727580.0000000004AF3000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\FRJeWenFHc\src\obj\x86\Debug\CallingConvent.pdb source: Ziraat Bankasi Swift Mesaji.exe, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000000.401671865.0000000000D72000.00000002.00000001.01000000.00000003.sdmp, control.exe, 0000000B.00000002.666266960.000000000535F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000000.615015403.00000000069EF000.00000004.80000000.00040000.00000000.sdmp
        Source: Binary string: control.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.512357918.0000000001900000.00000040.10000000.00040000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000002.511820567.0000000001549000.00000004.00000020.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_0322E2DB push 0000005Dh; retn 0004h0_2_0322E34D
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_004168D9 push edx; ret 2_2_004168DA
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_004171C1 push esi; iretd 2_2_004171C4
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_004169B5 push esi; iretd 2_2_004169B6
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041EA1A push 00000052h; ret 2_2_0041EA1E
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041DBCA push dword ptr [56144B31h]; ret 2_2_0041DCC6
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00417C4D push ds; retf 2_2_00417C4E
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041D4F2 push eax; ret 2_2_0041D4F8
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041D4FB push eax; ret 2_2_0041D562
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041D4A5 push eax; ret 2_2_0041D4F8
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041BCAE push ebx; retf 2_2_0041BCAF
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0041D55C push eax; ret 2_2_0041D562
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00409D2C push edi; iretd 2_2_00409D2F
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00416598 push ds; iretd 2_2_004165A8
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EAD0D1 push ecx; ret 11_2_04EAD0E4
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BA68D9 push edx; ret 11_2_00BA68DA
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BA69B5 push esi; iretd 11_2_00BA69B6
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BA71C1 push esi; iretd 11_2_00BA71C4
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAEA1A push 00000052h; ret 11_2_00BAEA1E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BADBCA push dword ptr [56144B31h]; ret 11_2_00BADCC6
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BABCAE push ebx; retf 11_2_00BABCAF
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAD4A5 push eax; ret 11_2_00BAD4F8
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAD4FB push eax; ret 11_2_00BAD562
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAD4F2 push eax; ret 11_2_00BAD4F8
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BA7C4D push ds; retf 11_2_00BA7C4E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BA6598 push ds; iretd 11_2_00BA65A8
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00B99D2C push edi; iretd 11_2_00B99D2F
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_00BAD55C push eax; ret 11_2_00BAD562
        Source: initial sampleStatic PE information: section name: .text entropy: 7.74275900541

        Hooking and other Techniques for Hiding and Protection

        barindex
        Self deletion via cmd or bat file
        Source: C:\Windows\SysWOW64\control.exeProcess created: /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
        Source: C:\Windows\SysWOW64\control.exeProcess created: /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\control.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Yara detected AntiVM3
        Source: Yara matchFile source: 00000000.00000002.409614207.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Ziraat Bankasi Swift Mesaji.exe PID: 6344, type: MEMORYSTR
        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.409614207.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.409614207.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
        Tries to detect virtualization through RDTSC time measurements
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeRDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeRDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 0000000000B99904 second address: 0000000000B9990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 0000000000B99B6E second address: 0000000000B99B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6424Thread sleep time: -43731s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6180Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\control.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 43731Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: explorer.exe, 00000004.00000000.467434177.0000000006389000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
        Source: explorer.exe, 00000015.00000000.611695006.00000000060F0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
        Source: explorer.exe, 00000004.00000000.472575552.0000000007C29000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
        Source: explorer.exe, 00000015.00000003.624832431.00000000061F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: explorer.exe, 00000004.00000000.472575552.0000000007C29000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
        Source: explorer.exe, 00000015.00000002.666439896.00000000061F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWte%SystemRoot%\system32\mswsock.dll6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
        Source: explorer.exe, 00000004.00000000.444306306.0000000004150000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}:
        Source: explorer.exe, 00000004.00000000.472575552.0000000007C29000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i&
        Source: explorer.exe, 00000004.00000000.472836099.0000000007D2A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
        Source: explorer.exe, 00000004.00000000.472575552.0000000007C29000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00Iy
        Source: explorer.exe, 00000015.00000000.605923799.0000000000A7E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000c
        Source: explorer.exe, 00000015.00000000.605698579.0000000000A68000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.{
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.414265819.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: xLfkRqemuCj72yuiGNb
        Source: explorer.exe, 00000004.00000000.426944558.0000000007DC1000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
        Source: explorer.exe, 00000004.00000000.426543032.0000000007CC2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000v
        Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\control.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F114FB mov eax, dword ptr fs:[00000030h]11_2_04F114FB
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6CF0 mov eax, dword ptr fs:[00000030h]11_2_04ED6CF0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6CF0 mov eax, dword ptr fs:[00000030h]11_2_04ED6CF0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6CF0 mov eax, dword ptr fs:[00000030h]11_2_04ED6CF0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28CD6 mov eax, dword ptr fs:[00000030h]11_2_04F28CD6
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov eax, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov ecx, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov eax, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov eax, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov eax, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEB8D0 mov eax, dword ptr fs:[00000030h]11_2_04EEB8D0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E990AF mov eax, dword ptr fs:[00000030h]11_2_04E990AF
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8F0BF mov ecx, dword ptr fs:[00000030h]11_2_04E8F0BF
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8F0BF mov eax, dword ptr fs:[00000030h]11_2_04E8F0BF
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8F0BF mov eax, dword ptr fs:[00000030h]11_2_04E8F0BF
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59080 mov eax, dword ptr fs:[00000030h]11_2_04E59080
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED3884 mov eax, dword ptr fs:[00000030h]11_2_04ED3884
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED3884 mov eax, dword ptr fs:[00000030h]11_2_04ED3884
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6849B mov eax, dword ptr fs:[00000030h]11_2_04E6849B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F12073 mov eax, dword ptr fs:[00000030h]11_2_04F12073
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F21074 mov eax, dword ptr fs:[00000030h]11_2_04F21074
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7746D mov eax, dword ptr fs:[00000030h]11_2_04E7746D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A44B mov eax, dword ptr fs:[00000030h]11_2_04E8A44B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E70050 mov eax, dword ptr fs:[00000030h]11_2_04E70050
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E70050 mov eax, dword ptr fs:[00000030h]11_2_04E70050
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEC450 mov eax, dword ptr fs:[00000030h]11_2_04EEC450
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEC450 mov eax, dword ptr fs:[00000030h]11_2_04EEC450
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8BC2C mov eax, dword ptr fs:[00000030h]11_2_04E8BC2C
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8002D mov eax, dword ptr fs:[00000030h]11_2_04E8002D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8002D mov eax, dword ptr fs:[00000030h]11_2_04E8002D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8002D mov eax, dword ptr fs:[00000030h]11_2_04E8002D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8002D mov eax, dword ptr fs:[00000030h]11_2_04E8002D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8002D mov eax, dword ptr fs:[00000030h]11_2_04E8002D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6B02A mov eax, dword ptr fs:[00000030h]11_2_04E6B02A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6B02A mov eax, dword ptr fs:[00000030h]11_2_04E6B02A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6B02A mov eax, dword ptr fs:[00000030h]11_2_04E6B02A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6B02A mov eax, dword ptr fs:[00000030h]11_2_04E6B02A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F24015 mov eax, dword ptr fs:[00000030h]11_2_04F24015
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F24015 mov eax, dword ptr fs:[00000030h]11_2_04F24015
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6C0A mov eax, dword ptr fs:[00000030h]11_2_04ED6C0A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6C0A mov eax, dword ptr fs:[00000030h]11_2_04ED6C0A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6C0A mov eax, dword ptr fs:[00000030h]11_2_04ED6C0A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED6C0A mov eax, dword ptr fs:[00000030h]11_2_04ED6C0A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F11C06 mov eax, dword ptr fs:[00000030h]11_2_04F11C06
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7016 mov eax, dword ptr fs:[00000030h]11_2_04ED7016
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7016 mov eax, dword ptr fs:[00000030h]11_2_04ED7016
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7016 mov eax, dword ptr fs:[00000030h]11_2_04ED7016
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F2740D mov eax, dword ptr fs:[00000030h]11_2_04F2740D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F2740D mov eax, dword ptr fs:[00000030h]11_2_04F2740D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F2740D mov eax, dword ptr fs:[00000030h]11_2_04F2740D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F08DF1 mov eax, dword ptr fs:[00000030h]11_2_04F08DF1
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5B1E1 mov eax, dword ptr fs:[00000030h]11_2_04E5B1E1
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5B1E1 mov eax, dword ptr fs:[00000030h]11_2_04E5B1E1
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5B1E1 mov eax, dword ptr fs:[00000030h]11_2_04E5B1E1
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EE41E8 mov eax, dword ptr fs:[00000030h]11_2_04EE41E8
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6D5E0 mov eax, dword ptr fs:[00000030h]11_2_04E6D5E0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6D5E0 mov eax, dword ptr fs:[00000030h]11_2_04E6D5E0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E861A0 mov eax, dword ptr fs:[00000030h]11_2_04E861A0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E861A0 mov eax, dword ptr fs:[00000030h]11_2_04E861A0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E835A1 mov eax, dword ptr fs:[00000030h]11_2_04E835A1
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED69A6 mov eax, dword ptr fs:[00000030h]11_2_04ED69A6
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED51BE mov eax, dword ptr fs:[00000030h]11_2_04ED51BE
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED51BE mov eax, dword ptr fs:[00000030h]11_2_04ED51BE
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED51BE mov eax, dword ptr fs:[00000030h]11_2_04ED51BE
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED51BE mov eax, dword ptr fs:[00000030h]11_2_04ED51BE
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E81DB5 mov eax, dword ptr fs:[00000030h]11_2_04E81DB5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E81DB5 mov eax, dword ptr fs:[00000030h]11_2_04E81DB5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E81DB5 mov eax, dword ptr fs:[00000030h]11_2_04E81DB5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7C182 mov eax, dword ptr fs:[00000030h]11_2_04E7C182
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82581 mov eax, dword ptr fs:[00000030h]11_2_04E82581
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82581 mov eax, dword ptr fs:[00000030h]11_2_04E82581
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82581 mov eax, dword ptr fs:[00000030h]11_2_04E82581
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82581 mov eax, dword ptr fs:[00000030h]11_2_04E82581
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A185 mov eax, dword ptr fs:[00000030h]11_2_04E8A185
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E52D8A mov eax, dword ptr fs:[00000030h]11_2_04E52D8A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E52D8A mov eax, dword ptr fs:[00000030h]11_2_04E52D8A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E52D8A mov eax, dword ptr fs:[00000030h]11_2_04E52D8A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E52D8A mov eax, dword ptr fs:[00000030h]11_2_04E52D8A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E52D8A mov eax, dword ptr fs:[00000030h]11_2_04E52D8A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8FD9B mov eax, dword ptr fs:[00000030h]11_2_04E8FD9B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8FD9B mov eax, dword ptr fs:[00000030h]11_2_04E8FD9B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82990 mov eax, dword ptr fs:[00000030h]11_2_04E82990
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5C962 mov eax, dword ptr fs:[00000030h]11_2_04E5C962
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7C577 mov eax, dword ptr fs:[00000030h]11_2_04E7C577
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7C577 mov eax, dword ptr fs:[00000030h]11_2_04E7C577
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5B171 mov eax, dword ptr fs:[00000030h]11_2_04E5B171
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5B171 mov eax, dword ptr fs:[00000030h]11_2_04E5B171
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7B944 mov eax, dword ptr fs:[00000030h]11_2_04E7B944
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7B944 mov eax, dword ptr fs:[00000030h]11_2_04E7B944
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E93D43 mov eax, dword ptr fs:[00000030h]11_2_04E93D43
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED3540 mov eax, dword ptr fs:[00000030h]11_2_04ED3540
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E77D50 mov eax, dword ptr fs:[00000030h]11_2_04E77D50
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28D34 mov eax, dword ptr fs:[00000030h]11_2_04F28D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E74120 mov eax, dword ptr fs:[00000030h]11_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E74120 mov eax, dword ptr fs:[00000030h]11_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E74120 mov eax, dword ptr fs:[00000030h]11_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E74120 mov eax, dword ptr fs:[00000030h]11_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E74120 mov ecx, dword ptr fs:[00000030h]11_2_04E74120
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8513A mov eax, dword ptr fs:[00000030h]11_2_04E8513A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8513A mov eax, dword ptr fs:[00000030h]11_2_04E8513A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E63D34 mov eax, dword ptr fs:[00000030h]11_2_04E63D34
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E84D3B mov eax, dword ptr fs:[00000030h]11_2_04E84D3B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E84D3B mov eax, dword ptr fs:[00000030h]11_2_04E84D3B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E84D3B mov eax, dword ptr fs:[00000030h]11_2_04E84D3B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5AD30 mov eax, dword ptr fs:[00000030h]11_2_04E5AD30
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EDA537 mov eax, dword ptr fs:[00000030h]11_2_04EDA537
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59100 mov eax, dword ptr fs:[00000030h]11_2_04E59100
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59100 mov eax, dword ptr fs:[00000030h]11_2_04E59100
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59100 mov eax, dword ptr fs:[00000030h]11_2_04E59100
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E676E2 mov eax, dword ptr fs:[00000030h]11_2_04E676E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E816E0 mov ecx, dword ptr fs:[00000030h]11_2_04E816E0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82AE4 mov eax, dword ptr fs:[00000030h]11_2_04E82AE4
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82ACB mov eax, dword ptr fs:[00000030h]11_2_04E82ACB
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28ED6 mov eax, dword ptr fs:[00000030h]11_2_04F28ED6
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E836CC mov eax, dword ptr fs:[00000030h]11_2_04E836CC
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E98EC7 mov eax, dword ptr fs:[00000030h]11_2_04E98EC7
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F0FEC0 mov eax, dword ptr fs:[00000030h]11_2_04F0FEC0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E552A5 mov eax, dword ptr fs:[00000030h]11_2_04E552A5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E552A5 mov eax, dword ptr fs:[00000030h]11_2_04E552A5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E552A5 mov eax, dword ptr fs:[00000030h]11_2_04E552A5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E552A5 mov eax, dword ptr fs:[00000030h]11_2_04E552A5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E552A5 mov eax, dword ptr fs:[00000030h]11_2_04E552A5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED46A7 mov eax, dword ptr fs:[00000030h]11_2_04ED46A7
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6AAB0 mov eax, dword ptr fs:[00000030h]11_2_04E6AAB0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6AAB0 mov eax, dword ptr fs:[00000030h]11_2_04E6AAB0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F20EA5 mov eax, dword ptr fs:[00000030h]11_2_04F20EA5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F20EA5 mov eax, dword ptr fs:[00000030h]11_2_04F20EA5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F20EA5 mov eax, dword ptr fs:[00000030h]11_2_04F20EA5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8FAB0 mov eax, dword ptr fs:[00000030h]11_2_04E8FAB0
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEFE87 mov eax, dword ptr fs:[00000030h]11_2_04EEFE87
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8D294 mov eax, dword ptr fs:[00000030h]11_2_04E8D294
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8D294 mov eax, dword ptr fs:[00000030h]11_2_04E8D294
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6766D mov eax, dword ptr fs:[00000030h]11_2_04E6766D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F0B260 mov eax, dword ptr fs:[00000030h]11_2_04F0B260
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F0B260 mov eax, dword ptr fs:[00000030h]11_2_04F0B260
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28A62 mov eax, dword ptr fs:[00000030h]11_2_04F28A62
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E9927A mov eax, dword ptr fs:[00000030h]11_2_04E9927A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7AE73 mov eax, dword ptr fs:[00000030h]11_2_04E7AE73
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7AE73 mov eax, dword ptr fs:[00000030h]11_2_04E7AE73
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7AE73 mov eax, dword ptr fs:[00000030h]11_2_04E7AE73
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7AE73 mov eax, dword ptr fs:[00000030h]11_2_04E7AE73
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7AE73 mov eax, dword ptr fs:[00000030h]11_2_04E7AE73
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59240 mov eax, dword ptr fs:[00000030h]11_2_04E59240
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59240 mov eax, dword ptr fs:[00000030h]11_2_04E59240
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59240 mov eax, dword ptr fs:[00000030h]11_2_04E59240
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E59240 mov eax, dword ptr fs:[00000030h]11_2_04E59240
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E67E41 mov eax, dword ptr fs:[00000030h]11_2_04E67E41
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EE4257 mov eax, dword ptr fs:[00000030h]11_2_04EE4257
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5E620 mov eax, dword ptr fs:[00000030h]11_2_04E5E620
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F0FE3F mov eax, dword ptr fs:[00000030h]11_2_04F0FE3F
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5C600 mov eax, dword ptr fs:[00000030h]11_2_04E5C600
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5C600 mov eax, dword ptr fs:[00000030h]11_2_04E5C600
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5C600 mov eax, dword ptr fs:[00000030h]11_2_04E5C600
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E88E00 mov eax, dword ptr fs:[00000030h]11_2_04E88E00
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E68A0A mov eax, dword ptr fs:[00000030h]11_2_04E68A0A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5AA16 mov eax, dword ptr fs:[00000030h]11_2_04E5AA16
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5AA16 mov eax, dword ptr fs:[00000030h]11_2_04E5AA16
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A61C mov eax, dword ptr fs:[00000030h]11_2_04E8A61C
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A61C mov eax, dword ptr fs:[00000030h]11_2_04E8A61C
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E73A1C mov eax, dword ptr fs:[00000030h]11_2_04E73A1C
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E803E2 mov eax, dword ptr fs:[00000030h]11_2_04E803E2
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E937F5 mov eax, dword ptr fs:[00000030h]11_2_04E937F5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED53CA mov eax, dword ptr fs:[00000030h]11_2_04ED53CA
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED53CA mov eax, dword ptr fs:[00000030h]11_2_04ED53CA
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F25BA5 mov eax, dword ptr fs:[00000030h]11_2_04F25BA5
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E61B8F mov eax, dword ptr fs:[00000030h]11_2_04E61B8F
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E61B8F mov eax, dword ptr fs:[00000030h]11_2_04E61B8F
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F0D380 mov ecx, dword ptr fs:[00000030h]11_2_04F0D380
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E68794 mov eax, dword ptr fs:[00000030h]11_2_04E68794
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8B390 mov eax, dword ptr fs:[00000030h]11_2_04E8B390
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7794 mov eax, dword ptr fs:[00000030h]11_2_04ED7794
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7794 mov eax, dword ptr fs:[00000030h]11_2_04ED7794
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04ED7794 mov eax, dword ptr fs:[00000030h]11_2_04ED7794
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F1138A mov eax, dword ptr fs:[00000030h]11_2_04F1138A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E82397 mov eax, dword ptr fs:[00000030h]11_2_04E82397
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5DB60 mov ecx, dword ptr fs:[00000030h]11_2_04E5DB60
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6FF60 mov eax, dword ptr fs:[00000030h]11_2_04E6FF60
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E83B7A mov eax, dword ptr fs:[00000030h]11_2_04E83B7A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E83B7A mov eax, dword ptr fs:[00000030h]11_2_04E83B7A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28F6A mov eax, dword ptr fs:[00000030h]11_2_04F28F6A
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5DB40 mov eax, dword ptr fs:[00000030h]11_2_04E5DB40
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E6EF40 mov eax, dword ptr fs:[00000030h]11_2_04E6EF40
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F28B58 mov eax, dword ptr fs:[00000030h]11_2_04F28B58
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E5F358 mov eax, dword ptr fs:[00000030h]11_2_04E5F358
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E54F2E mov eax, dword ptr fs:[00000030h]11_2_04E54F2E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E54F2E mov eax, dword ptr fs:[00000030h]11_2_04E54F2E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8E730 mov eax, dword ptr fs:[00000030h]11_2_04E8E730
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A70E mov eax, dword ptr fs:[00000030h]11_2_04E8A70E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E8A70E mov eax, dword ptr fs:[00000030h]11_2_04E8A70E
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F1131B mov eax, dword ptr fs:[00000030h]11_2_04F1131B
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04E7F716 mov eax, dword ptr fs:[00000030h]11_2_04E7F716
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEFF10 mov eax, dword ptr fs:[00000030h]11_2_04EEFF10
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04EEFF10 mov eax, dword ptr fs:[00000030h]11_2_04EEFF10
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F2070D mov eax, dword ptr fs:[00000030h]11_2_04F2070D
        Source: C:\Windows\SysWOW64\control.exeCode function: 11_2_04F2070D mov eax, dword ptr fs:[00000030h]11_2_04F2070D
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess queried: DebugPortJump to behavior
        Source: C:\Windows\SysWOW64\control.exeProcess queried: DebugPortJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 2_2_0040ACE0 LdrLoadDll,2_2_0040ACE0
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeMemory allocated: page read and write | page guardJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Sample uses process hollowing technique
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection unmapped: C:\Windows\SysWOW64\control.exe base address: DF0000Jump to behavior
        Maps a DLL or memory area into another process
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and writeJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and writeJump to behavior
        Source: C:\Windows\SysWOW64\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
        Source: C:\Windows\SysWOW64\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
        Source: C:\Windows\SysWOW64\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
        Injects a PE file into a foreign processes
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeMemory written: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe base: 400000 value starts with: 4D5AJump to behavior
        Queues an APC in another process (thread injection)
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
        Modifies the context of a thread in another process (thread injection)
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread register set: target process: 3808Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread register set: target process: 3808Jump to behavior
        Source: C:\Windows\SysWOW64\control.exeThread register set: target process: 3808Jump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeJump to behavior
        Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"Jump to behavior
        Source: explorer.exe, 00000004.00000000.410648421.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.442349668.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.498725435.0000000000D00000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program ManagerG
        Source: explorer.exe, 00000015.00000002.630848927.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000000.605923799.0000000000A7E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman.
        Source: explorer.exe, 00000004.00000000.410648421.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.442349668.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.426299406.0000000007C08000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
        Source: explorer.exe, 00000004.00000000.410648421.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.442349668.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.498725435.0000000000D00000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
        Source: explorer.exe, 00000004.00000000.410648421.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.442349668.0000000000D00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.498725435.0000000000D00000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
        Source: explorer.exe, 00000015.00000003.604906517.0000000004639000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.665124479.0000000004639000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000000.610052116.0000000004639000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd(T'
        Source: explorer.exe, 00000004.00000000.498187251.0000000000628000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.410150061.0000000000628000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.441801892.0000000000628000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanPV*
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44bbf10.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.44eb6c0.5.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.2.Ziraat Bankasi Swift Mesaji.exe.43221b0.7.raw.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid Accounts1
        Shared Modules        		Path Interception512
        Process Injection        		1
        Masquerading        		OS Credential Dumping221
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		Exfiltration Over Other Network Medium1
        Encrypted Channel        		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
        Disable or Modify Tools        		LSASS Memory2
        Process Discovery        		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
        Non-Application Layer Protocol        		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)31
        Virtualization/Sandbox Evasion        		Security Account Manager31
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration11
        Application Layer Protocol        		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)512
        Process Injection        		NTDS1
        File and Directory Discovery        		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA Secrets112
        System Information Discovery        		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.common3
        Obfuscated Files or Information        		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup Items3
        Software Packing        		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
        File Deletion        		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635281 Sample: Ziraat Bankasi Swift Mesaji.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 31 www.wwohead.com 2->31 33 www.gabimejia.com 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus detection for URL or domain 2->39 41 6 other signatures 2->41 11 Ziraat Bankasi Swift Mesaji.exe 3 2->11         started        signatures3 process4 file5 29 C:\...\Ziraat Bankasi Swift Mesaji.exe.log, ASCII 11->29 dropped 51 Injects a PE file into a foreign processes 11->51 15 Ziraat Bankasi Swift Mesaji.exe 11->15         started        signatures6 process7 signatures8 53 Modifies the context of a thread in another process (thread injection) 15->53 55 Maps a DLL or memory area into another process 15->55 57 Sample uses process hollowing technique 15->57 59 Queues an APC in another process (thread injection) 15->59 18 explorer.exe 15->18 injected process9 process10 20 control.exe 18->20         started        signatures11 43 Self deletion via cmd or bat file 20->43 45 Modifies the context of a thread in another process (thread injection) 20->45 47 Maps a DLL or memory area into another process 20->47 49 Tries to detect virtualization through RDTSC time measurements 20->49 23 cmd.exe 1 20->23         started        25 explorer.exe 120 20->25         started        process12 process13 27 conhost.exe 23->27         started       

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Ziraat Bankasi Swift Mesaji.exe22%ReversingLabsByteCode-MSIL.Spyware.Negasteal

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        SourceDetectionScannerLabelLinkDownload
        2.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        2.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        2.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
        2.2.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

        Domains

        SourceDetectionScannerLabelLink
        dual-a-0001.dc-msedge.net0%VirustotalBrowse

        URLs

        SourceDetectionScannerLabelLink
        http://www.gabimejia.com0%Avira URL Cloudsafe
        http://www.thesoupproject.netReferer:0%Avira URL Cloudsafe
        http://www.51cdfang.com/ah6m/www.theguaranteedadmissions.com0%Avira URL Cloudsafe
        http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
        http://www.yuh-gal-p.xyzReferer:0%Avira URL Cloudsafe
        http://www.aerialdatainc.com/ah6m/www.planet-ideam.com0%Avira URL Cloudsafe
        www.wwohead.com/ah6m/100%Avira URL Cloudmalware
        http://www.glencoreprocurement.comReferer:0%Avira URL Cloudsafe
        http://www.xiaochunge.top/ah6m/0%Avira URL Cloudsafe
        http://www.alltinyildiz.com/ah6m/www.xiaochunge.top0%Avira URL Cloudsafe
        http://www.nontradebulkcement.online/ah6m/0%Avira URL Cloudsafe
        http://www.wwohead.comReferer:0%Avira URL Cloudsafe
        http://www.tiro.com0%URL Reputationsafe
        http://www.planet-ideam.com0%Avira URL Cloudsafe
        http://www.theguaranteedadmissions.comReferer:0%Avira URL Cloudsafe
        http://www.hummingbirdfeederhat.comReferer:0%Avira URL Cloudsafe
        http://www.goodfont.co.kr0%URL Reputationsafe
        http://www.alltinyildiz.com0%Avira URL Cloudsafe
        http://www.gabimejia.com/ah6m/www.wwohead.com0%Avira URL Cloudsafe
        http://www.planet-ideam.comReferer:0%Avira URL Cloudsafe
        http://www.aerialdatainc.com/ah6m/0%Avira URL Cloudsafe
        http://www.sajatypeworks.com0%URL Reputationsafe
        http://www.thesoupproject.net/ah6m/www.everythingmandab.com0%Avira URL Cloudsafe
        http://www.typography.netD0%URL Reputationsafe
        http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
        http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
        http://fontfabrik.com0%URL Reputationsafe
        http://www.nontradebulkcement.onlineReferer:0%Avira URL Cloudsafe
        http://www.nontradebulkcement.online/ah6m/www.hummingbirdfeederhat.com0%Avira URL Cloudsafe
        http://www.wwohead.com0%Avira URL Cloudsafe
        http://www.everythingmandab.com/ah6m/0%Avira URL Cloudsafe
        http://www.nontradebulkcement.online0%Avira URL Cloudsafe
        http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
        http://www.xiaochunge.topReferer:0%Avira URL Cloudsafe
        http://www.aerialdatainc.comReferer:0%Avira URL Cloudsafe
        http://www.planet-ideam.com/ah6m/www.glencoreprocurement.com0%Avira URL Cloudsafe
        http://www.wwohead.com/ah6m/100%Avira URL Cloudmalware
        http://www.planet-ideam.com/ah6m/0%Avira URL Cloudsafe
        http://www.theguaranteedadmissions.com/ah6m/www.aerialdatainc.com0%Avira URL Cloudsafe
        http://www.51cdfang.com0%Avira URL Cloudsafe
        http://www.sandoll.co.kr0%URL Reputationsafe
        http://www.urwpp.deDPlease0%URL Reputationsafe
        http://www.alltinyildiz.com/ah6m/0%Avira URL Cloudsafe
        http://www.zhongyicts.com.cn0%URL Reputationsafe
        http://www.sakkal.com0%URL Reputationsafe
        http://www.everythingmandab.comReferer:0%Avira URL Cloudsafe
        http://www.difan-mobile.com/ah6m/www.nontradebulkcement.online0%Avira URL Cloudsafe
        http://www.aerialdatainc.com0%Avira URL Cloudsafe
        http://ns.adobY0%URL Reputationsafe
        http://www.thesoupproject.net/ah6m/0%Avira URL Cloudsafe
        http://www.hummingbirdfeederhat.com/ah6m/0%Avira URL Cloudsafe
        http://www.wwohead.com/ah6m/www.51cdfang.com100%Avira URL Cloudmalware
        http://www.yuh-gal-p.xyz/ah6m/0%Avira URL Cloudsafe
        http://www.xiaochunge.top/ah6m/www.difan-mobile.com0%Avira URL Cloudsafe
        http://www.alltinyildiz.comReferer:0%Avira URL Cloudsafe
        http://www.difan-mobile.com/ah6m/0%Avira URL Cloudsafe
        http://www.gabimejia.com/ah6m/0%Avira URL Cloudsafe
        http://www.51cdfang.comReferer:0%Avira URL Cloudsafe
        http://www.glencoreprocurement.com/ah6m/www.thesoupproject.net0%Avira URL Cloudsafe
        http://www.yuh-gal-p.xyz0%Avira URL Cloudsafe
        http://www.difan-mobile.com0%Avira URL Cloudsafe
        http://www.glencoreprocurement.com/ah6m/0%Avira URL Cloudsafe
        http://www.carterandcone.coml0%URL Reputationsafe
        http://www.everythingmandab.com/ah6m/www.stringm.com0%Avira URL Cloudsafe
        http://www.theguaranteedadmissions.com/ah6m/0%Avira URL Cloudsafe
        http://www.51cdfang.com/ah6m/0%Avira URL Cloudsafe
        http://www.founder.com.cn/cn0%URL Reputationsafe
        http://www.stringm.com/ah6m/100%Avira URL Cloudmalware
        http://www.hummingbirdfeederhat.com0%Avira URL Cloudsafe
        http://www.yuh-gal-p.xyz/ah6m/www.alltinyildiz.com0%Avira URL Cloudsafe
        http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
        http://www.stringm.comReferer:0%Avira URL Cloudsafe
        http://www.difan-mobile.comReferer:0%Avira URL Cloudsafe
        http://www.theguaranteedadmissions.com0%Avira URL Cloudsafe
        http://www.gabimejia.comReferer:0%Avira URL Cloudsafe
        http://www.stringm.com/ah6m/www.yuh-gal-p.xyz100%Avira URL Cloudmalware
        http://www.everythingmandab.com0%Avira URL Cloudsafe
        http://www.stringm.com0%Avira URL Cloudsafe
        http://www.xiaochunge.top0%Avira URL Cloudsafe
        http://www.glencoreprocurement.com0%Avira URL Cloudsafe
        http://www.thesoupproject.net0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        dual-a-0001.dc-msedge.net
        		131.253.33.200
        		truefalseunknown
        www.gabimejia.com
        		104.140.60.254
        		truefalse
          		unknown
          www.wwohead.com
          		172.252.94.104
          		truetrue
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.wwohead.com/ah6m/true
            • Avira URL Cloud: malware
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://www.gabimejia.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.fontbureau.com/designersGZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://www.thesoupproject.netReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/dcoetzee/plants-vs-zombies-user-file-editorZiraat Bankasi Swift Mesaji.exe, 00000000.00000000.359661923.0000000000EB2000.00000002.00000001.01000000.00000003.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000002.00000000.401671865.0000000000D72000.00000002.00000001.01000000.00000003.sdmp, control.exe, 0000000B.00000002.666266960.000000000535F000.00000004.10000000.00040000.00000000.sdmp, explorer.exe, 00000015.00000000.615015403.00000000069EF000.00000004.80000000.00040000.00000000.sdmpfalse
                		high
                http://www.51cdfang.com/ah6m/www.theguaranteedadmissions.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.fontbureau.com/designers/?Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.founder.com.cn/cn/bTheZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.yuh-gal-p.xyzReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.aerialdatainc.com/ah6m/www.planet-ideam.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.fontbureau.com/designers?Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.glencoreprocurement.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.xiaochunge.top/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://github.comZiraat Bankasi Swift Mesaji.exefalse
                      		high
                      http://www.alltinyildiz.com/ah6m/www.xiaochunge.topexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.nontradebulkcement.online/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.wwohead.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.tiro.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.planet-ideam.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.theguaranteedadmissions.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.hummingbirdfeederhat.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.com/designersZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.goodfont.co.krZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.alltinyildiz.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.gabimejia.com/ah6m/www.wwohead.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.planet-ideam.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.aerialdatainc.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.sajatypeworks.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.thesoupproject.net/ah6m/www.everythingmandab.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.typography.netDZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.founder.com.cn/cn/cTheZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.galapagosdesign.com/staff/dennis.htmZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://fontfabrik.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.nontradebulkcement.onlineReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.nontradebulkcement.online/ah6m/www.hummingbirdfeederhat.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.wwohead.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.everythingmandab.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.nontradebulkcement.onlineexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.galapagosdesign.com/DPleaseZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.xiaochunge.topReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.aerialdatainc.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.planet-ideam.com/ah6m/www.glencoreprocurement.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.wwohead.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.planet-ideam.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.theguaranteedadmissions.com/ah6m/www.aerialdatainc.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.51cdfang.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.fonts.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.sandoll.co.krZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.urwpp.deDPleaseZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.alltinyildiz.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.zhongyicts.com.cnZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.sakkal.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.everythingmandab.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.difan-mobile.com/ah6m/www.nontradebulkcement.onlineexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.apache.org/licenses/LICENSE-2.0Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.comZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.aerialdatainc.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://ns.adobYexplorer.exe, 00000004.00000000.463834252.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.442686652.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.411056762.00000000026D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.498956126.00000000026D0000.00000004.00000001.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.thesoupproject.net/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.hummingbirdfeederhat.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.wwohead.com/ah6m/www.51cdfang.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmptrue
                              • Avira URL Cloud: malware
                              		unknown
                              http://www.yuh-gal-p.xyz/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.xiaochunge.top/ah6m/www.difan-mobile.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.alltinyildiz.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.difan-mobile.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.gabimejia.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.51cdfang.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.glencoreprocurement.com/ah6m/www.thesoupproject.netexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.yuh-gal-p.xyzexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.difan-mobile.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.glencoreprocurement.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.carterandcone.comlZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.everythingmandab.com/ah6m/www.stringm.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.theguaranteedadmissions.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.51cdfang.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.com/designers/cabarga.htmlNZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.founder.com.cn/cnZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-jones.htmlZiraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.stringm.com/ah6m/explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.hummingbirdfeederhat.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.yuh-gal-p.xyz/ah6m/www.alltinyildiz.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.stringm.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.difan-mobile.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.theguaranteedadmissions.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designers8Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.413299631.0000000007422000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.gabimejia.comReferer:explorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.stringm.com/ah6m/www.yuh-gal-p.xyzexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmptrue
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://www.everythingmandab.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.stringm.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.xiaochunge.topexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.glencoreprocurement.comexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.thesoupproject.netexplorer.exe, 00000015.00000002.669684800.0000000008A8B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown

                                    World Map of Contacted IPs

                                    ⊘No contacted IP infos

                                    General Information

                                    Joe Sandbox Version:34.0.0 Boulder Opal
                                    Analysis ID:635281
                                    Start date and time: 27/05/202218:22:082022-05-27 18:22:08 +02:00
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 13m 29s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Sample file name:Ziraat Bankasi Swift Mesaji.exe
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:23
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:1
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Detection:MAL
                                    Classification:mal100.troj.evad.winEXE@8/1@2/0
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HDC Information:
                                    • Successful, ratio: 60.9% (good quality ratio 54.3%)
                                    • Quality average: 69.5%
                                    • Quality standard deviation: 32.9%
                                    HCA Information:
                                    • Successful, ratio: 100%
                                    • Number of executed functions: 78
                                    • Number of non-executed functions: 115
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe
                                    • Adjust boot time
                                    • Enable AMSI

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, SearchUI.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 20.54.89.106, 40.125.122.176, 52.152.110.14, 20.223.24.244
                                    • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, settings-win.data.microsoft.com, arc.msn.com, a-0001.a-afdentry.net.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    18:23:37API Interceptor2x Sleep call for process: Ziraat Bankasi Swift Mesaji.exe modified
                                    18:25:16API Interceptor44x Sleep call for process: explorer.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    ⊘No context

                                    Domains

                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                    dual-a-0001.dc-msedge.netszLAUZKesq.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    http://australianmorningnews.com/Get hashmaliciousBrowse
                                    • 131.253.33.200
                                    zJ76cv6IC8.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    SecuriteInfo.com.Variant.Tedy.122593.12781.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    INVOICE.exeGet hashmaliciousBrowse
                                    • 13.107.22.200
                                    triage_dropped_file.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    vbc.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    REQUEST FOR OFFER 25-05-2022#U00b7pdf.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    DHL Global_Inv.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    Shipping Docments_0009228888.PDF.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    011382843.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    zN7UCkDmIC.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    Purchase Order (Ref M050417).docxGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    RFQ - Offer for Attached Specs.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    SecuriteInfo.com.W32.AIDetectNet.01.25717.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    files.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    recepit Swift copy from JCORP TRADING PTY LTD MT103_pdf.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    SecuriteInfo.com.W32.AIDetectNet.01.637.exeGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    PaymentRequest_Invoice229182.docxGet hashmaliciousBrowse
                                    • 131.253.33.200
                                    Product Inquiry.exeGet hashmaliciousBrowse
                                    • 131.253.33.200

                                    ASNs

                                    ⊘No context

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    ⊘No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji.exe.log

                                    Download File
                                    Process:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):1308
                                    Entropy (8bit):5.345811588615766
                                    Encrypted:false
                                    SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                    MD5:2E016B886BDB8389D2DD0867BE55F87B
                                    SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                    SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                    SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                    Malicious:true
                                    Reputation:high, very likely benign file
                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                    Entropy (8bit):7.744489165365895
                                    TrID:
                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                    • Windows Screen Saver (13104/52) 0.07%
                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                    File name:Ziraat Bankasi Swift Mesaji.exe
                                    File size:716288
                                    MD5:d891e26c0707977398e963d6076eeae1
                                    SHA1:039457a2c4d73c24ef410a7665a04e9d456019e7
                                    SHA256:2979a77144d0df70f4dff084420d8e034eb6f751027fa44d158de924960f2a6a
                                    SHA512:f75a0274621ee095f30d01b83a0d07d02974e6876384f4a99d1d818862d09781e600352479fc845a7c3e2cd885ac344d58742dd9b44e322966d710a59188740b
                                    SSDEEP:12288:O092x9bHoAUOvqVpleUE0q8cf7qb4dHDn8LaRASedck6Q:nUfbHodlC0qj7qcdHDn8La+SCchQ
                                    TLSH:4EE4F10072F81B22E2BA67FE6578A18403B67D946520E34E5DC278DB3B71F918E45F1B
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y.b..............0......Z........... ........@.. .......................@............@................................

                                    File Icon

                                    Icon Hash:4462f276dcec30e6

                                    Static PE Info

                                    General

                                    Entrypoint:0x4ab1da
                                    Entrypoint Section:.text
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                    Time Stamp:0x629079C1 [Fri May 27 07:12:01 2022 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:v4.0.30319
                                    OS Version Major:4
                                    OS Version Minor:0
                                    File Version Major:4
                                    File Version Minor:0
                                    Subsystem Version Major:4
                                    Subsystem Version Minor:0
                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                    Entrypoint Preview

                                    Instruction
                                    jmp dword ptr [00402000h]
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xab1880x4f.text
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xac0000x57cc.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xb20000xc.reloc
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0xab0500x1c.text
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    .text0x20000xa91e00xa9200False0.860052025591data7.74275900541IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                    .rsrc0xac0000x57cc0x5800False0.964577414773data7.89168206066IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    .reloc0xb20000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                    Resources

                                    NameRVASizeTypeLanguageCountry
                                    RT_ICON0xac1000x51a3PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                    RT_GROUP_ICON0xb12b40x14data
                                    RT_VERSION0xb12d80x2f4data
                                    RT_MANIFEST0xb15dc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                    Imports

                                    DLLImport
                                    mscoree.dll_CorExeMain

                                    Version Infos

                                    DescriptionData
                                    Translation0x0000 0x04b0
                                    LegalCopyright
                                    Assembly Version1.0.0.0
                                    InternalNameCallingConvent.exe
                                    FileVersion1.0.0.0
                                    CompanyName
                                    LegalTrademarks
                                    Comments
                                    ProductName
                                    ProductVersion1.0.0.0
                                    FileDescription
                                    OriginalFilenameCallingConvent.exe

                                    Network Behavior

                                    Network Port Distribution

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    May 27, 2022 18:25:36.139713049 CEST6284353192.168.2.78.8.8.8
                                    May 27, 2022 18:25:36.309185982 CEST53628438.8.8.8192.168.2.7
                                    May 27, 2022 18:25:53.158830881 CEST4949553192.168.2.78.8.8.8
                                    May 27, 2022 18:25:53.581492901 CEST53494958.8.8.8192.168.2.7

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                    May 27, 2022 18:25:36.139713049 CEST192.168.2.78.8.8.80xd167Standard query (0)www.gabimejia.comA (IP address)IN (0x0001)
                                    May 27, 2022 18:25:53.158830881 CEST192.168.2.78.8.8.80x98d2Standard query (0)www.wwohead.comA (IP address)IN (0x0001)

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                    May 27, 2022 18:25:31.742157936 CEST8.8.8.8192.168.2.70x7a1cNo error (0)www-bing-com.dual-a-0001.a-msedge.netdual-a-0001.dc-msedge.netCNAME (Canonical name)IN (0x0001)
                                    May 27, 2022 18:25:31.742157936 CEST8.8.8.8192.168.2.70x7a1cNo error (0)dual-a-0001.dc-msedge.net131.253.33.200A (IP address)IN (0x0001)
                                    May 27, 2022 18:25:31.742157936 CEST8.8.8.8192.168.2.70x7a1cNo error (0)dual-a-0001.dc-msedge.net13.107.22.200A (IP address)IN (0x0001)
                                    May 27, 2022 18:25:36.309185982 CEST8.8.8.8192.168.2.70xd167No error (0)www.gabimejia.com104.140.60.254A (IP address)IN (0x0001)
                                    May 27, 2022 18:25:53.581492901 CEST8.8.8.8192.168.2.70x98d2No error (0)www.wwohead.com172.252.94.104A (IP address)IN (0x0001)

                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    General

                                    Target ID:0
                                    Start time:18:23:24
                                    Start date:27/05/2022
                                    Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
                                    Imagebase:0xeb0000
                                    File size:716288 bytes
                                    MD5 hash:D891E26C0707977398E963D6076EEAE1
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:.Net C# or VB.NET
                                    Yara matches:
                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.409614207.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.414265819.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.409834205.0000000004322000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.407668611.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    Reputation:low

                                    General

                                    Target ID:2
                                    Start time:18:23:43
                                    Start date:27/05/2022
                                    Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe
                                    Imagebase:0xd70000
                                    File size:716288 bytes
                                    MD5 hash:D891E26C0707977398E963D6076EEAE1
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000000.403126818.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000000.404005637.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.511417797.00000000014C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.511211883.0000000001380000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    General

                                    Target ID:4
                                    Start time:18:23:48
                                    Start date:27/05/2022
                                    Path:C:\Windows\explorer.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\Explorer.EXE
                                    Imagebase:0x7ff631f70000
                                    File size:3933184 bytes
                                    MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.455844055.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.476604607.000000000DE2E000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:high

                                    General

                                    Target ID:11
                                    Start time:18:24:30
                                    Start date:27/05/2022
                                    Path:C:\Windows\SysWOW64\control.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Windows\SysWOW64\control.exe
                                    Imagebase:0xdf0000
                                    File size:114688 bytes
                                    MD5 hash:40FBA3FBFD5E33E0DE1BA45472FDA66F
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.633141128.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.634227955.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:moderate

                                    General

                                    Target ID:12
                                    Start time:18:24:36
                                    Start date:27/05/2022
                                    Path:C:\Windows\SysWOW64\cmd.exe
                                    Wow64 process (32bit):true
                                    Commandline:/c del "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
                                    Imagebase:0xdd0000
                                    File size:232960 bytes
                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    General

                                    Target ID:13
                                    Start time:18:24:38
                                    Start date:27/05/2022
                                    Path:C:\Windows\System32\conhost.exe
                                    Wow64 process (32bit):false
                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    Imagebase:0x7ff7bab80000
                                    File size:625664 bytes
                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    General

                                    Target ID:21
                                    Start time:18:25:15
                                    Start date:27/05/2022
                                    Path:C:\Windows\explorer.exe
                                    Wow64 process (32bit):false
                                    Commandline:explorer.exe
                                    Imagebase:0x7ff631f70000
                                    File size:3933184 bytes
                                    MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:high

                                    Disassembly

                                    Reset < >

                                      Execution Graph

                                      Execution Coverage:9.7%
                                      Dynamic/Decrypted Code Coverage:100%
                                      Signature Coverage:0%
                                      Total number of Nodes:106
                                      Total number of Limit Nodes:8
                                      execution_graph 14816 322c590 14817 322c591 14816->14817 14818 322c6a5 14817->14818 14821 322c740 14817->14821 14825 322c750 14817->14825 14822 322c744 14821->14822 14829 322c2f4 14822->14829 14826 322c751 14825->14826 14827 322c2f4 DuplicateHandle 14826->14827 14828 322c77e 14827->14828 14828->14818 14830 322c7b8 DuplicateHandle 14829->14830 14832 322c77e 14830->14832 14832->14818 14833 32240d0 14834 32240d1 14833->14834 14835 32240ee 14834->14835 14839 32241e0 14834->14839 14844 3223894 14835->14844 14837 322410d 14840 32241e4 14839->14840 14848 32242e0 14840->14848 14852 32242d0 14840->14852 14845 322389f 14844->14845 14860 32258cc 14845->14860 14847 3227555 14847->14837 14850 32242e1 14848->14850 14849 32243e4 14849->14849 14850->14849 14856 3223e94 14850->14856 14854 32242d4 14852->14854 14853 32243e4 14853->14853 14854->14853 14855 3223e94 CreateActCtxA 14854->14855 14855->14853 14857 3225370 CreateActCtxA 14856->14857 14859 3225433 14857->14859 14861 32258d7 14860->14861 14864 322722c 14861->14864 14863 32276b5 14863->14847 14865 3227237 14864->14865 14868 322725c 14865->14868 14867 322779a 14867->14863 14869 3227267 14868->14869 14872 322728c 14869->14872 14871 322788a 14871->14867 14873 3227297 14872->14873 14875 3227f9e 14873->14875 14878 3229d58 14873->14878 14874 3227fdc 14874->14871 14875->14874 14882 322bec0 14875->14882 14887 322a198 14878->14887 14891 322a189 14878->14891 14879 3229d6e 14879->14875 14883 322bee1 14882->14883 14884 322bf05 14883->14884 14924 322c46b 14883->14924 14928 322c478 14883->14928 14884->14874 14896 322a280 14887->14896 14904 322a290 14887->14904 14888 322a1a7 14888->14879 14892 322a198 14891->14892 14894 322a280 2 API calls 14892->14894 14895 322a290 2 API calls 14892->14895 14893 322a1a7 14893->14879 14894->14893 14895->14893 14897 322a290 14896->14897 14898 322a2bb 14897->14898 14912 322a508 14897->14912 14916 322a518 14897->14916 14898->14888 14899 322a2b3 14899->14898 14900 322a4b8 GetModuleHandleW 14899->14900 14901 322a4e5 14900->14901 14901->14888 14905 322a295 14904->14905 14906 322a2bb 14905->14906 14910 322a508 LoadLibraryExW 14905->14910 14911 322a518 LoadLibraryExW 14905->14911 14906->14888 14907 322a2b3 14907->14906 14908 322a4b8 GetModuleHandleW 14907->14908 14909 322a4e5 14908->14909 14909->14888 14910->14907 14911->14907 14913 322a50c 14912->14913 14915 322a551 14913->14915 14920 3229f80 14913->14920 14915->14899 14917 322a52c 14916->14917 14918 322a551 14917->14918 14919 3229f80 LoadLibraryExW 14917->14919 14918->14899 14919->14918 14921 322a6f8 LoadLibraryExW 14920->14921 14923 322a771 14921->14923 14923->14915 14925 322c439 14924->14925 14926 322c472 14924->14926 14925->14884 14926->14925 14932 322c26c 14926->14932 14929 322c479 14928->14929 14930 322c26c 3 API calls 14929->14930 14931 322c4bf 14929->14931 14930->14931 14931->14884 14933 322c277 14932->14933 14935 322cdb0 14933->14935 14936 322c354 14933->14936 14937 322c35f 14936->14937 14938 322728c 3 API calls 14937->14938 14939 322ce1f 14938->14939 14943 322ebb8 14939->14943 14949 322eba0 14939->14949 14940 322ce58 14940->14935 14945 322ebe9 14943->14945 14946 322ec35 14943->14946 14944 322ebf5 14944->14940 14945->14944 14947 322f038 LoadLibraryExW GetModuleHandleW 14945->14947 14948 322f029 LoadLibraryExW GetModuleHandleW 14945->14948 14946->14940 14947->14946 14948->14946 14950 322ebb8 14949->14950 14951 322ebf5 14950->14951 14952 322f038 LoadLibraryExW GetModuleHandleW 14950->14952 14953 322f029 LoadLibraryExW GetModuleHandleW 14950->14953 14951->14940 14952->14951 14953->14951

                                      Executed Functions

                                      Function 0322A290 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetModuleHandleW.KERNELBASE(00000000), ref: 0322A4D6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: HandleModule
                                      • String ID:
                                      • API String ID: 4139908857-0
                                      • Opcode ID: 085a581b56e7771586a2c83d7c1010bdfaa7428ece07547b58a6daab6a33ee54
                                      • Instruction ID: 46309f953101e8bce1799ded587e73f2cfeec444dc52d1316cc6219b540f8090
                                      • Opcode Fuzzy Hash: 085a581b56e7771586a2c83d7c1010bdfaa7428ece07547b58a6daab6a33ee54
                                      • Instruction Fuzzy Hash: E6714670A10B15AFD724DF2AD840B5ABBF5FF88304F04892DE44AD7B40DB75E9858BA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 03225364 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 57 3225364-3225366 58 3225368-322536a 57->58 59 322536d-322536e 57->59 60 3225371-3225374 58->60 61 322536c 58->61 62 3225370 59->62 63 3225375-3225431 CreateActCtxA 59->63 60->63 61->59 62->60 65 3225433-3225439 63->65 66 322543a-3225494 63->66 65->66 73 32254a3-32254a7 66->73 74 3225496-3225499 66->74 75 32254b8 73->75 76 32254a9-32254b5 73->76 74->73 78 32254b9 75->78 76->75 78->78
                                      APIs
                                      • CreateActCtxA.KERNEL32(?), ref: 03225421
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: Create
                                      • String ID:
                                      • API String ID: 2289755597-0
                                      • Opcode ID: b8862fe378e60661d93626f7c0a06052724cbe63f26635a3e86fae3aae1edfd4
                                      • Instruction ID: 4f372b58cfc093897186054aff163bc5383efe0afec91303b39a1eb12c62d77a
                                      • Opcode Fuzzy Hash: b8862fe378e60661d93626f7c0a06052724cbe63f26635a3e86fae3aae1edfd4
                                      • Instruction Fuzzy Hash: 0E412471C04229DFCB20DFAAC884B9DFBB5FF49308F24805AD408AB250DB756986CF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 03223E94 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 79 3223e94-3225431 CreateActCtxA 84 3225433-3225439 79->84 85 322543a-3225494 79->85 84->85 92 32254a3-32254a7 85->92 93 3225496-3225499 85->93 94 32254b8 92->94 95 32254a9-32254b5 92->95 93->92 97 32254b9 94->97 95->94 97->97
                                      APIs
                                      • CreateActCtxA.KERNEL32(?), ref: 03225421
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: Create
                                      • String ID:
                                      • API String ID: 2289755597-0
                                      • Opcode ID: 76b4f241e967cffb9f1b6d8d6f5bf796d0ecf9a7ea44a07098b9d464c8600094
                                      • Instruction ID: d0f64ee129675135e43344a3ad0616fd4ef6fe881ac0ce9cba61bd23e32f8fac
                                      • Opcode Fuzzy Hash: 76b4f241e967cffb9f1b6d8d6f5bf796d0ecf9a7ea44a07098b9d464c8600094
                                      • Instruction Fuzzy Hash: 2D410471D04628DFDB24DFAAC884B9DFBB5FF49308F61806AD408AB250DB756985CF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322C7B1 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 98 322c7b1-322c7b2 99 322c7b4-322c7b6 98->99 100 322c7b9-322c7bc 98->100 101 322c7bd-322c84c DuplicateHandle 99->101 102 322c7b8 99->102 100->101 103 322c855-322c872 101->103 104 322c84e-322c854 101->104 102->100 104->103
                                      APIs
                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0322C77E,?,?,?,?,?), ref: 0322C83F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: DuplicateHandle
                                      • String ID:
                                      • API String ID: 3793708945-0
                                      • Opcode ID: b2748b382d119662bc67af6b55d181447b77e93e7ef01185984b34730d1985dd
                                      • Instruction ID: b98c656091691ff2f83f1a39c4070a656787b4b755ae8a825ecffea70cce53e6
                                      • Opcode Fuzzy Hash: b2748b382d119662bc67af6b55d181447b77e93e7ef01185984b34730d1985dd
                                      • Instruction Fuzzy Hash: CD21D4B5900219AFDB10CFA9D884ADEBFF8FB48324F14801AE914A7310D374A954CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322C2F4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 107 322c2f4-322c84c DuplicateHandle 111 322c855-322c872 107->111 112 322c84e-322c854 107->112 112->111
                                      APIs
                                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0322C77E,?,?,?,?,?), ref: 0322C83F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: DuplicateHandle
                                      • String ID:
                                      • API String ID: 3793708945-0
                                      • Opcode ID: 34af1bcdb6209a26219921153a43645d5618d7bbe814e17ed5fa85ec86765ec0
                                      • Instruction ID: 534172e9d49c81af826f57436d5dbc102f595a2a5f7af38e7c70dafacd915957
                                      • Opcode Fuzzy Hash: 34af1bcdb6209a26219921153a43645d5618d7bbe814e17ed5fa85ec86765ec0
                                      • Instruction Fuzzy Hash: 5221E4B5900258AFDB10CFA9D884AEEBFF8FB48324F14841AE914B3310D374A954CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 03229F68 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 115 3229f68-3229f83 117 3229f85-3229f87 115->117 118 3229f8a 115->118 119 322a6f8-322a738 117->119 118->119 120 322a740-322a76f LoadLibraryExW 119->120 121 322a73a-322a73d 119->121 122 322a771-322a777 120->122 123 322a778-322a795 120->123 121->120 122->123
                                      APIs
                                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0322A551,00000800,00000000,00000000), ref: 0322A762
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: LibraryLoad
                                      • String ID:
                                      • API String ID: 1029625771-0
                                      • Opcode ID: 8cbf18845f55a0a2ea653e96a1611619ff09cf9e060a3d63a5217c7332fca038
                                      • Instruction ID: 4ed163d39c1b1037eca50075636d0e33c4019bb10cb9de55e407c34a4d8ac3e8
                                      • Opcode Fuzzy Hash: 8cbf18845f55a0a2ea653e96a1611619ff09cf9e060a3d63a5217c7332fca038
                                      • Instruction Fuzzy Hash: 372189B2C043499FCB10CFAAC844BDEBFF4EB88314F15805AE515A7600D7B4A545CFA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 03229F80 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 126 3229f80-322a738 128 322a740-322a76f LoadLibraryExW 126->128 129 322a73a-322a73d 126->129 130 322a771-322a777 128->130 131 322a778-322a795 128->131 129->128 130->131
                                      APIs
                                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0322A551,00000800,00000000,00000000), ref: 0322A762
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: LibraryLoad
                                      • String ID:
                                      • API String ID: 1029625771-0
                                      • Opcode ID: 401aa2d1d82517962a3f72610155f7288a46811b66d0e3f5228e246bc97d2745
                                      • Instruction ID: b20f07d2277b72bf85d6f9b71b1dc0a83318e1a6856121a29b6f66b89f0d99e6
                                      • Opcode Fuzzy Hash: 401aa2d1d82517962a3f72610155f7288a46811b66d0e3f5228e246bc97d2745
                                      • Instruction Fuzzy Hash: 3A1117B69043099FCB10CFAAD844AEEFBF4EB48724F14842EE515A7600C775A945CFA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322A6F1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 134 322a6f1-322a738 136 322a740-322a76f LoadLibraryExW 134->136 137 322a73a-322a73d 134->137 138 322a771-322a777 136->138 139 322a778-322a795 136->139 137->136 138->139
                                      APIs
                                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0322A551,00000800,00000000,00000000), ref: 0322A762
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: LibraryLoad
                                      • String ID:
                                      • API String ID: 1029625771-0
                                      • Opcode ID: 7347b6b35b34c5b9589b2a75d45fc663465933a5f3b26741e194787f9fb0831b
                                      • Instruction ID: 11c12a006f44f053241905c73cacc270ba7e26b0ace69fc826780db2a745822a
                                      • Opcode Fuzzy Hash: 7347b6b35b34c5b9589b2a75d45fc663465933a5f3b26741e194787f9fb0831b
                                      • Instruction Fuzzy Hash: A61114B6C002099FCB10DFAAD844BDEFBF4EB48724F14842AE419A7600C779A545CFA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322A470 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 142 322a470-322a4b0 143 322a4b2-322a4b5 142->143 144 322a4b8-322a4e3 GetModuleHandleW 142->144 143->144 145 322a4e5-322a4eb 144->145 146 322a4ec-322a500 144->146 145->146
                                      APIs
                                      • GetModuleHandleW.KERNELBASE(00000000), ref: 0322A4D6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID: HandleModule
                                      • String ID:
                                      • API String ID: 4139908857-0
                                      • Opcode ID: 47e75709453299b0eb5b84e12f85f17cf67b642b90bc2b51e2a618ed8e197618
                                      • Instruction ID: 29b62283d8eb5e3fc01e57026e2e8b33a019b7098199315a24ff28ae1a30d825
                                      • Opcode Fuzzy Hash: 47e75709453299b0eb5b84e12f85f17cf67b642b90bc2b51e2a618ed8e197618
                                      • Instruction Fuzzy Hash: D61102B5C006499FCB10CF9AD844ADEFBF8EB88224F14841AD419B7600D779A545CFA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D4C4 Relevance: .1, Instructions: 75COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a9b3b37c5f54eb7f5228b9cf88782875828caf4977223eba9069c6a32509342d
                                      • Instruction ID: 5c62ef2c515a5e491626abbaab83bd907d2af2dc0945c5129c5fd9ba24466b2f
                                      • Opcode Fuzzy Hash: a9b3b37c5f54eb7f5228b9cf88782875828caf4977223eba9069c6a32509342d
                                      • Instruction Fuzzy Hash: 42212871504244DFDB02DF54DAC0B26BF65FB88318F24C6A9F9058B246C376D995C7A1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D3D8 Relevance: .1, Instructions: 75COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8498939fbe87e732bcc603072734b45adb16ad6484647d2c823104856b417530
                                      • Instruction ID: 0bbea5f0ecfff488bc17443bbe140fdbf86ee9be7c56f6b141a3fa183eb47c3b
                                      • Opcode Fuzzy Hash: 8498939fbe87e732bcc603072734b45adb16ad6484647d2c823104856b417530
                                      • Instruction Fuzzy Hash: 70216AB1504204DFDB02DF44D9C0B66BF65FB88328F20C669E9058F246C336E986C7A1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0183D1D4 Relevance: .1, Instructions: 72COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407128912.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_183d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 214ebe75249418c4c0fbf965c95613eaf5ad9e09fc862227d750f459585d3278
                                      • Instruction ID: d66325ae3a4bd3f2707910bf309cc0fda4f14484f0b6871273006d8502f145fe
                                      • Opcode Fuzzy Hash: 214ebe75249418c4c0fbf965c95613eaf5ad9e09fc862227d750f459585d3278
                                      • Instruction Fuzzy Hash: E621F871504204DFDB01DF54D9C0B25BB65FBC4328F68C66DE9098B242C736E946CAA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0183D01C Relevance: .1, Instructions: 72COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407128912.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_183d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 46e4ae3918101df0f8c1ed7e394a0e4838d7fe67bffb885b08c8e85ad73b818c
                                      • Instruction ID: fec3c3c38b4902bb03085bf11bdfb03c4ecfcda056087678fdeb61dab7ffa5a6
                                      • Opcode Fuzzy Hash: 46e4ae3918101df0f8c1ed7e394a0e4838d7fe67bffb885b08c8e85ad73b818c
                                      • Instruction Fuzzy Hash: 042125B1508204DFCB11DF54D8D0B26FB65FBC8758F68C669E9098B346C33AD907CAA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D3D3 Relevance: .1, Instructions: 56COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1bfb3aba2a15877e7bcd26e2822cbb8c2d677bd236deaf3f1958028af9bb876d
                                      • Instruction ID: caf0085fae9be26ced0b60101cb522855920550db8600afac1d8130410432e66
                                      • Opcode Fuzzy Hash: 1bfb3aba2a15877e7bcd26e2822cbb8c2d677bd236deaf3f1958028af9bb876d
                                      • Instruction Fuzzy Hash: 7711D376404280DFDB12CF54D9C4B56BF71FB84324F24C6A9D8094B657C33AE59ACBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D4BF Relevance: .1, Instructions: 56COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1bfb3aba2a15877e7bcd26e2822cbb8c2d677bd236deaf3f1958028af9bb876d
                                      • Instruction ID: 0c2167d420f751b8463841abd0a25ee2e951d26967b6973a99ce1e3715a2bd45
                                      • Opcode Fuzzy Hash: 1bfb3aba2a15877e7bcd26e2822cbb8c2d677bd236deaf3f1958028af9bb876d
                                      • Instruction Fuzzy Hash: 4D11D376404280DFDB12CF54D6C4B16BF71FB84324F24C6A9E8454B657C336D59ACBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0183D017 Relevance: .1, Instructions: 53COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407128912.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_183d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3913381544556c8f130f0414bd4aa73f7b271d0d51e96c491ec5fd0834483e1b
                                      • Instruction ID: 0fe39a1569fd5a70829a1303f260fb673525680767ccb9fca0f2705996fc06cb
                                      • Opcode Fuzzy Hash: 3913381544556c8f130f0414bd4aa73f7b271d0d51e96c491ec5fd0834483e1b
                                      • Instruction Fuzzy Hash: BA11BB75504280CFCB12CF54D5D4B15FBA2FB84724F28C6AAD8498B656C33AD54ACBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0183D1CF Relevance: .1, Instructions: 53COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407128912.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_183d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3913381544556c8f130f0414bd4aa73f7b271d0d51e96c491ec5fd0834483e1b
                                      • Instruction ID: 7c4169b0a0ac132b50f4bcf30f3420b52b7c50fec49cd986de274383c374c431
                                      • Opcode Fuzzy Hash: 3913381544556c8f130f0414bd4aa73f7b271d0d51e96c491ec5fd0834483e1b
                                      • Instruction Fuzzy Hash: A811BB75904280DFCB02CF54C5C0B15BBA2FB84324F28C6A9D8498B656C33AE55ACBA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D745 Relevance: .0, Instructions: 45COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: cc612d35d9cec906686a6f9b8d865021ffa9c3ba1e68cb1fd44320581a153482
                                      • Instruction ID: cbbd32c8a0bbe8e9867f71f2095255bb2a09d1d5a37b77e3bd1d81fe740ab453
                                      • Opcode Fuzzy Hash: cc612d35d9cec906686a6f9b8d865021ffa9c3ba1e68cb1fd44320581a153482
                                      • Instruction Fuzzy Hash: 5001477100C3E49EE7225F65CC84B62BF9CEF41338F08865AEE049B246D37D9984C6B1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0182D744 Relevance: .0, Instructions: 36COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407063279.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_182d000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 929f4df5baa855778e8f1ffe303fe5881b63f36e70dfaad925bd571ff82b07bf
                                      • Instruction ID: c24eb65f575e743e858a849d4416b530632a770e2cb3ac0c2580431bfcbad59c
                                      • Opcode Fuzzy Hash: 929f4df5baa855778e8f1ffe303fe5881b63f36e70dfaad925bd571ff82b07bf
                                      • Instruction Fuzzy Hash: E2F096714083949EEB118E19CCC8B72FF9CEB81774F18C55AED085B286D3799C84CAB1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Non-executed Functions

                                      Function 00EB4714 Relevance: 1.4, Instructions: 1432COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.405849849.0000000000EB2000.00000002.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true
                                      • Associated: 00000000.00000002.405832860.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_eb0000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4c7fbfa501736f52c44a17307a6c2ecd11b7da269bb3927c58d963c01cf38633
                                      • Instruction ID: fb4db065f226331cc45956b00609a297a0739877442fbbd73643b01557b4d119
                                      • Opcode Fuzzy Hash: 4c7fbfa501736f52c44a17307a6c2ecd11b7da269bb3927c58d963c01cf38633
                                      • Instruction Fuzzy Hash: A6C206A240E7C28FDB134B785CB52D27FB1AE6721871E14CBC4C0DF0A7E219595ADB62
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322F080 Relevance: .3, Instructions: 305COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 17f1343f9c90d9fad8e5c321e17efe31cf4e36162d31cd29a771edfae10acc28
                                      • Instruction ID: fa0bc3d9a162274219671fe8ee6b26f2975a55c93749b7d3f8d946e5e113e894
                                      • Opcode Fuzzy Hash: 17f1343f9c90d9fad8e5c321e17efe31cf4e36162d31cd29a771edfae10acc28
                                      • Instruction Fuzzy Hash: F802A7F14297468BD310CF65E89A1893FE1B74533AB90C309E2616BAD1DFB8114AFF84
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322D65C Relevance: .3, Instructions: 265COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3ca80cbb8658bccb34da354e4155b9dee85affb0af4e527d03d1f15354d46e95
                                      • Instruction ID: 6f521a9d57d941ce285cda44a8bdeea8298eee20b185eec589fe85b0cd2340ab
                                      • Opcode Fuzzy Hash: 3ca80cbb8658bccb34da354e4155b9dee85affb0af4e527d03d1f15354d46e95
                                      • Instruction Fuzzy Hash: 15A19E36E2062A9FCF05DFA5C8445DDBBF2FF84301B15816AE805AF260DB75A945DB40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0322F071 Relevance: .2, Instructions: 212COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.407434444.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_3220000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 71902635239cfa6b95337b77227eb3fde9c4ddc19a94a2e874f94dd54140c289
                                      • Instruction ID: 315c9c7c2803001d7d732e8cdf3ac15e94acfe00dd55e44712a0ca3aa03d8fc8
                                      • Opcode Fuzzy Hash: 71902635239cfa6b95337b77227eb3fde9c4ddc19a94a2e874f94dd54140c289
                                      • Instruction Fuzzy Hash: A4B11BB18297568BD710DF64E88A1897FB1BB8533AF50C309E1616B6D0EFB41146FF84
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Execution Graph

                                      Execution Coverage:7.6%
                                      Dynamic/Decrypted Code Coverage:0%
                                      Signature Coverage:3%
                                      Total number of Nodes:659
                                      Total number of Limit Nodes:80
                                      execution_graph 17216 41f160 17219 41b960 17216->17219 17220 41b986 17219->17220 17227 409d30 17220->17227 17222 41b9b3 17223 41b992 17223->17222 17235 40c1b0 17223->17235 17225 41b9a5 17271 41a6a0 17225->17271 17274 409c80 17227->17274 17229 409d3d 17230 409d44 17229->17230 17286 409c20 17229->17286 17230->17223 17236 40c1d5 17235->17236 17792 40b1b0 17236->17792 17238 40c22c 17796 40ae30 17238->17796 17240 40c252 17270 40c4a3 17240->17270 17805 414390 17240->17805 17242 40c297 17242->17270 17808 408a60 17242->17808 17244 40c2db 17244->17270 17815 41a4f0 17244->17815 17248 40c331 17249 40c338 17248->17249 17251 41a000 LdrLoadDll 17248->17251 17250 41bdb0 2 API calls 17249->17250 17252 40c345 17250->17252 17253 40c375 17251->17253 17252->17225 17254 40c392 17253->17254 17255 40c382 17253->17255 17258 40f490 LdrLoadDll 17254->17258 17256 41bdb0 2 API calls 17255->17256 17257 40c389 17256->17257 17257->17225 17259 40c406 17258->17259 17259->17249 17260 40c411 17259->17260 17261 41bdb0 2 API calls 17260->17261 17262 40c435 17261->17262 17825 41a050 17262->17825 17265 41a000 LdrLoadDll 17266 40c470 17265->17266 17266->17270 17828 419e10 17266->17828 17269 41a6a0 2 API calls 17269->17270 17270->17225 17272 41a6bf ExitProcess 17271->17272 17273 41af50 LdrLoadDll 17271->17273 17273->17272 17305 418bb0 17274->17305 17278 409ca6 17278->17229 17279 409c9c 17279->17278 17312 41b2a0 17279->17312 17281 409ce3 17281->17278 17323 409aa0 17281->17323 17283 409d03 17329 409620 17283->17329 17285 409d15 17285->17229 17287 409c3a 17286->17287 17288 41b590 LdrLoadDll 17286->17288 17775 41b590 17287->17775 17288->17287 17291 41b590 LdrLoadDll 17292 409c61 17291->17292 17293 40f170 17292->17293 17294 40f189 17293->17294 17779 40b030 17294->17779 17296 40f19c 17783 41a1d0 17296->17783 17300 40f1c2 17301 40f1ed 17300->17301 17789 41a250 17300->17789 17303 41a480 2 API calls 17301->17303 17304 409d55 17303->17304 17304->17223 17306 418bbf 17305->17306 17333 414e40 17306->17333 17308 409c93 17309 418a60 17308->17309 17365 41a5f0 17309->17365 17313 41b2b9 17312->17313 17372 414a40 17313->17372 17315 41b2d1 17316 41b2da 17315->17316 17411 41b0e0 17315->17411 17316->17281 17318 41b2ee 17318->17316 17429 419ef0 17318->17429 17749 407ea0 17323->17749 17325 409ac1 17325->17283 17326 409aba 17326->17325 17762 408160 17326->17762 17330 409648 17329->17330 17768 40af00 17330->17768 17332 40967e 17332->17285 17334 414e5a 17333->17334 17335 414e4e 17333->17335 17334->17308 17335->17334 17338 4152c0 17335->17338 17343 414fc0 17338->17343 17340 4152d8 17341 414e40 LdrLoadDll 17340->17341 17342 414fac 17340->17342 17341->17342 17342->17308 17344 414fe5 17343->17344 17345 415054 17344->17345 17357 40ace0 17344->17357 17345->17340 17347 415086 17353 41512b 17347->17353 17361 41c050 17347->17361 17350 415124 17350->17353 17355 4152c0 LdrLoadDll 17350->17355 17351 415191 17352 4152c0 LdrLoadDll 17351->17352 17351->17353 17354 4151c3 17352->17354 17353->17340 17354->17340 17356 415187 17355->17356 17356->17340 17358 40ad04 17357->17358 17359 40ad40 LdrLoadDll 17358->17359 17360 40ad0b 17358->17360 17359->17360 17360->17347 17362 41c060 17361->17362 17363 4150cd 17361->17363 17364 414e40 LdrLoadDll 17362->17364 17363->17350 17363->17351 17363->17353 17364->17363 17368 41af50 17365->17368 17367 418a75 17367->17279 17369 41af60 17368->17369 17371 41af82 17368->17371 17370 414e40 LdrLoadDll 17369->17370 17370->17371 17371->17367 17373 414d75 17372->17373 17383 414a54 17372->17383 17373->17315 17376 414b80 17438 41a350 17376->17438 17377 414b63 17495 41a450 17377->17495 17380 414b6d 17380->17315 17381 414ba7 17382 41bdb0 2 API calls 17381->17382 17385 414bb3 17382->17385 17383->17373 17435 419c40 17383->17435 17384 414d39 17387 41a480 2 API calls 17384->17387 17385->17380 17385->17384 17386 414d4f 17385->17386 17391 414c42 17385->17391 17520 414780 17386->17520 17388 414d40 17387->17388 17388->17315 17390 414d62 17390->17315 17392 414ca9 17391->17392 17394 414c51 17391->17394 17392->17384 17393 414cbc 17392->17393 17511 41a2d0 17393->17511 17396 414c56 17394->17396 17397 414c6a 17394->17397 17498 414640 17396->17498 17398 414c87 17397->17398 17399 414c6f 17397->17399 17398->17388 17453 414400 17398->17453 17441 4146e0 17399->17441 17402 414c60 17402->17315 17405 414c7d 17405->17315 17409 414c9f 17409->17315 17410 414d28 17410->17315 17413 41b0f1 17411->17413 17412 41b103 17412->17318 17413->17412 17583 41bd30 17413->17583 17415 41b124 17586 414060 17415->17586 17417 41b170 17417->17318 17418 41b147 17418->17417 17419 414060 3 API calls 17418->17419 17420 41b169 17419->17420 17420->17417 17618 415380 17420->17618 17422 41b20a 17628 41ad60 17422->17628 17423 41b1fa 17423->17422 17710 41aef0 17423->17710 17426 41b238 17707 419eb0 17426->17707 17430 419f0c 17429->17430 17431 41af50 LdrLoadDll 17429->17431 17432 41bdb0 17430->17432 17431->17430 17746 41a660 17432->17746 17434 41b349 17434->17281 17436 41af50 LdrLoadDll 17435->17436 17437 414b34 17436->17437 17437->17376 17437->17377 17437->17380 17439 41a36c NtCreateFile 17438->17439 17440 41af50 LdrLoadDll 17438->17440 17439->17381 17440->17439 17442 4146fc 17441->17442 17443 41a2d0 LdrLoadDll 17442->17443 17444 41471d 17443->17444 17445 414724 17444->17445 17446 414738 17444->17446 17447 41a480 2 API calls 17445->17447 17448 41a480 2 API calls 17446->17448 17449 41472d 17447->17449 17450 414741 17448->17450 17449->17405 17554 41bfc0 17450->17554 17452 41474c 17452->17405 17454 41444b 17453->17454 17455 41447e 17453->17455 17456 41a2d0 LdrLoadDll 17454->17456 17457 4145c9 17455->17457 17461 41449a 17455->17461 17459 414466 17456->17459 17458 41a2d0 LdrLoadDll 17457->17458 17467 4145e4 17458->17467 17460 41a480 2 API calls 17459->17460 17462 41446f 17460->17462 17463 41a2d0 LdrLoadDll 17461->17463 17462->17409 17464 4144b5 17463->17464 17465 4144d1 17464->17465 17466 4144bc 17464->17466 17471 4144d6 17465->17471 17472 4144ec 17465->17472 17470 41a480 2 API calls 17466->17470 17468 41a310 LdrLoadDll 17467->17468 17469 41461e 17468->17469 17473 41a480 2 API calls 17469->17473 17474 4144c5 17470->17474 17475 41a480 2 API calls 17471->17475 17481 4144f1 17472->17481 17560 41bf80 17472->17560 17476 414629 17473->17476 17474->17409 17477 4144df 17475->17477 17476->17409 17477->17409 17480 414557 17482 41456e 17480->17482 17571 41a290 17480->17571 17488 414503 17481->17488 17563 41a400 17481->17563 17484 414575 17482->17484 17485 41458a 17482->17485 17486 41a480 2 API calls 17484->17486 17487 41a480 2 API calls 17485->17487 17486->17488 17489 414593 17487->17489 17488->17409 17490 4145bf 17489->17490 17566 41bb80 17489->17566 17490->17409 17492 4145aa 17493 41bdb0 2 API calls 17492->17493 17494 4145b3 17493->17494 17494->17409 17496 41a46c 17495->17496 17497 41af50 LdrLoadDll 17495->17497 17496->17380 17497->17496 17574 419fb0 17498->17574 17501 414684 17503 41a480 2 API calls 17501->17503 17502 414698 17577 41a000 17502->17577 17505 41468d 17503->17505 17505->17402 17507 41a480 2 API calls 17508 4146c2 17507->17508 17509 41a480 2 API calls 17508->17509 17510 4146cc 17509->17510 17510->17402 17512 414d04 17511->17512 17513 41af50 LdrLoadDll 17511->17513 17514 41a310 17512->17514 17513->17512 17515 41af50 LdrLoadDll 17514->17515 17516 414d1c 17515->17516 17517 41a480 17516->17517 17518 41a49c NtClose 17517->17518 17519 41af50 LdrLoadDll 17517->17519 17518->17410 17519->17518 17521 4147be 17520->17521 17522 41a2d0 LdrLoadDll 17520->17522 17523 4147c7 17521->17523 17524 4147dc 17521->17524 17522->17521 17525 41a480 2 API calls 17523->17525 17526 414800 17524->17526 17527 41484a 17524->17527 17537 4147d0 17525->17537 17580 41a3b0 17526->17580 17528 414890 17527->17528 17529 41484f 17527->17529 17534 4148a2 17528->17534 17539 4149ca 17528->17539 17533 41a400 2 API calls 17529->17533 17529->17537 17532 41a480 2 API calls 17532->17537 17535 41487a 17533->17535 17536 4148a7 17534->17536 17545 4148e2 17534->17545 17538 41a480 2 API calls 17535->17538 17540 41a3b0 LdrLoadDll 17536->17540 17537->17390 17541 414883 17538->17541 17539->17537 17544 41a400 2 API calls 17539->17544 17542 4148ca 17540->17542 17541->17390 17543 41a480 2 API calls 17542->17543 17546 4148d3 17543->17546 17548 414a21 17544->17548 17545->17537 17547 41a3b0 LdrLoadDll 17545->17547 17546->17390 17549 41490a 17547->17549 17550 41a480 2 API calls 17548->17550 17551 41a480 2 API calls 17549->17551 17552 414a2a 17550->17552 17553 414915 17551->17553 17552->17390 17553->17390 17557 41a620 17554->17557 17556 41bfda 17556->17452 17558 41af50 LdrLoadDll 17557->17558 17559 41a63c RtlAllocateHeap 17558->17559 17559->17556 17561 41a620 2 API calls 17560->17561 17562 41bf98 17560->17562 17561->17562 17562->17481 17564 41a41c NtReadFile 17563->17564 17565 41af50 LdrLoadDll 17563->17565 17564->17480 17565->17564 17567 41bba4 17566->17567 17568 41bb8d 17566->17568 17567->17492 17568->17567 17569 41bf80 2 API calls 17568->17569 17570 41bbbb 17569->17570 17570->17492 17572 41af50 LdrLoadDll 17571->17572 17573 41a2ac 17572->17573 17573->17482 17575 41467d 17574->17575 17576 41af50 LdrLoadDll 17574->17576 17575->17501 17575->17502 17576->17575 17578 41af50 LdrLoadDll 17577->17578 17579 4146b9 17578->17579 17579->17507 17581 414825 17580->17581 17582 41af50 LdrLoadDll 17580->17582 17581->17532 17582->17581 17714 41a530 17583->17714 17585 41bd5d 17585->17415 17587 414071 17586->17587 17588 414079 17586->17588 17587->17418 17617 41434c 17588->17617 17717 41cf20 17588->17717 17590 4140cd 17591 41cf20 2 API calls 17590->17591 17595 4140d8 17591->17595 17592 414126 17594 41cf20 2 API calls 17592->17594 17598 41413a 17594->17598 17595->17592 17596 41d050 3 API calls 17595->17596 17728 41cfc0 17595->17728 17596->17595 17597 414197 17599 41cf20 2 API calls 17597->17599 17598->17597 17722 41d050 17598->17722 17605 4141ad 17599->17605 17601 4141ea 17602 41cf20 2 API calls 17601->17602 17604 4141f5 17602->17604 17603 41d050 3 API calls 17603->17605 17606 41d050 3 API calls 17604->17606 17612 41422f 17604->17612 17605->17601 17605->17603 17606->17604 17609 41cf80 2 API calls 17610 41432e 17609->17610 17611 41cf80 2 API calls 17610->17611 17613 414338 17611->17613 17734 41cf80 17612->17734 17614 41cf80 2 API calls 17613->17614 17615 414342 17614->17615 17616 41cf80 2 API calls 17615->17616 17616->17617 17617->17418 17619 415391 17618->17619 17620 414a40 6 API calls 17619->17620 17622 4153a7 17620->17622 17621 4153fa 17621->17423 17622->17621 17623 4153e2 17622->17623 17624 4153f5 17622->17624 17626 41bdb0 2 API calls 17623->17626 17625 41bdb0 2 API calls 17624->17625 17625->17621 17627 4153e7 17626->17627 17627->17423 17629 41ad74 17628->17629 17630 41ac20 LdrLoadDll 17628->17630 17737 41ac20 17629->17737 17630->17629 17633 41ac20 LdrLoadDll 17634 41ad86 17633->17634 17635 41ac20 LdrLoadDll 17634->17635 17636 41ad8f 17635->17636 17637 41ac20 LdrLoadDll 17636->17637 17638 41ad98 17637->17638 17639 41ac20 LdrLoadDll 17638->17639 17640 41ada1 17639->17640 17641 41ac20 LdrLoadDll 17640->17641 17642 41adad 17641->17642 17643 41ac20 LdrLoadDll 17642->17643 17644 41adb6 17643->17644 17645 41ac20 LdrLoadDll 17644->17645 17646 41adbf 17645->17646 17647 41ac20 LdrLoadDll 17646->17647 17648 41adc8 17647->17648 17649 41ac20 LdrLoadDll 17648->17649 17650 41add1 17649->17650 17651 41ac20 LdrLoadDll 17650->17651 17652 41adda 17651->17652 17653 41ac20 LdrLoadDll 17652->17653 17654 41ade6 17653->17654 17655 41ac20 LdrLoadDll 17654->17655 17656 41adef 17655->17656 17657 41ac20 LdrLoadDll 17656->17657 17658 41adf8 17657->17658 17659 41ac20 LdrLoadDll 17658->17659 17660 41ae01 17659->17660 17661 41ac20 LdrLoadDll 17660->17661 17662 41ae0a 17661->17662 17663 41ac20 LdrLoadDll 17662->17663 17664 41ae13 17663->17664 17665 41ac20 LdrLoadDll 17664->17665 17666 41ae1f 17665->17666 17667 41ac20 LdrLoadDll 17666->17667 17668 41ae28 17667->17668 17669 41ac20 LdrLoadDll 17668->17669 17670 41ae31 17669->17670 17671 41ac20 LdrLoadDll 17670->17671 17672 41ae3a 17671->17672 17673 41ac20 LdrLoadDll 17672->17673 17674 41ae43 17673->17674 17675 41ac20 LdrLoadDll 17674->17675 17676 41ae4c 17675->17676 17677 41ac20 LdrLoadDll 17676->17677 17678 41ae58 17677->17678 17679 41ac20 LdrLoadDll 17678->17679 17680 41ae61 17679->17680 17681 41ac20 LdrLoadDll 17680->17681 17682 41ae6a 17681->17682 17683 41ac20 LdrLoadDll 17682->17683 17684 41ae73 17683->17684 17685 41ac20 LdrLoadDll 17684->17685 17686 41ae7c 17685->17686 17687 41ac20 LdrLoadDll 17686->17687 17688 41ae85 17687->17688 17689 41ac20 LdrLoadDll 17688->17689 17690 41ae91 17689->17690 17691 41ac20 LdrLoadDll 17690->17691 17692 41ae9a 17691->17692 17693 41ac20 LdrLoadDll 17692->17693 17694 41aea3 17693->17694 17695 41ac20 LdrLoadDll 17694->17695 17696 41aeac 17695->17696 17697 41ac20 LdrLoadDll 17696->17697 17698 41aeb5 17697->17698 17699 41ac20 LdrLoadDll 17698->17699 17700 41aebe 17699->17700 17701 41ac20 LdrLoadDll 17700->17701 17702 41aeca 17701->17702 17703 41ac20 LdrLoadDll 17702->17703 17704 41aed3 17703->17704 17705 41ac20 LdrLoadDll 17704->17705 17706 41aedc 17705->17706 17706->17426 17708 41af50 LdrLoadDll 17707->17708 17709 419ecc 17708->17709 17709->17318 17711 41af03 17710->17711 17743 41a4b0 17711->17743 17715 41a54c NtAllocateVirtualMemory 17714->17715 17716 41af50 LdrLoadDll 17714->17716 17715->17585 17716->17715 17718 41cf30 17717->17718 17719 41cf36 17717->17719 17718->17590 17720 41bf80 2 API calls 17719->17720 17721 41cf5c 17720->17721 17721->17590 17723 41cfc0 17722->17723 17724 41d01d 17723->17724 17725 41bf80 2 API calls 17723->17725 17724->17598 17726 41cffa 17725->17726 17727 41bdb0 2 API calls 17726->17727 17727->17724 17729 41cfe5 17728->17729 17730 41d01d 17728->17730 17731 41bf80 2 API calls 17729->17731 17730->17595 17732 41cffa 17731->17732 17733 41bdb0 2 API calls 17732->17733 17733->17730 17735 414324 17734->17735 17736 41bdb0 2 API calls 17734->17736 17735->17609 17736->17735 17738 41ac3b 17737->17738 17739 414e40 LdrLoadDll 17738->17739 17740 41ac5b 17739->17740 17741 414e40 LdrLoadDll 17740->17741 17742 41ad07 17740->17742 17741->17742 17742->17633 17744 41af50 LdrLoadDll 17743->17744 17745 41a4cc 17744->17745 17745->17422 17747 41a67c RtlFreeHeap 17746->17747 17748 41af50 LdrLoadDll 17746->17748 17747->17434 17748->17747 17750 407eb0 17749->17750 17751 407eab 17749->17751 17752 41bd30 2 API calls 17750->17752 17751->17326 17755 407ed5 17752->17755 17753 407f38 17753->17326 17754 419eb0 LdrLoadDll 17754->17755 17755->17753 17755->17754 17756 407f3e 17755->17756 17760 41bd30 2 API calls 17755->17760 17765 41a5b0 17755->17765 17758 407f64 17756->17758 17759 41a5b0 LdrLoadDll 17756->17759 17758->17326 17761 407f55 17759->17761 17760->17755 17761->17326 17763 40817e 17762->17763 17764 41a5b0 LdrLoadDll 17762->17764 17763->17283 17764->17763 17766 41a5cc 17765->17766 17767 41af50 LdrLoadDll 17765->17767 17766->17755 17767->17766 17769 40af24 17768->17769 17772 419c80 17769->17772 17771 40af5e 17771->17332 17773 419c9c 17772->17773 17774 41af50 LdrLoadDll 17772->17774 17773->17771 17774->17773 17776 41b5b3 17775->17776 17777 40ace0 LdrLoadDll 17776->17777 17778 409c4b 17777->17778 17778->17291 17780 40b053 17779->17780 17781 419c80 LdrLoadDll 17780->17781 17782 40b0d0 17780->17782 17781->17782 17782->17296 17784 41af50 LdrLoadDll 17783->17784 17785 40f1ab 17784->17785 17785->17304 17786 41a7c0 17785->17786 17787 41af50 LdrLoadDll 17786->17787 17788 41a7df LookupPrivilegeValueW 17787->17788 17788->17300 17790 41a26c 17789->17790 17791 41af50 LdrLoadDll 17789->17791 17790->17301 17791->17790 17793 40b1b9 17792->17793 17794 40b030 LdrLoadDll 17793->17794 17795 40b1f4 17794->17795 17795->17238 17797 40ae41 17796->17797 17798 40ae3d 17796->17798 17799 40ae5a 17797->17799 17800 40ae8c 17797->17800 17798->17240 17831 419cc0 17799->17831 17801 419cc0 LdrLoadDll 17800->17801 17802 40ae9d 17801->17802 17802->17240 17806 40f490 LdrLoadDll 17805->17806 17807 4143b6 17806->17807 17807->17242 17811 408a79 17808->17811 17834 4087a0 17808->17834 17810 408a9d 17810->17244 17811->17810 17812 4087a0 8 API calls 17811->17812 17813 408a8a 17812->17813 17813->17810 17852 40f700 17813->17852 17816 41af50 LdrLoadDll 17815->17816 17817 40c312 17816->17817 17818 40f490 17817->17818 17819 40f4ad 17818->17819 17820 419fb0 LdrLoadDll 17819->17820 17821 40f4ee 17820->17821 17822 40f4f5 17821->17822 17823 41a000 LdrLoadDll 17821->17823 17822->17248 17824 40f51e 17823->17824 17824->17248 17826 41af50 LdrLoadDll 17825->17826 17827 40c449 17826->17827 17827->17265 17829 41af50 LdrLoadDll 17828->17829 17830 40c49c 17829->17830 17830->17269 17832 41af50 LdrLoadDll 17831->17832 17833 40ae7c 17832->17833 17833->17240 17835 407ea0 2 API calls 17834->17835 17844 4087ba 17834->17844 17835->17844 17836 408a49 17836->17811 17837 408a3f 17838 408160 LdrLoadDll 17837->17838 17838->17836 17841 419ef0 LdrLoadDll 17841->17844 17843 41a480 LdrLoadDll NtClose 17843->17844 17844->17836 17844->17837 17844->17841 17844->17843 17847 40c4b0 LdrLoadDll NtClose 17844->17847 17850 419e10 LdrLoadDll 17844->17850 17860 419d00 17844->17860 17863 4085d0 17844->17863 17875 40f5e0 17844->17875 17883 419d80 17844->17883 17886 419db0 17844->17886 17889 419e40 17844->17889 17892 4083a0 17844->17892 17908 405f60 17844->17908 17847->17844 17850->17844 17853 40f725 17852->17853 17854 4081a0 6 API calls 17853->17854 17855 40f749 17854->17855 17856 40f756 17855->17856 17857 414a40 6 API calls 17855->17857 17859 41bdb0 2 API calls 17855->17859 17996 40f540 17855->17996 17856->17810 17857->17855 17859->17855 17861 41af50 LdrLoadDll 17860->17861 17862 419d1c 17860->17862 17861->17862 17862->17844 17864 4085e6 17863->17864 17918 419870 17864->17918 17866 4085ff 17871 408771 17866->17871 17939 4081a0 17866->17939 17868 4086e5 17869 4083a0 7 API calls 17868->17869 17868->17871 17870 408713 17869->17870 17870->17871 17872 419ef0 LdrLoadDll 17870->17872 17871->17844 17873 408748 17872->17873 17873->17871 17874 41a4f0 LdrLoadDll 17873->17874 17874->17871 17975 419d40 17875->17975 17878 40f645 17878->17844 17881 40f651 17881->17844 17882 41a480 2 API calls 17882->17878 17884 419d9c 17883->17884 17885 41af50 LdrLoadDll 17883->17885 17884->17844 17885->17884 17887 41af50 LdrLoadDll 17886->17887 17888 419dcc 17887->17888 17888->17844 17890 41af50 LdrLoadDll 17889->17890 17891 419e5c 17890->17891 17891->17844 17893 4083ae 17892->17893 17981 408310 17893->17981 17896 41a4f0 LdrLoadDll 17897 4083dc 17896->17897 17897->17896 17898 408467 17897->17898 17901 408462 17897->17901 17989 40f660 17897->17989 17898->17844 17899 41a480 2 API calls 17900 40849a 17899->17900 17900->17898 17902 419d00 LdrLoadDll 17900->17902 17901->17899 17903 4084ff 17902->17903 17903->17898 17904 419d40 LdrLoadDll 17903->17904 17905 408563 17904->17905 17905->17898 17906 414a40 6 API calls 17905->17906 17907 4085b8 17906->17907 17907->17844 17909 405faa 17908->17909 17910 419d00 LdrLoadDll 17909->17910 17911 405fc4 17910->17911 17912 414e40 LdrLoadDll 17911->17912 17917 40609c 17911->17917 17913 406018 17912->17913 17914 40af00 LdrLoadDll 17913->17914 17915 406077 17914->17915 17916 414e40 LdrLoadDll 17915->17916 17916->17917 17917->17844 17919 41bf80 2 API calls 17918->17919 17920 419887 17919->17920 17946 409310 17920->17946 17922 4198a2 17923 4198e0 17922->17923 17924 4198c9 17922->17924 17927 41bd30 2 API calls 17923->17927 17925 41bdb0 2 API calls 17924->17925 17926 4198d6 17925->17926 17926->17866 17928 41991a 17927->17928 17929 41bd30 2 API calls 17928->17929 17930 419933 17929->17930 17936 419bd4 17930->17936 17952 41bd70 17930->17952 17933 419bc0 17934 41bdb0 2 API calls 17933->17934 17935 419bca 17934->17935 17935->17866 17937 41bdb0 2 API calls 17936->17937 17938 419c29 17937->17938 17938->17866 17940 40829f 17939->17940 17941 4081b5 17939->17941 17940->17868 17941->17940 17942 414a40 6 API calls 17941->17942 17943 408222 17942->17943 17944 41bdb0 2 API calls 17943->17944 17945 408249 17943->17945 17944->17945 17945->17868 17947 409335 17946->17947 17948 40ace0 LdrLoadDll 17947->17948 17949 409368 17948->17949 17951 40938d 17949->17951 17955 40cf10 17949->17955 17951->17922 17972 41a570 17952->17972 17956 40cf3c 17955->17956 17957 41a1d0 LdrLoadDll 17956->17957 17958 40cf55 17957->17958 17959 40cf5c 17958->17959 17966 41a210 17958->17966 17959->17951 17963 40cf97 17964 41a480 2 API calls 17963->17964 17965 40cfba 17964->17965 17965->17951 17967 40cf7f 17966->17967 17968 41af50 LdrLoadDll 17966->17968 17967->17959 17969 41a800 17967->17969 17968->17967 17970 41af50 LdrLoadDll 17969->17970 17971 41a81f 17970->17971 17971->17963 17973 41af50 LdrLoadDll 17972->17973 17974 419bb9 17973->17974 17974->17933 17974->17936 17976 41af50 LdrLoadDll 17975->17976 17977 40f624 17976->17977 17977->17878 17978 419de0 17977->17978 17979 41af50 LdrLoadDll 17978->17979 17980 40f635 17979->17980 17980->17881 17980->17882 17982 408328 17981->17982 17983 40ace0 LdrLoadDll 17982->17983 17984 408343 17983->17984 17985 414e40 LdrLoadDll 17984->17985 17986 408353 17985->17986 17987 408362 PostThreadMessageW 17986->17987 17988 408370 17986->17988 17987->17988 17988->17897 17990 40f673 17989->17990 17993 419e80 17990->17993 17994 40f69e 17993->17994 17995 41af50 LdrLoadDll 17993->17995 17994->17897 17995->17994 17997 40f551 17996->17997 18005 41a6d0 17997->18005 18000 40f598 18000->17855 18001 419ef0 LdrLoadDll 18002 40f5af 18001->18002 18002->18000 18003 41a4f0 LdrLoadDll 18002->18003 18004 40f5ce 18003->18004 18004->17855 18006 41af50 LdrLoadDll 18005->18006 18007 40f591 18006->18007 18007->18000 18007->18001

                                      Executed Functions

                                      Function 0041A3A4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 0 41a3a4-41a3a8 1 41a418-41a449 NtReadFile 0->1 2 41a3aa-41a3f9 call 41af50 0->2
                                      APIs
                                      • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A445
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID: IA$!JA$bMA$bMA
                                      • API String ID: 2738559852-3023253649
                                      • Opcode ID: 02f171dd9abe79aa025456d3a49aa9605f58399f91c6d33c59844f9de9b11b29
                                      • Instruction ID: 7ba8b5ee95dc65f450bda6e5119d593f5e168c5a849c0bf76054824a0001a25c
                                      • Opcode Fuzzy Hash: 02f171dd9abe79aa025456d3a49aa9605f58399f91c6d33c59844f9de9b11b29
                                      • Instruction Fuzzy Hash: CA11D7B6200108AFCB18DF99DC81DEB77A9EF8C364B158249F91DD7291C634EC11CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A3FA Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 7 41a3fa-41a449 call 41af50 NtReadFile
                                      APIs
                                      • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A445
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID: !JA$bMA$bMA
                                      • API String ID: 2738559852-4222312340
                                      • Opcode ID: 77fa557546fe326a48d5db15a66fdd37999c19f0ca4e5129ba7016a132965d11
                                      • Instruction ID: 0a2999f5d66880b1c51ddff7d12a0dbc5927ef3f44aef4bf25d619828c601fc9
                                      • Opcode Fuzzy Hash: 77fa557546fe326a48d5db15a66fdd37999c19f0ca4e5129ba7016a132965d11
                                      • Instruction Fuzzy Hash: 84F0F4B2200108AFCB14DF89CC81EEB77ADEF8C714F158248BA1DA7241C630E8518BB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 10 41a400-41a416 11 41a41c-41a449 NtReadFile 10->11 12 41a417 call 41af50 10->12 12->11
                                      C-Code - Quality: 37%
                                      			E0041A400(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				signed char _t14;
				void* _t19;
				void* _t28;
				intOrPtr* _t29;

				_t13 = _a4;
				_t29 = _a4 + 0xc48;
				_t14 = E0041AF50(_t28, _t13, _t29,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				 *(_t14 ^ 0x0000000b) =  *(_t14 ^ 0x0000000b) + _t15;
				_t4 =  &_a40; // 0x414a21
				_t6 =  &_a32; // 0x414d62
				_t12 =  &_a8; // 0x414d62
				_t19 =  *((intOrPtr*)( *_t29))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t19;
			}







                                      0x0041a403
                                      0x0041a40f
                                      0x0041a417
                                      0x0041a41a
                                      0x0041a41c
                                      0x0041a422
                                      0x0041a43d
                                      0x0041a445
                                      0x0041a449

                                      APIs
                                      • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A445
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID: !JA$bMA$bMA
                                      • API String ID: 2738559852-4222312340
                                      • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                      • Instruction ID: 27817754ac388b25b847a3362b671b2e44b934df7eae6808a762aa4d31f9cf83
                                      • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                      • Instruction Fuzzy Hash: 93F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A47A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 45 41a47a-41a4a9 call 41af50 NtClose
                                      C-Code - Quality: 84%
                                      			E0041A47A(void* __eax, intOrPtr _a4, void* _a8) {
				long _t16;
				void* _t19;
				signed int _t23;

				 *(_t23 + 0x4a + _t23 * 8) =  *(_t23 + 0x4a + _t23 * 8) >> 0x45;
				_push(_t23);
				_t13 = _a4;
				_t8 = _t13 + 0x10; // 0x300
				_t9 = _t13 + 0xc50; // 0x40a933
				E0041AF50(_t19, _a4, _t9,  *_t8, 0, 0x2c);
				_t16 = NtClose(_a8); // executed
				return _t16;
			}






                                      0x0041a47a
                                      0x0041a480
                                      0x0041a483
                                      0x0041a486
                                      0x0041a48f
                                      0x0041a497
                                      0x0041a4a5
                                      0x0041a4a9

                                      APIs
                                      • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A4A5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID: E
                                      • API String ID: 3535843008-3568589458
                                      • Opcode ID: a4c7c786217c4016c6368f2dd919b55df1f64bc3a74c0d7b6deab0023c9f6c34
                                      • Instruction ID: b82452393396c760bc7dc4aca2b857540a6fe5864660773e95f89c00c989313c
                                      • Opcode Fuzzy Hash: a4c7c786217c4016c6368f2dd919b55df1f64bc3a74c0d7b6deab0023c9f6c34
                                      • Instruction Fuzzy Hash: 26E08C71200308ABDB10EFD4DC85FE77B68EF49764F044599BA1C5B242C534E60087D4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 311 40ace0-40ad09 call 41cc40 314 40ad0b-40ad0e 311->314 315 40ad0f-40ad1d call 41d060 311->315 318 40ad2d-40ad3e call 41b490 315->318 319 40ad1f-40ad2a call 41d2e0 315->319 324 40ad40-40ad54 LdrLoadDll 318->324 325 40ad57-40ad5a 318->325 319->318 324->325
                                      C-Code - Quality: 100%
                                      			E0040ACE0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041CC40( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041D060(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041D2E0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041B490(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}













                                      0x0040acfc
                                      0x0040acff
                                      0x0040ad04
                                      0x0040ad09
                                      0x0040ad13
                                      0x0040ad18
                                      0x0040ad1b
                                      0x0040ad1d
                                      0x0040ad25
                                      0x0040ad2a
                                      0x0040ad2a
                                      0x0040ad31
                                      0x0040ad39
                                      0x0040ad3c
                                      0x0040ad3e
                                      0x0040ad52
                                      0x00000000
                                      0x0040ad54
                                      0x0040ad5a
                                      0x0040ad0e
                                      0x0040ad0e
                                      0x0040ad0e

                                      APIs
                                      • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Load
                                      • String ID:
                                      • API String ID: 2234796835-0
                                      • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                      • Instruction ID: d499f532a4605d4acc668fd39ab8700ce4e6b27de0f8ef54b1fb0fb48fae0bb4
                                      • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                      • Instruction Fuzzy Hash: EF0152B5D4020DA7DB10EBA5DC42FDEB3789F14308F0041A5E908A7281F634EB54CB95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A34A Relevance: 1.5, APIs: 1, Instructions: 45filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 326 41a34a-41a34b 327 41a355-41a3a1 call 41af50 NtCreateFile 326->327 328 41a34d-41a353 326->328 328->327
                                      C-Code - Quality: 28%
                                      			E0041A34A(void* __ebx, signed int __ecx, intOrPtr* __edx, signed int __esi, void* __eflags) {
				intOrPtr _t16;
				long _t22;
				void* _t23;
				intOrPtr* _t29;
				void* _t34;
				void* _t38;
				void* _t40;

				_t29 = __edx;
				_t24 = __ecx;
				_t23 = __ebx;
				_pop(_t40);
				if(__eflags > 0) {
					_t24 = __ecx | __esi;
					asm("adc [ebp-0x75], dl");
					_push(_t38);
					_t38 = _t40;
					_t16 =  *((intOrPtr*)(_t38 + 8));
				}
				 *(_t23 + 0x6a561048) =  *(_t23 + 0x6a561048) | _t24;
				 *_t29 =  *_t29 - _t24;
				_push(_t24);
				_t4 = _t16 + 0xc40; // 0xc40
				_push(_t16);
				E0041AF50(_t34);
				_t22 = NtCreateFile( *(_t38 + 0xc),  *(_t38 + 0x10),  *(_t38 + 0x14),  *(_t38 + 0x18),  *(_t38 + 0x1c),  *(_t38 + 0x20),  *(_t38 + 0x24),  *(_t38 + 0x28),  *(_t38 + 0x2c),  *(_t38 + 0x30),  *(_t38 + 0x34)); // executed
				return _t22;
			}










                                      0x0041a34a
                                      0x0041a34a
                                      0x0041a34a
                                      0x0041a34a
                                      0x0041a34b
                                      0x0041a34d
                                      0x0041a34f
                                      0x0041a350
                                      0x0041a351
                                      0x0041a353
                                      0x0041a353
                                      0x0041a355
                                      0x0041a35b
                                      0x0041a35e
                                      0x0041a35f
                                      0x0041a366
                                      0x0041a367
                                      0x0041a39d
                                      0x0041a3a1

                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A39D
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID:
                                      • API String ID: 823142352-0
                                      • Opcode ID: de3c37f828ddaa709f374e16871e4b9037cc4364ad44e145c8b1027d8e38ab5d
                                      • Instruction ID: 83849d2875ebda3e7c289ce02147d0e1deee08ae8f0c8b0722f8f9cab4c711ce
                                      • Opcode Fuzzy Hash: de3c37f828ddaa709f374e16871e4b9037cc4364ad44e145c8b1027d8e38ab5d
                                      • Instruction Fuzzy Hash: DC0108B2205148AFCB08CF98DC85DEB7BA9AF8C314F14824DFA5D97241D630E851CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A350 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 331 41a350-41a366 332 41a36c-41a3a1 NtCreateFile 331->332 333 41a367 call 41af50 331->333 333->332
                                      C-Code - Quality: 35%
                                      			E0041A350(void* __ebx, signed int __ecx, intOrPtr* __edx, intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				intOrPtr _t16;
				long _t22;
				void* _t34;

				_t16 = _a4;
				 *(__ebx + 0x6a561048) =  *(__ebx + 0x6a561048) | __ecx;
				 *__edx =  *__edx - __ecx;
				_push(__ecx);
				_t4 = _t16 + 0xc40; // 0xc40
				_push(_t16);
				E0041AF50(_t34);
				_t22 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t22;
			}






                                      0x0041a353
                                      0x0041a355
                                      0x0041a35b
                                      0x0041a35e
                                      0x0041a35f
                                      0x0041a366
                                      0x0041a367
                                      0x0041a39d
                                      0x0041a3a1

                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A39D
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID:
                                      • API String ID: 823142352-0
                                      • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                      • Instruction ID: 880687b14e2bfdcefdfb108c829fe1d34a34742feba638e3287dae326a4d6923
                                      • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                      • Instruction Fuzzy Hash: AAF0BDB2201208AFCB08CF89DC85EEB77ADAF8C754F158248BA1D97241C630E8518BA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A52A Relevance: 1.5, APIs: 1, Instructions: 34memorynativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 334 41a52a-41a56d call 41af50 NtAllocateVirtualMemory
                                      C-Code - Quality: 84%
                                      			E0041A52A(void* __eax, signed int __edx, void* __edi, intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, long _a32) {
				signed int _v117;
				long _t18;
				void* _t28;

				_t28 = __edi - 1;
				asm("out dx, al");
				_v117 = _v117 | __edx;
				_t14 = _a8;
				_t5 = _t14 + 0xc60; // 0xca0
				E0041AF50(_t28, _a8, _t5,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x30);
				_t18 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28, _a32); // executed
				return _t18;
			}






                                      0x0041a52b
                                      0x0041a52c
                                      0x0041a52f
                                      0x0041a533
                                      0x0041a53f
                                      0x0041a547
                                      0x0041a569
                                      0x0041a56d

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B124,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A569
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: 637234894afbe613aee5d160dccaea548d1332aada684fd864522c98b85a8469
                                      • Instruction ID: 31a1b75251a84055230d136ff6e175c7ee6a7874a970cfb91bf49b2b2f89ac44
                                      • Opcode Fuzzy Hash: 637234894afbe613aee5d160dccaea548d1332aada684fd864522c98b85a8469
                                      • Instruction Fuzzy Hash: 58F058B1200108AFCB14DF99CC81EEB7BA9AF98354F148649FA0D97242C631E811CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A530 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 337 41a530-41a546 338 41a54c-41a56d NtAllocateVirtualMemory 337->338 339 41a547 call 41af50 337->339 339->338
                                      C-Code - Quality: 100%
                                      			E0041A530(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E0041AF50(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}





                                      0x0041a53f
                                      0x0041a547
                                      0x0041a569
                                      0x0041a56d

                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B124,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A569
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                      • Instruction ID: 4e0f78fd3c2c10b6dba7ecb12144fed22081eaa1fb7babd41561f41a61d0d9a2
                                      • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                      • Instruction Fuzzy Hash: A3F015B2200208AFCB14DF89CC81EEB77ADAF88754F118149BE1C97241C630F811CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A480 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E0041A480(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a933
				E0041AF50(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}





                                      0x0041a483
                                      0x0041a486
                                      0x0041a48f
                                      0x0041a497
                                      0x0041a4a5
                                      0x0041a4a9

                                      APIs
                                      • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A4A5
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID:
                                      • API String ID: 3535843008-0
                                      • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                      • Instruction ID: 58703de6d0d09b45194c1a78dafb6a6614d70e6a8447524affba2eb7b0ba4c9c
                                      • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                      • Instruction Fuzzy Hash: E9D01776200214ABD710EB99CC85EE77BACEF48764F154499BA1C9B242C530FA1086E4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00409AA0 Relevance: .1, Instructions: 92COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 95%
                                      			E00409AA0(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				signed int _t31;
				signed int _t33;
				void* _t34;
				signed int _t39;
				void* _t50;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407EA0(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E004080B0( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041BE00( &_v284, 0x104);
						E0041C470( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DE0(__eflags, E00414D80(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							__eflags = _t31;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							__eflags = _t50 - 0x62;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							L8:
							_t33 = E004080E0( &_v24,  &_v840);
							_t55 = _t56 + 8;
							__eflags = _t33;
							if(_t33 != 0) {
								goto L9;
							}
							goto L10;
						}
						_t9 = _t52 + 0x14; // 0xffffe055
						_t10 = _t52 + 0x474;
						 *_t10 =  *(_t52 + 0x474) ^  *_t9;
						__eflags =  *_t10;
						_t39 = 1;
						goto L8;
						L9:
						__eflags = _t39;
					} while (_t39 == 0);
					L10:
					_t34 = E00408160(_t52,  &_v24); // executed
					__eflags = _t39;
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						_t16 = _t52 + 0x55c;
						 *_t16 =  *(_t52 + 0x55c) + 0xffffffba;
						__eflags =  *_t16;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					_t21 = _t52 + 0x32;
					 *_t21 =  *(_t52 + 0x32) +  *_t20 + 1;
					__eflags =  *_t21;
					return 1;
				} else {
					return _t24;
				}
			}



















                                      0x00409aab
                                      0x00409ab3
                                      0x00409ab5
                                      0x00409aba
                                      0x00409abf
                                      0x00409ad2
                                      0x00409ad7
                                      0x00409ae0
                                      0x00409aec
                                      0x00409aff
                                      0x00409b04
                                      0x00409b07
                                      0x00409b10
                                      0x00409b22
                                      0x00409b27
                                      0x00409b2a
                                      0x00409b2c
                                      0x00000000
                                      0x00000000
                                      0x00409b2e
                                      0x00409b2f
                                      0x00409b32
                                      0x00000000
                                      0x00000000
                                      0x00409b34
                                      0x00409b41
                                      0x00409b4c
                                      0x00409b51
                                      0x00409b54
                                      0x00409b56
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00409b56
                                      0x00409b36
                                      0x00409b39
                                      0x00409b39
                                      0x00409b39
                                      0x00409b3f
                                      0x00000000
                                      0x00409b58
                                      0x00409b58
                                      0x00409b58
                                      0x00409b5c
                                      0x00409b61
                                      0x00409b6a
                                      0x00409b6c
                                      0x00409b6e
                                      0x00409b74
                                      0x00409b78
                                      0x00409b7b
                                      0x00409b7b
                                      0x00409b7b
                                      0x00409b7b
                                      0x00409b82
                                      0x00409b85
                                      0x00409b8a
                                      0x00409b8a
                                      0x00409b8a
                                      0x00409b97
                                      0x00409ac6
                                      0x00409ac6
                                      0x00409ac6

                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9835c872434805b420af9e009800db09fa022f69ef5fa6a2d6e4e63ee433b124
                                      • Instruction ID: 290ea537485be02d779a264d5a339eceb4dab98af215cfaa17b5abd8430697b8
                                      • Opcode Fuzzy Hash: 9835c872434805b420af9e009800db09fa022f69ef5fa6a2d6e4e63ee433b124
                                      • Instruction Fuzzy Hash: FD213AB2D442095BCB21D664AD42BFF73BCAB54314F04007FE949A3182F638BF498BA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A620 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 42 41a620-41a651 call 41af50 RtlAllocateHeap
                                      C-Code - Quality: 100%
                                      			E0041A620(intOrPtr _a4, char _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E0041AF50(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t6 =  &_a8; // 0x414526
				_t10 = RtlAllocateHeap( *_t6, _a12, _a16); // executed
				return _t10;
			}





                                      0x0041a637
                                      0x0041a642
                                      0x0041a64d
                                      0x0041a651

                                      APIs
                                      • RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A64D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateHeap
                                      • String ID: &EA
                                      • API String ID: 1279760036-1330915590
                                      • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                      • Instruction ID: 51260f1f489a67c7b9949974b81657d9e18ee3442a924465d5a53260c52aa3af
                                      • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                      • Instruction Fuzzy Hash: AFE012B1200208ABDB14EF99CC41EA777ACAF88664F118559BA1C5B242C630F9118AB4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00408393 Relevance: 1.7, APIs: 1, Instructions: 165threadwindowCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 243 408393-408394 244 408362-40836e PostThreadMessageW 243->244 245 408396-408397 243->245 248 408370-40838a call 40a470 244->248 249 40838d-408392 244->249 246 408399-40839b 245->246 247 4083ae-4083f8 call 41be50 call 408310 call 41b740 245->247 246->247 260 408400-408432 call 40f660 call 41a4f0 247->260 248->249 265 408434-40843c 260->265 266 408467-40846f 260->266 267 408456-408460 265->267 268 40843e-408445 265->268 267->260 270 408462-408465 267->270 268->267 269 408447-40844e 268->269 269->267 271 408450-408454 269->271 272 40848d-40849f call 41a480 270->272 271->267 273 408470-40848a call 41bdd0 271->273 272->266 278 4084a1-40850c call 419d00 272->278 273->272 278->266 281 408512-40856e call 419d40 278->281 281->266 284 408574-4085c1 call 41b3e0 call 41b400 call 41c0c0 call 41bdd0 call 414a40 281->284
                                      C-Code - Quality: 74%
                                      			E00408393(void* __ebx, long __edi, void* __esi, signed int _a8, signed int _a12, signed int _a16, int _a20) {
				intOrPtr _v4;
				signed int _v8;
				signed int _v132;
				signed int _v136;
				char _v656;
				signed int _v668;
				char _v680;
				intOrPtr _v684;
				char _v688;
				int _t64;
				void* _t68;
				intOrPtr* _t73;
				void* _t75;

				_t73 = __esi + 1;
				if(_t73 < 0) {
					_t64 = PostThreadMessageW(__edi, 0x111, 0, ??); // executed
					_t81 = _t64;
					if(_t64 == 0) {
						_t64 =  *_t73(__edi, 0x8003, _t75 + (E0040A470(__ebx, _t68, _t81) & 0x000000ff) - 0x40, 1, 8, _t64);
					}
					return _t64;
				} else {
					_pop(es);
					asm("jecxz 0x17");
					asm("loop 0x41");
					 *(__ebp + __ebx * 2 - 5) =  *(__ebp + __ebx * 2 - 5) | __edi;
					asm("invalid");
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0x2ac;
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					__eax = 0;
					_v4 = 0;
					_v684 = 0;
					 &_v680 = E0041BE50( &_v680, 0, 0x2a4);
					__esi = _a20;
					__ecx =  *((intOrPtr*)(__esi + 0x300));
					__edi = _a8;
					__eax = E00408310(__ebx, __eflags, _a8,  *((intOrPtr*)(__esi + 0x300))); // executed
					__eax = E0041B740(__ecx);
					_t17 =  *((intOrPtr*)(__esi + 0x2d4)) + 0x29000; // 0x29000
					__ebx = __eax + _t17;
					_a20 = 0;
					while(1) {
						__eax = E0040F660(__edi, 0xfe363c80); // executed
						__ecx =  *((intOrPtr*)(__esi + 0x2f4));
						__eax =  &_v688;
						__eax = E0041A4F0(__edi,  *((intOrPtr*)(__esi + 0x2f4)), __ebx,  &_v688, 0x2a8, 0); // executed
						 *(__esi + 0x2dc) = __eax;
						__eflags = __eax;
						if(__eax < 0) {
							break;
						}
						__eflags = _v656;
						if(_v656 == 0) {
							L12:
							__eax = _a16;
							__eax = _a16 + 1;
							_a16 = __eax;
							__eflags = __eax - 2;
							if(__eax < 2) {
								continue;
							} else {
								__ebx = _v8;
								goto L16;
							}
						} else {
							__eflags = _v668;
							if(_v668 == 0) {
								goto L12;
							} else {
								__eflags = _v136;
								if(_v136 == 0) {
									goto L12;
								} else {
									__eflags = _v132;
									if(_v132 != 0) {
										__eax = _a12;
										__edx =  &_v688;
										__ebx = 1;
										__eax = E0041BDD0(_a12,  &_v688, 0x2a8);
										L16:
										__ecx =  *((intOrPtr*)(__esi + 0x2f4));
										__eax = E0041A480(__edi,  *((intOrPtr*)(__esi + 0x2f4))); // executed
										__eflags = __ebx;
										if(__ebx == 0) {
											break;
										} else {
											__edx = _v668;
											__eax = _a12;
											__ecx = _v136;
											 *(_a12 + 0x14) = _v668;
											__edx =  *(__esi + 0x2d0);
											_t37 = __esi + 0x2e8; // 0x2e8
											__eax = _t37;
											 *_t37 = _v136;
											__eax = _a12;
											_t39 = __esi + 0x314; // 0x314
											__ebx = _t39;
											__ecx = 0;
											__eax = _a12 + 0x220;
											 *__ebx = 0x18;
											 *((intOrPtr*)(__esi + 0x318)) = 0;
											 *((intOrPtr*)(__esi + 0x320)) = 0;
											 *((intOrPtr*)(__esi + 0x31c)) = 0;
											 *((intOrPtr*)(__esi + 0x324)) = 0;
											 *((intOrPtr*)(__esi + 0x328)) = 0;
											__eax = E00419D00(__edi, _a12 + 0x220,  *(__esi + 0x2d0), __ebx, _a12 + 0x220);
											__ecx = 0;
											 *(__esi + 0x2dc) = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												break;
											} else {
												__edx = _v132;
												_t47 = __esi + 0x2e0; // 0x2e0
												__eax = _t47;
												 *((intOrPtr*)(__esi + 0x318)) = 0;
												 *((intOrPtr*)(__esi + 0x320)) = 0;
												 *((intOrPtr*)(__esi + 0x31c)) = 0;
												 *((intOrPtr*)(__esi + 0x324)) = 0;
												 *((intOrPtr*)(__esi + 0x328)) = 0;
												_a12 = _a12 + 0x224;
												 *(__esi + 0x2e4) = _v132;
												 *__ebx = 0x18;
												 *(__esi + 0x2d0) = 0x1a;
												__eax = E00419D40(__edi, _a12 + 0x224, 0x1a, __ebx, _t47);
												 *(__esi + 0x2dc) = __eax;
												__eflags = __eax;
												if(__eax < 0) {
													break;
												} else {
													__edx = _a8;
													 *(__edx + 0x10) =  *(__edx + 0x10) + 0x200;
													__eflags =  *(__edx + 0x10) + 0x200;
													__eax = E0041B3E0(__ecx);
													__ebx = __eax;
													__eax =  *(__ebx + 0x28);
													__eax = E0041C0C0( *(__ebx + 0x28));
													__edx =  *(__ebx + 0x28);
													_t62 = __eax + 2; // 0x2
													__ecx = __eax + _t62;
													__eax =  &_v656;
													__eax = E00414A40(__edi,  &_v656, 2, 0); // executed
													_pop(__edi);
													_pop(__esi);
													_pop(__ebx);
													__esp = __ebp;
													_pop(__ebp);
													return __eax;
												}
											}
										}
									} else {
										goto L12;
									}
								}
							}
						}
						goto L20;
					}
					_pop(__edi);
					_pop(__esi);
					__eax = 0;
					__eflags = 0;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return 0;
				}
				L20:
			}
















                                      0x00408393
                                      0x00408394
                                      0x0040836a
                                      0x0040836c
                                      0x0040836e
                                      0x0040838b
                                      0x0040838b
                                      0x00408392
                                      0x00408396
                                      0x00408396
                                      0x00408397
                                      0x00408399
                                      0x0040839b
                                      0x0040839f
                                      0x004083a0
                                      0x004083a1
                                      0x004083a3
                                      0x004083a9
                                      0x004083aa
                                      0x004083ab
                                      0x004083ac
                                      0x004083b4
                                      0x004083b7
                                      0x004083c4
                                      0x004083c9
                                      0x004083cc
                                      0x004083d2
                                      0x004083d7
                                      0x004083df
                                      0x004083ea
                                      0x004083ea
                                      0x004083f1
                                      0x00408400
                                      0x00408406
                                      0x0040840b
                                      0x00408418
                                      0x00408422
                                      0x0040842a
                                      0x00408430
                                      0x00408432
                                      0x00000000
                                      0x00000000
                                      0x00408434
                                      0x0040843c
                                      0x00408456
                                      0x00408456
                                      0x00408459
                                      0x0040845a
                                      0x0040845d
                                      0x00408460
                                      0x00000000
                                      0x00408462
                                      0x00408462
                                      0x00000000
                                      0x00408462
                                      0x0040843e
                                      0x0040843e
                                      0x00408445
                                      0x00000000
                                      0x00408447
                                      0x00408447
                                      0x0040844e
                                      0x00000000
                                      0x00408450
                                      0x00408450
                                      0x00408454
                                      0x00408470
                                      0x00408478
                                      0x00408480
                                      0x00408485
                                      0x0040848d
                                      0x0040848d
                                      0x00408495
                                      0x0040849d
                                      0x0040849f
                                      0x00000000
                                      0x004084a1
                                      0x004084a1
                                      0x004084a7
                                      0x004084aa
                                      0x004084b0
                                      0x004084b3
                                      0x004084b9
                                      0x004084b9
                                      0x004084c0
                                      0x004084c2
                                      0x004084c5
                                      0x004084c5
                                      0x004084cc
                                      0x004084cf
                                      0x004084d6
                                      0x004084dc
                                      0x004084e2
                                      0x004084e8
                                      0x004084ee
                                      0x004084f4
                                      0x004084fa
                                      0x004084ff
                                      0x00408504
                                      0x0040850a
                                      0x0040850c
                                      0x00000000
                                      0x00408512
                                      0x00408512
                                      0x00408515
                                      0x00408515
                                      0x0040851c
                                      0x00408522
                                      0x00408528
                                      0x0040852e
                                      0x00408534
                                      0x00408540
                                      0x00408548
                                      0x0040854e
                                      0x00408554
                                      0x0040855e
                                      0x00408566
                                      0x0040856c
                                      0x0040856e
                                      0x00000000
                                      0x00408574
                                      0x00408574
                                      0x0040857a
                                      0x0040857a
                                      0x00408580
                                      0x0040858d
                                      0x0040858f
                                      0x00408593
                                      0x00408598
                                      0x0040859b
                                      0x0040859b
                                      0x004085ab
                                      0x004085b3
                                      0x004085bb
                                      0x004085bc
                                      0x004085bd
                                      0x004085be
                                      0x004085c0
                                      0x004085c1
                                      0x004085c1
                                      0x0040856e
                                      0x0040850c
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00408454
                                      0x0040844e
                                      0x00408445
                                      0x00000000
                                      0x0040843c
                                      0x00408467
                                      0x00408468
                                      0x00408469
                                      0x00408469
                                      0x0040846b
                                      0x0040846c
                                      0x0040846e
                                      0x0040846f
                                      0x0040846f
                                      0x00000000

                                      APIs
                                      • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 2829a2070c2dbd20142f6f3ce8835d7fed95989c5c1832511b77a93f1cf33794
                                      • Instruction ID: 4452cda7cd086dc373cf6f70ae273f6dca1fa277326d26e6148e08bc47964974
                                      • Opcode Fuzzy Hash: 2829a2070c2dbd20142f6f3ce8835d7fed95989c5c1832511b77a93f1cf33794
                                      • Instruction Fuzzy Hash: F951B2B0A003099FDB14DF64DD85BEB77A8EB48708F00457EF549A7281DB746941CBA9
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 295 408310-40835a call 41be50 call 41c9f0 call 40ace0 call 414e40 304 40835c-40836e PostThreadMessageW 295->304 305 40838e-408392 295->305 307 408370-40838a call 40a470 304->307 308 40838d 304->308 307->308 308->305
                                      C-Code - Quality: 68%
                                      			E00408310(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t22;
				intOrPtr* _t26;
				void* _t27;
				void* _t31;

				_t31 = __eflags;
				_v68 = 0;
				E0041BE50( &_v67, 0, 0x3f);
				E0041C9F0( &_v68, 3);
				_t12 = E0040ACE0(_t31, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E40(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t26 = _t13;
				if(_t26 != 0) {
					_t22 = _a8;
					_push(0);
					_t14 = PostThreadMessageW(_t22, 0x111, 0, ??); // executed
					_t33 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t26(_t22, 0x8003, _t27 + (E0040A470(__ebx,  &_v68, _t33) & 0x000000ff) - 0x40, 1, 8, _t14);
					}
					return _t14;
				}
				return _t13;
			}












                                      0x00408310
                                      0x0040831f
                                      0x00408323
                                      0x0040832e
                                      0x0040833e
                                      0x0040834e
                                      0x00408353
                                      0x0040835a
                                      0x0040835d
                                      0x00408360
                                      0x0040836a
                                      0x0040836c
                                      0x0040836e
                                      0x0040838b
                                      0x0040838b
                                      0x00000000
                                      0x0040838d
                                      0x00408392

                                      APIs
                                      • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: b0fcd880289c8ecfbeb793961d9b547f85606b63ac5ed8a73f76917213b02706
                                      • Instruction ID: d17f8cfce065c66642409dfa920775f821b8147089a61b374e72855f6ed3688e
                                      • Opcode Fuzzy Hash: b0fcd880289c8ecfbeb793961d9b547f85606b63ac5ed8a73f76917213b02706
                                      • Instruction Fuzzy Hash: E0018471A8032877E720A6959C43FFE776C6B40F54F05412AFF04BA1C2E6A8690546EA
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A652 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                                      Download Yara Rule
                                      C-Code - Quality: 72%
                                      			E0041A652(signed int __eax, void* __edi, signed int __esi, intOrPtr _a3, void* _a7, long _a11, void* _a15) {
				char _t14;
				signed int _t21;

				_t21 = __esi ^ 0x0000001a;
				_push(_t21);
				 *((char*)(__edi + 0x55)) = (__eax & 0x30d23aba) != 0;
				_t11 = _a3;
				_push(_t21);
				_t6 = _t11 + 0xc74; // 0xc74
				E0041AF50(__edi, _a3, _t6,  *((intOrPtr*)(_a3 + 0x10)), 0, 0x35);
				_t14 = RtlFreeHeap(_a7, _a11, _a15); // executed
				return _t14;
			}





                                      0x0041a654
                                      0x0041a65c
                                      0x0041a65d
                                      0x0041a663
                                      0x0041a669
                                      0x0041a66f
                                      0x0041a677
                                      0x0041a68d
                                      0x0041a691

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A68D
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID:
                                      • API String ID: 3298025750-0
                                      • Opcode ID: c03433509fdc377c6cd502ca29283496bdcac8475fa83c40f8868dd7370a5755
                                      • Instruction ID: 466137b3bacb6200c7bb5c0c7340f025127fedc6f8ce09fdbcbe90b94413d384
                                      • Opcode Fuzzy Hash: c03433509fdc377c6cd502ca29283496bdcac8475fa83c40f8868dd7370a5755
                                      • Instruction Fuzzy Hash: FAE065B62002146FD714DFA9DC4AEE777ADAF88364F018599FD596B642C230E8248AE1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A7B4 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 79%
                                      			E0041A7B4(void* __eax, void* __ebx, void* __ecx, void* __edi, WCHAR* _a4, WCHAR* _a8, struct _LUID* _a12) {
				intOrPtr _v0;
				int _t13;

				asm("rol bl, cl");
				 *((intOrPtr*)(__ebx + 0x55e5328d)) =  *((intOrPtr*)(__ebx + 0x55e5328d)) - __edi;
				_t10 = _v0;
				E0041AF50(__edi, _v0, _v0 + 0xc8c,  *((intOrPtr*)(_t10 + 0xa18)), 0, 0x46);
				_t13 = LookupPrivilegeValueW(_a4, _a8, _a12); // executed
				return _t13;
			}





                                      0x0041a7b7
                                      0x0041a7bb
                                      0x0041a7c3
                                      0x0041a7da
                                      0x0041a7f0
                                      0x0041a7f4

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7F0
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 57bfe9d982232674cc7be07468da8d71e38963f6665c31f6420130c54bc02083
                                      • Instruction ID: e48ba0e00cd5ce3336ea562726f1d724edabc612003d58ca857e1ee239ae1e95
                                      • Opcode Fuzzy Hash: 57bfe9d982232674cc7be07468da8d71e38963f6665c31f6420130c54bc02083
                                      • Instruction Fuzzy Hash: 2EE06DB1600214AFDB14EF69CC85EEB73ADAF88250F05815AFE0D9B281D930A854CBF5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A660 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E0041A660(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E0041AF50(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}





                                      0x0041a66f
                                      0x0041a677
                                      0x0041a68d
                                      0x0041a691

                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A68D
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID:
                                      • API String ID: 3298025750-0
                                      • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                      • Instruction ID: bc8b067cd83da56cee666b5c28ce04d4f8bf1b8054c0557e0bc192b3240f86e0
                                      • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                      • Instruction Fuzzy Hash: DAE012B1200208ABDB18EF99CC49EA777ACAF88764F018559BA1C5B242C630E9108AB4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A7C0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E0041A7C0(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E0041AF50(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}





                                      0x0041a7da
                                      0x0041a7f0
                                      0x0041a7f4

                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7F0
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                      • Instruction ID: b271a6b6fd8fca1a6df64550df1cef4b538e167436523c48f1a9ef262b7a55b1
                                      • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                      • Instruction Fuzzy Hash: 4FE01AB12002086BDB10DF49CC85EE737ADAF88654F018155BA0C57241C934E8118BF5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A693 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 46%
                                      			E0041A693(int _a4) {
				intOrPtr _v0;
				void* _t9;
				intOrPtr _t13;

				asm("in eax, 0x25");
				_push(0xc1f8428d);
				asm("scasd");
				_t13 =  *((intOrPtr*)(_t9 - 0x74aa2d70));
				_t6 = _v0;
				E0041AF50(_t13, _v0, _v0 + 0xc7c,  *((intOrPtr*)(_t6 + 0xa14)), 0, 0x36);
				ExitProcess(_a4);
			}






                                      0x0041a693
                                      0x0041a69a
                                      0x0041a69b
                                      0x0041a69c
                                      0x0041a6a3
                                      0x0041a6ba
                                      0x0041a6c8

                                      APIs
                                      • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6C8
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: 78e34275901a1d8c3f9f44de55777e5df16fcc040fe5263745175699131cd4f6
                                      • Instruction ID: ecff54dbca0f54875319f4a9fe31a8ddfc1ff7bb682e4d445fc8e9660d9bd054
                                      • Opcode Fuzzy Hash: 78e34275901a1d8c3f9f44de55777e5df16fcc040fe5263745175699131cd4f6
                                      • Instruction Fuzzy Hash: 19E04F716001006BD620CF248CC5EC737699F49364F254158B518AB281C931A9128AA1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 0041A6A0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E0041A6A0(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E0041AF50(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}




                                      0x0041a6a3
                                      0x0041a6ba
                                      0x0041a6c8

                                      APIs
                                      • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6C8
                                      Memory Dump Source
                                      • Source File: 00000002.00000002.510795876.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_2_2_400000_Ziraat Bankasi Swift Mesaji.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID:
                                      • API String ID: 621844428-0
                                      • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                      • Instruction ID: 02052f1feec4c32fa888e0c2ff15824475a9bddcc7bd9f2d7c69f560d23a1846
                                      • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                      • Instruction Fuzzy Hash: CBD017726002187BD620EB99CC85FD777ACDF487A4F0180A9BA1C6B242C531BA108AE5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Execution Graph

                                      Execution Coverage:5.7%
                                      Dynamic/Decrypted Code Coverage:2%
                                      Signature Coverage:0%
                                      Total number of Nodes:591
                                      Total number of Limit Nodes:68
                                      execution_graph 29899 baf17d 29902 bab9c0 29899->29902 29903 bab9e6 29902->29903 29910 b99d30 29903->29910 29905 bab9f2 29906 baba16 29905->29906 29918 b98f30 29905->29918 29956 baa6a0 29906->29956 29959 b99c80 29910->29959 29912 b99d3d 29913 b99d44 29912->29913 29971 b99c20 29912->29971 29913->29905 29919 b98f57 29918->29919 30388 b9b1b0 29919->30388 29921 b98f69 30392 b9af00 29921->30392 29923 b98f86 29931 b98f8d 29923->29931 30463 b9ae30 LdrLoadDll 29923->30463 29925 b990f2 29925->29906 29927 b98ffc 30408 b9f400 29927->30408 29929 b99006 29929->29925 29930 babf80 2 API calls 29929->29930 29932 b9902a 29930->29932 29931->29925 30396 b9f370 29931->30396 29933 babf80 2 API calls 29932->29933 29934 b9903b 29933->29934 29935 babf80 2 API calls 29934->29935 29936 b9904c 29935->29936 30420 b9ca80 29936->30420 29938 b99059 29939 ba4a40 8 API calls 29938->29939 29940 b99066 29939->29940 29941 ba4a40 8 API calls 29940->29941 29942 b99077 29941->29942 29943 b990a5 29942->29943 29944 b99084 29942->29944 29946 ba4a40 8 API calls 29943->29946 30430 b9d610 29944->30430 29953 b990c1 29946->29953 29949 b990e9 29950 b98d00 23 API calls 29949->29950 29950->29925 29951 b99092 30446 b98d00 29951->30446 29953->29949 30464 b9d6b0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 29953->30464 29957 baaf50 LdrLoadDll 29956->29957 29958 baa6bf 29957->29958 29990 ba8bb0 29959->29990 29963 b99ca6 29963->29912 29964 b99c9c 29964->29963 29997 bab2a0 29964->29997 29966 b99ce3 29966->29963 30008 b99aa0 29966->30008 29968 b99d03 30014 b99620 LdrLoadDll 29968->30014 29970 b99d15 29970->29912 30363 bab590 29971->30363 29974 bab590 LdrLoadDll 29975 b99c4b 29974->29975 29976 bab590 LdrLoadDll 29975->29976 29977 b99c61 29976->29977 29978 b9f170 29977->29978 29979 b9f189 29978->29979 30371 b9b030 29979->30371 29981 b9f19c 30375 baa1d0 29981->30375 29985 b9f1c2 29986 b9f1ed 29985->29986 30381 baa250 29985->30381 29988 baa480 2 API calls 29986->29988 29989 b99d55 29988->29989 29989->29905 29991 ba8bbf 29990->29991 30015 ba4e40 29991->30015 29993 b99c93 29994 ba8a60 29993->29994 30021 baa5f0 29994->30021 29998 bab2b9 29997->29998 30028 ba4a40 29998->30028 30000 bab2d1 30001 bab2da 30000->30001 30067 bab0e0 30000->30067 30001->29966 30003 bab2ee 30003->30001 30085 ba9ef0 30003->30085 30341 b97ea0 30008->30341 30010 b99ac1 30010->29968 30011 b99aba 30011->30010 30354 b98160 30011->30354 30014->29970 30016 ba4e5a 30015->30016 30018 ba4e4e 30015->30018 30016->29993 30018->30016 30020 ba52c0 LdrLoadDll 30018->30020 30019 ba4fac 30019->29993 30020->30019 30024 baaf50 30021->30024 30023 ba8a75 30023->29964 30025 baaf60 30024->30025 30027 baaf82 30024->30027 30026 ba4e40 LdrLoadDll 30025->30026 30026->30027 30027->30023 30029 ba4d75 30028->30029 30030 ba4a54 30028->30030 30029->30000 30030->30029 30093 ba9c40 30030->30093 30033 ba4b63 30153 baa450 LdrLoadDll 30033->30153 30034 ba4b80 30096 baa350 30034->30096 30037 ba4b6d 30037->30000 30038 ba4ba7 30039 babdb0 2 API calls 30038->30039 30040 ba4bb3 30039->30040 30040->30037 30041 ba4d39 30040->30041 30042 ba4d4f 30040->30042 30047 ba4c42 30040->30047 30043 baa480 2 API calls 30041->30043 30162 ba4780 LdrLoadDll NtReadFile NtClose 30042->30162 30044 ba4d40 30043->30044 30044->30000 30046 ba4d62 30046->30000 30048 ba4ca9 30047->30048 30050 ba4c51 30047->30050 30048->30041 30049 ba4cbc 30048->30049 30155 baa2d0 30049->30155 30052 ba4c6a 30050->30052 30053 ba4c56 30050->30053 30056 ba4c6f 30052->30056 30057 ba4c87 30052->30057 30154 ba4640 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 30053->30154 30099 ba46e0 30056->30099 30057->30044 30111 ba4400 30057->30111 30059 ba4c60 30059->30000 30061 ba4d1c 30159 baa480 30061->30159 30062 ba4c7d 30062->30000 30065 ba4c9f 30065->30000 30066 ba4d28 30066->30000 30068 bab0f1 30067->30068 30069 bab103 30068->30069 30180 babd30 30068->30180 30069->30003 30071 bab124 30183 ba4060 30071->30183 30073 bab170 30073->30003 30074 bab147 30074->30073 30075 ba4060 3 API calls 30074->30075 30078 bab169 30075->30078 30077 bab1fa 30079 bab20a 30077->30079 30309 baaef0 LdrLoadDll 30077->30309 30078->30073 30215 ba5380 30078->30215 30225 baad60 30079->30225 30082 bab238 30304 ba9eb0 30082->30304 30086 baaf50 LdrLoadDll 30085->30086 30087 ba9f0c 30086->30087 30335 4e9967a 30087->30335 30088 ba9f27 30090 babdb0 30088->30090 30338 baa660 30090->30338 30092 bab349 30092->29966 30094 ba4b34 30093->30094 30095 baaf50 LdrLoadDll 30093->30095 30094->30033 30094->30034 30094->30037 30095->30094 30097 baaf50 LdrLoadDll 30096->30097 30098 baa36c NtCreateFile 30097->30098 30098->30038 30100 ba46fc 30099->30100 30101 baa2d0 LdrLoadDll 30100->30101 30102 ba471d 30101->30102 30103 ba4738 30102->30103 30104 ba4724 30102->30104 30105 baa480 2 API calls 30103->30105 30106 baa480 2 API calls 30104->30106 30107 ba4741 30105->30107 30108 ba472d 30106->30108 30163 babfc0 LdrLoadDll RtlAllocateHeap 30107->30163 30108->30062 30110 ba474c 30110->30062 30112 ba444b 30111->30112 30113 ba447e 30111->30113 30115 baa2d0 LdrLoadDll 30112->30115 30114 ba45c9 30113->30114 30119 ba449a 30113->30119 30117 baa2d0 LdrLoadDll 30114->30117 30116 ba4466 30115->30116 30118 baa480 2 API calls 30116->30118 30122 ba45e4 30117->30122 30120 ba446f 30118->30120 30121 baa2d0 LdrLoadDll 30119->30121 30120->30065 30123 ba44b5 30121->30123 30176 baa310 LdrLoadDll 30122->30176 30125 ba44bc 30123->30125 30126 ba44d1 30123->30126 30130 baa480 2 API calls 30125->30130 30127 ba44ec 30126->30127 30128 ba44d6 30126->30128 30138 ba44f1 30127->30138 30164 babf80 30127->30164 30131 baa480 2 API calls 30128->30131 30129 ba461e 30132 baa480 2 API calls 30129->30132 30133 ba44c5 30130->30133 30134 ba44df 30131->30134 30135 ba4629 30132->30135 30133->30065 30134->30065 30135->30065 30146 ba4503 30138->30146 30167 baa400 30138->30167 30139 ba4557 30140 ba456e 30139->30140 30175 baa290 LdrLoadDll 30139->30175 30142 ba458a 30140->30142 30143 ba4575 30140->30143 30145 baa480 2 API calls 30142->30145 30144 baa480 2 API calls 30143->30144 30144->30146 30147 ba4593 30145->30147 30146->30065 30148 ba45bf 30147->30148 30170 babb80 30147->30170 30148->30065 30150 ba45aa 30151 babdb0 2 API calls 30150->30151 30152 ba45b3 30151->30152 30152->30065 30153->30037 30154->30059 30156 baaf50 LdrLoadDll 30155->30156 30157 ba4d04 30156->30157 30158 baa310 LdrLoadDll 30157->30158 30158->30061 30160 baaf50 LdrLoadDll 30159->30160 30161 baa49c NtClose 30160->30161 30161->30066 30162->30046 30163->30110 30177 baa620 30164->30177 30166 babf98 30166->30138 30168 baa41c NtReadFile 30167->30168 30169 baaf50 LdrLoadDll 30167->30169 30168->30139 30169->30168 30171 babb8d 30170->30171 30172 babba4 30170->30172 30171->30172 30173 babf80 2 API calls 30171->30173 30172->30150 30174 babbbb 30173->30174 30174->30150 30175->30140 30176->30129 30178 baaf50 LdrLoadDll 30177->30178 30179 baa63c RtlAllocateHeap 30178->30179 30179->30166 30310 baa530 30180->30310 30182 babd5d 30182->30071 30184 ba4071 30183->30184 30185 ba4079 30183->30185 30184->30074 30186 ba434c 30185->30186 30313 bacf20 30185->30313 30186->30074 30188 ba40cd 30189 bacf20 2 API calls 30188->30189 30192 ba40d8 30189->30192 30190 ba4126 30193 bacf20 2 API calls 30190->30193 30192->30190 30194 bad050 3 API calls 30192->30194 30327 bacfc0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 30192->30327 30196 ba413a 30193->30196 30194->30192 30195 ba4197 30197 bacf20 2 API calls 30195->30197 30196->30195 30318 bad050 30196->30318 30199 ba41ad 30197->30199 30200 ba41ea 30199->30200 30203 bad050 3 API calls 30199->30203 30201 bacf20 2 API calls 30200->30201 30202 ba41f5 30201->30202 30204 bad050 3 API calls 30202->30204 30211 ba422f 30202->30211 30203->30199 30204->30202 30207 bacf80 2 API calls 30208 ba432e 30207->30208 30209 bacf80 2 API calls 30208->30209 30210 ba4338 30209->30210 30212 bacf80 2 API calls 30210->30212 30324 bacf80 30211->30324 30213 ba4342 30212->30213 30214 bacf80 2 API calls 30213->30214 30214->30186 30216 ba5391 30215->30216 30217 ba4a40 8 API calls 30216->30217 30219 ba53a7 30217->30219 30218 ba53fa 30218->30077 30219->30218 30220 ba53e2 30219->30220 30221 ba53f5 30219->30221 30222 babdb0 2 API calls 30220->30222 30223 babdb0 2 API calls 30221->30223 30224 ba53e7 30222->30224 30223->30218 30224->30077 30328 baac20 30225->30328 30228 baac20 LdrLoadDll 30229 baad7d 30228->30229 30230 baac20 LdrLoadDll 30229->30230 30231 baad86 30230->30231 30232 baac20 LdrLoadDll 30231->30232 30233 baad8f 30232->30233 30234 baac20 LdrLoadDll 30233->30234 30235 baad98 30234->30235 30236 baac20 LdrLoadDll 30235->30236 30237 baada1 30236->30237 30238 baac20 LdrLoadDll 30237->30238 30239 baadad 30238->30239 30240 baac20 LdrLoadDll 30239->30240 30241 baadb6 30240->30241 30242 baac20 LdrLoadDll 30241->30242 30243 baadbf 30242->30243 30244 baac20 LdrLoadDll 30243->30244 30245 baadc8 30244->30245 30246 baac20 LdrLoadDll 30245->30246 30247 baadd1 30246->30247 30248 baac20 LdrLoadDll 30247->30248 30249 baadda 30248->30249 30250 baac20 LdrLoadDll 30249->30250 30251 baade6 30250->30251 30252 baac20 LdrLoadDll 30251->30252 30253 baadef 30252->30253 30254 baac20 LdrLoadDll 30253->30254 30255 baadf8 30254->30255 30256 baac20 LdrLoadDll 30255->30256 30257 baae01 30256->30257 30258 baac20 LdrLoadDll 30257->30258 30259 baae0a 30258->30259 30260 baac20 LdrLoadDll 30259->30260 30261 baae13 30260->30261 30262 baac20 LdrLoadDll 30261->30262 30263 baae1f 30262->30263 30264 baac20 LdrLoadDll 30263->30264 30265 baae28 30264->30265 30266 baac20 LdrLoadDll 30265->30266 30267 baae31 30266->30267 30268 baac20 LdrLoadDll 30267->30268 30269 baae3a 30268->30269 30270 baac20 LdrLoadDll 30269->30270 30271 baae43 30270->30271 30272 baac20 LdrLoadDll 30271->30272 30273 baae4c 30272->30273 30274 baac20 LdrLoadDll 30273->30274 30275 baae58 30274->30275 30276 baac20 LdrLoadDll 30275->30276 30277 baae61 30276->30277 30278 baac20 LdrLoadDll 30277->30278 30279 baae6a 30278->30279 30280 baac20 LdrLoadDll 30279->30280 30281 baae73 30280->30281 30282 baac20 LdrLoadDll 30281->30282 30283 baae7c 30282->30283 30284 baac20 LdrLoadDll 30283->30284 30285 baae85 30284->30285 30286 baac20 LdrLoadDll 30285->30286 30287 baae91 30286->30287 30288 baac20 LdrLoadDll 30287->30288 30289 baae9a 30288->30289 30290 baac20 LdrLoadDll 30289->30290 30291 baaea3 30290->30291 30292 baac20 LdrLoadDll 30291->30292 30293 baaeac 30292->30293 30294 baac20 LdrLoadDll 30293->30294 30295 baaeb5 30294->30295 30296 baac20 LdrLoadDll 30295->30296 30297 baaebe 30296->30297 30298 baac20 LdrLoadDll 30297->30298 30299 baaeca 30298->30299 30300 baac20 LdrLoadDll 30299->30300 30301 baaed3 30300->30301 30302 baac20 LdrLoadDll 30301->30302 30303 baaedc 30302->30303 30303->30082 30305 baaf50 LdrLoadDll 30304->30305 30306 ba9ecc 30305->30306 30334 4e99860 LdrInitializeThunk 30306->30334 30307 ba9ee3 30307->30003 30309->30079 30311 baaf50 LdrLoadDll 30310->30311 30312 baa54c NtAllocateVirtualMemory 30311->30312 30312->30182 30314 bacf30 30313->30314 30315 bacf36 30313->30315 30314->30188 30316 babf80 2 API calls 30315->30316 30317 bacf5c 30316->30317 30317->30188 30319 bacfc0 30318->30319 30320 babf80 2 API calls 30319->30320 30321 bad01d 30319->30321 30322 bacffa 30320->30322 30321->30196 30323 babdb0 2 API calls 30322->30323 30323->30321 30325 babdb0 2 API calls 30324->30325 30326 ba4324 30325->30326 30326->30207 30327->30192 30329 baac3b 30328->30329 30330 ba4e40 LdrLoadDll 30329->30330 30331 baac5b 30330->30331 30332 ba4e40 LdrLoadDll 30331->30332 30333 baad07 30331->30333 30332->30333 30333->30228 30334->30307 30336 4e9968f LdrInitializeThunk 30335->30336 30337 4e99681 30335->30337 30336->30088 30337->30088 30339 baaf50 LdrLoadDll 30338->30339 30340 baa67c RtlFreeHeap 30339->30340 30340->30092 30342 b97eab 30341->30342 30343 b97eb0 30341->30343 30342->30011 30344 babd30 2 API calls 30343->30344 30347 b97ed5 30344->30347 30345 b97f38 30345->30011 30346 ba9eb0 2 API calls 30346->30347 30347->30345 30347->30346 30348 b97f3e 30347->30348 30353 babd30 2 API calls 30347->30353 30357 baa5b0 30347->30357 30349 b97f64 30348->30349 30351 baa5b0 2 API calls 30348->30351 30349->30011 30352 b97f55 30351->30352 30352->30011 30353->30347 30355 baa5b0 2 API calls 30354->30355 30356 b9817e 30355->30356 30356->29968 30358 baaf50 LdrLoadDll 30357->30358 30359 baa5cc 30358->30359 30362 4e996e0 LdrInitializeThunk 30359->30362 30360 baa5e3 30360->30347 30362->30360 30364 bab5b3 30363->30364 30367 b9ace0 30364->30367 30368 b9ad04 30367->30368 30369 b9ad40 LdrLoadDll 30368->30369 30370 b99c3a 30368->30370 30369->30370 30370->29974 30372 b9b053 30371->30372 30374 b9b0d0 30372->30374 30386 ba9c80 LdrLoadDll 30372->30386 30374->29981 30376 baaf50 LdrLoadDll 30375->30376 30377 b9f1ab 30376->30377 30377->29989 30378 baa7c0 30377->30378 30379 baa7df LookupPrivilegeValueW 30378->30379 30380 baaf50 LdrLoadDll 30378->30380 30379->29985 30380->30379 30382 baaf50 LdrLoadDll 30381->30382 30383 baa26c 30382->30383 30387 4e99910 LdrInitializeThunk 30383->30387 30384 baa28b 30384->29986 30386->30374 30387->30384 30389 b9b1b9 30388->30389 30390 b9b030 LdrLoadDll 30389->30390 30391 b9b1f4 30390->30391 30391->29921 30393 b9af24 30392->30393 30465 ba9c80 LdrLoadDll 30393->30465 30395 b9af5e 30395->29923 30397 b9f39c 30396->30397 30398 b9b1b0 LdrLoadDll 30397->30398 30399 b9f3ae 30398->30399 30466 b9f280 30399->30466 30402 b9f3c9 30404 b9f3d4 30402->30404 30406 baa480 2 API calls 30402->30406 30403 b9f3e1 30405 b9f3f2 30403->30405 30407 baa480 2 API calls 30403->30407 30404->29927 30405->29927 30406->30404 30407->30405 30409 b9f42c 30408->30409 30485 b9b2a0 30409->30485 30411 b9f43e 30412 b9f280 3 API calls 30411->30412 30413 b9f44f 30412->30413 30414 b9f459 30413->30414 30415 b9f471 30413->30415 30417 b9f464 30414->30417 30418 baa480 2 API calls 30414->30418 30416 b9f482 30415->30416 30419 baa480 2 API calls 30415->30419 30416->29929 30417->29929 30418->30417 30419->30416 30421 b9ca96 30420->30421 30422 b9caa0 30420->30422 30421->29938 30423 b9af00 LdrLoadDll 30422->30423 30424 b9cb3e 30423->30424 30425 b9cb64 30424->30425 30426 b9b030 LdrLoadDll 30424->30426 30425->29938 30427 b9cb80 30426->30427 30428 ba4a40 8 API calls 30427->30428 30429 b9cbd5 30428->30429 30429->29938 30431 b9d636 30430->30431 30432 b9b030 LdrLoadDll 30431->30432 30433 b9d64a 30432->30433 30489 b9d300 30433->30489 30435 b9908b 30436 b9cbf0 30435->30436 30437 b9cc16 30436->30437 30438 b9b030 LdrLoadDll 30437->30438 30439 b9cc99 30437->30439 30438->30439 30440 b9b030 LdrLoadDll 30439->30440 30441 b9cd06 30440->30441 30442 b9af00 LdrLoadDll 30441->30442 30443 b9cd6f 30442->30443 30444 b9b030 LdrLoadDll 30443->30444 30445 b9ce1f 30444->30445 30445->29951 30518 b9f6c0 30446->30518 30448 b98f25 30448->29906 30449 b98d14 30449->30448 30523 ba4390 30449->30523 30451 b98d70 30451->30448 30526 b98ab0 30451->30526 30454 bacf20 2 API calls 30455 b98db2 30454->30455 30456 bad050 3 API calls 30455->30456 30460 b98dc7 30456->30460 30457 b97ea0 4 API calls 30457->30460 30460->30448 30460->30457 30461 b9c7a0 18 API calls 30460->30461 30462 b98160 2 API calls 30460->30462 30532 b9f660 30460->30532 30536 b9f070 21 API calls 30460->30536 30461->30460 30462->30460 30463->29931 30464->29949 30465->30395 30467 b9f29a 30466->30467 30475 b9f350 30466->30475 30468 b9b030 LdrLoadDll 30467->30468 30469 b9f2bc 30468->30469 30476 ba9f30 30469->30476 30471 b9f2fe 30479 ba9f70 30471->30479 30474 baa480 2 API calls 30474->30475 30475->30402 30475->30403 30477 baaf50 LdrLoadDll 30476->30477 30478 ba9f4c 30477->30478 30478->30471 30480 baaf50 LdrLoadDll 30479->30480 30481 ba9f8c 30480->30481 30484 4e99fe0 LdrInitializeThunk 30481->30484 30482 b9f344 30482->30474 30484->30482 30486 b9b2c7 30485->30486 30487 b9b030 LdrLoadDll 30486->30487 30488 b9b303 30487->30488 30488->30411 30490 b9d317 30489->30490 30498 b9f700 30490->30498 30494 b9d38b 30495 b9d392 30494->30495 30509 baa290 LdrLoadDll 30494->30509 30495->30435 30497 b9d3a5 30497->30435 30499 b9f725 30498->30499 30510 b981a0 30499->30510 30501 b9d35f 30506 baa6d0 30501->30506 30502 ba4a40 8 API calls 30504 b9f749 30502->30504 30504->30501 30504->30502 30505 babdb0 2 API calls 30504->30505 30517 b9f540 LdrLoadDll CreateProcessInternalW LdrInitializeThunk 30504->30517 30505->30504 30507 baaf50 LdrLoadDll 30506->30507 30508 baa6ef CreateProcessInternalW 30507->30508 30508->30494 30509->30497 30511 b9829f 30510->30511 30513 b981b5 30510->30513 30511->30504 30512 ba4a40 8 API calls 30514 b98222 30512->30514 30513->30511 30513->30512 30515 babdb0 2 API calls 30514->30515 30516 b98249 30514->30516 30515->30516 30516->30504 30517->30504 30519 b9f6df 30518->30519 30520 ba4e40 LdrLoadDll 30518->30520 30521 b9f6ed 30519->30521 30522 b9f6e6 SetErrorMode 30519->30522 30520->30519 30521->30449 30522->30521 30537 b9f490 30523->30537 30525 ba43b6 30525->30451 30527 b98ab6 30526->30527 30528 babd30 2 API calls 30527->30528 30531 b98ad5 30528->30531 30529 b98cea 30529->30454 30531->30529 30556 ba9870 30531->30556 30533 b9f673 30532->30533 30604 ba9e80 30533->30604 30536->30460 30538 b9f4ad 30537->30538 30544 ba9fb0 30538->30544 30541 b9f4f5 30541->30525 30545 baaf50 LdrLoadDll 30544->30545 30546 ba9fcc 30545->30546 30554 4e999a0 LdrInitializeThunk 30546->30554 30547 b9f4ee 30547->30541 30549 baa000 30547->30549 30550 baaf50 LdrLoadDll 30549->30550 30551 baa01c 30550->30551 30555 4e99780 LdrInitializeThunk 30551->30555 30552 b9f51e 30552->30525 30554->30547 30555->30552 30557 babf80 2 API calls 30556->30557 30558 ba9887 30557->30558 30577 b99310 30558->30577 30560 ba98a2 30561 ba98c9 30560->30561 30562 ba98e0 30560->30562 30563 babdb0 2 API calls 30561->30563 30564 babd30 2 API calls 30562->30564 30565 ba98d6 30563->30565 30566 ba991a 30564->30566 30565->30529 30567 babd30 2 API calls 30566->30567 30568 ba9933 30567->30568 30574 ba9bd4 30568->30574 30583 babd70 LdrLoadDll 30568->30583 30570 ba9bb9 30571 ba9bc0 30570->30571 30570->30574 30572 babdb0 2 API calls 30571->30572 30573 ba9bca 30572->30573 30573->30529 30575 babdb0 2 API calls 30574->30575 30576 ba9c29 30575->30576 30576->30529 30578 b99335 30577->30578 30579 b9ace0 LdrLoadDll 30578->30579 30580 b99368 30579->30580 30582 b9938d 30580->30582 30584 b9cf10 30580->30584 30582->30560 30583->30570 30585 b9cf3c 30584->30585 30586 baa1d0 LdrLoadDll 30585->30586 30587 b9cf55 30586->30587 30588 b9cf5c 30587->30588 30595 baa210 30587->30595 30588->30582 30592 b9cf97 30593 baa480 2 API calls 30592->30593 30594 b9cfba 30593->30594 30594->30582 30596 baaf50 LdrLoadDll 30595->30596 30597 baa22c 30596->30597 30603 4e99710 LdrInitializeThunk 30597->30603 30598 b9cf7f 30598->30588 30600 baa800 30598->30600 30601 baa81f 30600->30601 30602 baaf50 LdrLoadDll 30600->30602 30601->30592 30602->30601 30603->30598 30605 baaf50 LdrLoadDll 30604->30605 30606 ba9e9c 30605->30606 30609 4e99840 LdrInitializeThunk 30606->30609 30607 b9f69e 30607->30460 30609->30607 30612 4e99540 LdrInitializeThunk 30614 ba9070 30615 babd30 2 API calls 30614->30615 30617 ba90ab 30615->30617 30616 ba918c 30617->30616 30618 b9ace0 LdrLoadDll 30617->30618 30619 ba90e1 30618->30619 30620 ba4e40 LdrLoadDll 30619->30620 30622 ba90fd 30620->30622 30621 ba9110 Sleep 30621->30622 30622->30616 30622->30621 30625 ba8c90 LdrLoadDll 30622->30625 30626 ba8ea0 LdrLoadDll 30622->30626 30625->30622 30626->30622

                                      Executed Functions

                                      Function 00BAA34A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 319 baa34a-baa34b 320 baa34d-baa353 319->320 321 baa355-baa366 319->321 320->321 322 baa36c-baa3a1 NtCreateFile 321->322 323 baa367 call baaf50 321->323 323->322
                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00000000,.z`,00BA4BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00BA4BA7,007A002E,00000000,00000060,00000000,00000000), ref: 00BAA39D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID: .z`
                                      • API String ID: 823142352-1441809116
                                      • Opcode ID: 47521cde2547e6d02ba81f1e4331a9a24a5c05576ceef6d177ea780992b639fd
                                      • Instruction ID: fedeff3d6152e4b3b079f8e497ffc014f5caabae093a642370dc31caf0e041d3
                                      • Opcode Fuzzy Hash: 47521cde2547e6d02ba81f1e4331a9a24a5c05576ceef6d177ea780992b639fd
                                      • Instruction Fuzzy Hash: 820108B2205148AFCB08CF98DC85DEB7BA9AF8C314F14824DFA4D97241D630E800CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA350 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 324 baa350-baa3a1 call baaf50 NtCreateFile
                                      APIs
                                      • NtCreateFile.NTDLL(00000060,00000000,.z`,00BA4BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00BA4BA7,007A002E,00000000,00000060,00000000,00000000), ref: 00BAA39D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID: .z`
                                      • API String ID: 823142352-1441809116
                                      • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                      • Instruction ID: c5c1d5883409b9c72ccbc70e2794a55c5f28e2a9703bf94dfb04425e24c6c7fa
                                      • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                      • Instruction Fuzzy Hash: 84F0BDB2204208AFCB48CF88DC85EEB77EDAF8C754F158248BA1D97241C630E811CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA47A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 333 baa47a-baa496 334 baa49c-baa4a9 NtClose 333->334 335 baa497 call baaf50 333->335 335->334
                                      APIs
                                      • NtClose.NTDLL(00BA4D40,?,?,00BA4D40,00000000,FFFFFFFF), ref: 00BAA4A5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID: E
                                      • API String ID: 3535843008-3568589458
                                      • Opcode ID: 923c47fb6c0f806cb26e25cbe916e3a964f4a4ded6499c5a1a170f3e68478f80
                                      • Instruction ID: c136d013dae69fe7557c850070d89a5223657309937658524bf7d3c8c6ed4b7d
                                      • Opcode Fuzzy Hash: 923c47fb6c0f806cb26e25cbe916e3a964f4a4ded6499c5a1a170f3e68478f80
                                      • Instruction Fuzzy Hash: 77E08C71204308AFDB14EFD4DC85FE77BA8EF49760F044599BA1C9B242C635E60087E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA3A4 Relevance: 1.6, APIs: 1, Instructions: 67filenativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtReadFile.NTDLL(00BA4D62,5EB65239,FFFFFFFF,00BA4A21,?,?,00BA4D62,?,00BA4A21,FFFFFFFF,5EB65239,00BA4D62,?,00000000), ref: 00BAA445
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID:
                                      • API String ID: 2738559852-0
                                      • Opcode ID: cd0c703dcaaddf0b5ebc57ace2ac5a8c1af72b42e8c60a49fcae6888e848b205
                                      • Instruction ID: 55c59a4c990ec873013890b4b74d3e118333652e7e0832490a956a74c33e84c5
                                      • Opcode Fuzzy Hash: cd0c703dcaaddf0b5ebc57ace2ac5a8c1af72b42e8c60a49fcae6888e848b205
                                      • Instruction Fuzzy Hash: 8F11D4B6204109AFCB18DF99DC81DEB77A9EF8C364B158249FA1DD3291C630EC11CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA3FA Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtReadFile.NTDLL(00BA4D62,5EB65239,FFFFFFFF,00BA4A21,?,?,00BA4D62,?,00BA4A21,FFFFFFFF,5EB65239,00BA4D62,?,00000000), ref: 00BAA445
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID:
                                      • API String ID: 2738559852-0
                                      • Opcode ID: 6d520f1484ba43b1073e04a1d7204da911b72b33b0adb654da338ea857255f68
                                      • Instruction ID: 34fbdc1f41bbf7f5891695c6550afbe20ae665793861d865265b849bdcbfeb21
                                      • Opcode Fuzzy Hash: 6d520f1484ba43b1073e04a1d7204da911b72b33b0adb654da338ea857255f68
                                      • Instruction Fuzzy Hash: 48F0E2B2200108AFCB18DF89CC81EEB77A9AF8C714F158248BA1DA7241C630E8118BB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA400 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtReadFile.NTDLL(00BA4D62,5EB65239,FFFFFFFF,00BA4A21,?,?,00BA4D62,?,00BA4A21,FFFFFFFF,5EB65239,00BA4D62,?,00000000), ref: 00BAA445
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FileRead
                                      • String ID:
                                      • API String ID: 2738559852-0
                                      • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                      • Instruction ID: 11e3e5393ac26a16e01c7d40f31de28dd21ab775c4b176e4e56cea62cc8b14c7
                                      • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                      • Instruction Fuzzy Hash: A6F0A4B2200208AFCB18DF89DC81EEB77ADAF8C754F158248BA1D97241D630E811CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA52A Relevance: 1.5, APIs: 1, Instructions: 34memorynativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00B92D11,00002000,00003000,00000004), ref: 00BAA569
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: 8b61a02e1b8c493e735aae87a0508315516ab49d8e224b970204770650ae5e7f
                                      • Instruction ID: f2162795b9b52c68ff73449f865fd7f401e289b4054cad7c38d9916e8d695fce
                                      • Opcode Fuzzy Hash: 8b61a02e1b8c493e735aae87a0508315516ab49d8e224b970204770650ae5e7f
                                      • Instruction Fuzzy Hash: 6CF058B1204108AFCB18DF99CC81EEB7BA9AF98354F148649FA0D97242C631E811CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA530 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00B92D11,00002000,00003000,00000004), ref: 00BAA569
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateMemoryVirtual
                                      • String ID:
                                      • API String ID: 2167126740-0
                                      • Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                      • Instruction ID: 104e97e41f8083393c7b60f97f79e01d12d08b589028a48014a7c35979c89b65
                                      • Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
                                      • Instruction Fuzzy Hash: B5F015B2200208AFCB18DF89CC81EAB77ADAF88754F118148BE1C97241C630F810CBB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA480 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtClose.NTDLL(00BA4D40,?,?,00BA4D40,00000000,FFFFFFFF), ref: 00BAA4A5
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Close
                                      • String ID:
                                      • API String ID: 3535843008-0
                                      • Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                      • Instruction ID: d0e98bce69bc401f33028dcfb75bc9eacf03e79ef627eed5173cde39a0ea6631
                                      • Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                      • Instruction Fuzzy Hash: F0D01776200214AFD714EB98CC85EA77BACEF48760F154499BA1C9B242C630FA0086E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: d6f725b1fe327d0121a52e9e419c24dd3a466255389529a0326ba47a9203b48f
                                      • Instruction ID: 8e8ba8e0da27afef8c9651a6c14f053a1d1d1cc7a72364c5901cbe9c1444a818
                                      • Opcode Fuzzy Hash: d6f725b1fe327d0121a52e9e419c24dd3a466255389529a0326ba47a9203b48f
                                      • Instruction Fuzzy Hash: 4090027130100423F11161594905B07000E97D0385FD1D452A0415998D9A96E962B161
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 22cfcb933ff9568cb33e9c3f5fe96ebb95af605fc91dcc00bdf2021efa377ad4
                                      • Instruction ID: 726bedee8f8078d68e36c6565482e315aa249e5bed0d726d29c5880c4546850f
                                      • Opcode Fuzzy Hash: 22cfcb933ff9568cb33e9c3f5fe96ebb95af605fc91dcc00bdf2021efa377ad4
                                      • Instruction Fuzzy Hash: 2D900261342041627545B1594805907400BA7E03857D1D052A1405D90C8966F866E661
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E995D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 67800ee6f9dd3c589d14205f6ed8cd4c98e9450851e809792b8fd6b3894ce5d8
                                      • Instruction ID: 1952f53aaa8c70811abc32736ca0422d6c380065d4508d7eadeb6f80905a1978
                                      • Opcode Fuzzy Hash: 67800ee6f9dd3c589d14205f6ed8cd4c98e9450851e809792b8fd6b3894ce5d8
                                      • Instruction Fuzzy Hash: 809002A130200013610571594815A16400F97E0345B91D061E10059D0DC965E8A17165
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E999A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: e7ae273100a7a22e3f2f618d7119c1846342e850c3ba7fddee1b72182b3a3f12
                                      • Instruction ID: dda3f2f5cefe9b49d94f75833046926c21437e60666d2effa5d16b8e16e1a204
                                      • Opcode Fuzzy Hash: e7ae273100a7a22e3f2f618d7119c1846342e850c3ba7fddee1b72182b3a3f12
                                      • Instruction Fuzzy Hash: 259002A134100452F10061594815F06000AD7E1345F91D055E1055994D8A59EC627166
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 90c67f74531a6880588a54c99d7a9583986c1f19726fd299b26a0d760b6432a8
                                      • Instruction ID: 50da9aa934bc8ca69b88378503537dec5a64ea95c11ff7ff1b6a48f2b555238a
                                      • Opcode Fuzzy Hash: 90c67f74531a6880588a54c99d7a9583986c1f19726fd299b26a0d760b6432a8
                                      • Instruction Fuzzy Hash: 62900265311000132105A5590B05907004B97D5395391D061F1006990CDA61E8716161
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 253df83e38d0fc0aebd0be0af71b1007957a3b42acbbd4505043807940cb2709
                                      • Instruction ID: 61f1e73c1c395e56e03ac70212f3a024acb4120c0aa4a3d9e76e74ceca98fe7a
                                      • Opcode Fuzzy Hash: 253df83e38d0fc0aebd0be0af71b1007957a3b42acbbd4505043807940cb2709
                                      • Instruction Fuzzy Hash: D79002B130100412F14071594805B46000A97D0345F91D051A5055994E8A99EDE576A5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E996E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 24a97f6394c30b43c881886932dfeff777386bd3609d8307e037f15031845241
                                      • Instruction ID: 8769522096f4f477d61e25a785d00474c1d4bb375d01c5f2cac82fe5a20cb144
                                      • Opcode Fuzzy Hash: 24a97f6394c30b43c881886932dfeff777386bd3609d8307e037f15031845241
                                      • Instruction Fuzzy Hash: 4C90027130108812F11061598805B4A000A97D0345F95D451A4415A98D8AD5E8A17161
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E996D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 6b188558fe1a5950f9d9f8ad0213385a66fd2d11d49f39661fd36fa46e535071
                                      • Instruction ID: 94a1c85d90a0d066dd3e20d80c1f79d856be33021cdceec6db6bc30f8cc90f4e
                                      • Opcode Fuzzy Hash: 6b188558fe1a5950f9d9f8ad0213385a66fd2d11d49f39661fd36fa46e535071
                                      • Instruction Fuzzy Hash: 8E90027130100852F10061594805F46000A97E0345F91D056A0115A94D8A55E8617561
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: ad8f997fa643be34a0cf4e0ea63053f0aae49b1c8b2c58dbc1be366f9bdd5ce7
                                      • Instruction ID: dfcda8d48f389a1d0e756287dd3c5f03f65aa7bf6dfb5926b54fe1831d478604
                                      • Opcode Fuzzy Hash: ad8f997fa643be34a0cf4e0ea63053f0aae49b1c8b2c58dbc1be366f9bdd5ce7
                                      • Instruction Fuzzy Hash: 8390027130100812F18071594805A4A000A97D1345FD1D055A0016A94DCE55EA6977E1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 02839c81b967df0b1cd0ef42e5c5504e1aa16c9681dc443970ec950fe9bfac0f
                                      • Instruction ID: d9b246bdb4801f4bd90c218dbe540218756b0ec1ffe966577f36487157c0734a
                                      • Opcode Fuzzy Hash: 02839c81b967df0b1cd0ef42e5c5504e1aa16c9681dc443970ec950fe9bfac0f
                                      • Instruction Fuzzy Hash: CB90026131180052F20065694C15F07000A97D0347F91D155A0145994CCD55E8716561
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 357a682e9a411276cb960da428a421fd6322b8bac36208259b33222f8f1e8a73
                                      • Instruction ID: 2ba392c9b6ef24ad649db9a7296250f6170764e4bc90f6677021f0e449c4462c
                                      • Opcode Fuzzy Hash: 357a682e9a411276cb960da428a421fd6322b8bac36208259b33222f8f1e8a73
                                      • Instruction Fuzzy Hash: 1690027130504852F14071594805E46001A97D0349F91D051A0055AD4D9A65ED65B6A1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 91cccbdf6379e1b8d6d98f98ccce57eb8aa8ddb08578931c8c6513323a0e3945
                                      • Instruction ID: e0d6f9acc6f167b089fa47e3e55c928e3ed8d1660940010d86aa723d9abb5a02
                                      • Opcode Fuzzy Hash: 91cccbdf6379e1b8d6d98f98ccce57eb8aa8ddb08578931c8c6513323a0e3945
                                      • Instruction Fuzzy Hash: DE90027131114412F11061598805B06000A97D1345F91D451A0815998D8AD5E8A17162
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: a72c1a13d8252338ca8aa366107139a27eeaed8edfd3f6ffa6d512f120011785
                                      • Instruction ID: 13c80506b8c37dec1bc01dca7a3f53b42dba761b11c7ce83bbd5474dccc06dc4
                                      • Opcode Fuzzy Hash: a72c1a13d8252338ca8aa366107139a27eeaed8edfd3f6ffa6d512f120011785
                                      • Instruction Fuzzy Hash: E090026931300012F18071595809A0A000A97D1346FD1E455A0006998CCD55E8796361
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E99710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 17bc24c04aca9805cbbd8f13a3d0490fe28dfa70d3927dc0bd9ded09a3e73b03
                                      • Instruction ID: 392a6cd0acc02f56a9033ebd5789d672b5230c89f4108604590248a933bce060
                                      • Opcode Fuzzy Hash: 17bc24c04aca9805cbbd8f13a3d0490fe28dfa70d3927dc0bd9ded09a3e73b03
                                      • Instruction Fuzzy Hash: 6390027130100412F10065995809A46000A97E0345F91E051A5015995ECAA5E8A17171
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BA9070 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 278 ba9070-ba90b2 call babd30 281 ba90b8-ba9108 call babe00 call b9ace0 call ba4e40 278->281 282 ba918c-ba9192 278->282 289 ba9110-ba9121 Sleep 281->289 290 ba9123-ba9129 289->290 291 ba9186-ba918a 289->291 292 ba912b-ba9151 call ba8c90 290->292 293 ba9153-ba9174 call ba8ea0 290->293 291->282 291->289 297 ba9179-ba917c 292->297 293->297 297->291
                                      APIs
                                      • Sleep.KERNELBASE(000007D0), ref: 00BA9118
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Sleep
                                      • String ID: net.dll$wininet.dll
                                      • API String ID: 3472027048-1269752229
                                      • Opcode ID: 7a610f761d0da1d75e76726c77c53804720eb4ac1e2d24cbc414290cef663861
                                      • Instruction ID: f8bd9e96009a50a26d547029c6299e789af573beb91076df51f6173de62cc230
                                      • Opcode Fuzzy Hash: 7a610f761d0da1d75e76726c77c53804720eb4ac1e2d24cbc414290cef663861
                                      • Instruction Fuzzy Hash: 753190B2944645BBC724DF64C885F67B7F8FB88B01F10845DF62A6B245DB30A550CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BA906B Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 298 ba906b-ba90b2 call babd30 302 ba90b8-ba9108 call babe00 call b9ace0 call ba4e40 298->302 303 ba918c-ba9192 298->303 310 ba9110-ba9121 Sleep 302->310 311 ba9123-ba9129 310->311 312 ba9186-ba918a 310->312 313 ba912b-ba9151 call ba8c90 311->313 314 ba9153-ba9174 call ba8ea0 311->314 312->303 312->310 318 ba9179-ba917c 313->318 314->318 318->312
                                      APIs
                                      • Sleep.KERNELBASE(000007D0), ref: 00BA9118
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Sleep
                                      • String ID: net.dll$wininet.dll
                                      • API String ID: 3472027048-1269752229
                                      • Opcode ID: b08a6ce0d31fff67cd8a02ab452008492041f8f11dbb9245ffb7420602244e61
                                      • Instruction ID: 184e41234e872a05ba80a01a40cfe92e600e67ba2a9f1747b3077f0e2a964959
                                      • Opcode Fuzzy Hash: b08a6ce0d31fff67cd8a02ab452008492041f8f11dbb9245ffb7420602244e61
                                      • Instruction Fuzzy Hash: 5221A0B2944305BBC714DF64C886F6BB7F8FB89700F1084ADF6296B245D774A550CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 327 baa652-baa676 328 baa67c-baa691 RtlFreeHeap 327->328 329 baa677 call baaf50 327->329 329->328
                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00B93AF8), ref: 00BAA68D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID: .z`
                                      • API String ID: 3298025750-1441809116
                                      • Opcode ID: ae98f763628c4392bb3b1a1536c0b2f0368de0e2b0a792b329fc50dea6d35e34
                                      • Instruction ID: 51ceb8bec366cfe8a105fc09824991d2c6e23aa3cd22de7e25b374dc29945cac
                                      • Opcode Fuzzy Hash: ae98f763628c4392bb3b1a1536c0b2f0368de0e2b0a792b329fc50dea6d35e34
                                      • Instruction Fuzzy Hash: 88E0E5B22002106FC708DFA8DC0AEE777ACAF88310F018088FD08AB242C230E810CAF1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA660 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 330 baa660-baa691 call baaf50 RtlFreeHeap
                                      APIs
                                      • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00B93AF8), ref: 00BAA68D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: FreeHeap
                                      • String ID: .z`
                                      • API String ID: 3298025750-1441809116
                                      • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                      • Instruction ID: 8cceba5dc54da9348510b3697101254fd4f7a2533908247fb2883e1f600a907e
                                      • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                      • Instruction Fuzzy Hash: 14E01AB12002046FD718DF59CC45EA777ACAF88750F014554B91C57241C631E910CAB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00B98393 Relevance: 3.2, APIs: 2, Instructions: 165threadwindowCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 336 b98393-b98394 337 b98362-b9836e PostThreadMessageW 336->337 338 b98396-b98397 336->338 339 b9838d-b98392 337->339 340 b98370-b9838b call b9a470 PostThreadMessageW 337->340 341 b98399-b9839b 338->341 342 b983ae-b983f8 call babe50 call b98310 call bab740 338->342 340->339 341->342 353 b98400-b98432 call b9f660 call baa4f0 342->353 358 b98434-b9843c 353->358 359 b98467-b9846f 353->359 360 b9843e-b98445 358->360 361 b98456-b98460 358->361 360->361 362 b98447-b9844e 360->362 361->353 363 b98462-b98465 361->363 362->361 365 b98450-b98454 362->365 364 b9848d-b9849f call baa480 363->364 364->359 371 b984a1-b9850c call ba9d00 364->371 365->361 367 b98470-b9848a call babdd0 365->367 367->364 371->359 374 b98512-b9856e call ba9d40 371->374 374->359 377 b98574-b985c1 call bab3e0 call bab400 call bac0c0 call babdd0 call ba4a40 374->377
                                      APIs
                                      • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00B9836A
                                      • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00B9838B
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 236999f765c31ed1e4a2b10231bcd8a33b3cf67a08a48903b585af6c4cd7ff1e
                                      • Instruction ID: 0880c692f7f84215b23562c1e9211100ba70b62f3917832d84e76da6ad8fa3a4
                                      • Opcode Fuzzy Hash: 236999f765c31ed1e4a2b10231bcd8a33b3cf67a08a48903b585af6c4cd7ff1e
                                      • Instruction Fuzzy Hash: AA519FB0A00209AFDB24DF64D886FAB77E8EF49704F1045BDF54997341DB70AA41CBA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00B98310 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00B9836A
                                      • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00B9838B
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: MessagePostThread
                                      • String ID:
                                      • API String ID: 1836367815-0
                                      • Opcode ID: 3172d27be0b016439e5481d8b21c313a41ffbcab7864ad54bb0489d0eefa33a4
                                      • Instruction ID: 335cd0f531cad85bcec414d548340d8fd2ab9d52a9acc8ea9bd84bcb9b411ad2
                                      • Opcode Fuzzy Hash: 3172d27be0b016439e5481d8b21c313a41ffbcab7864ad54bb0489d0eefa33a4
                                      • Instruction Fuzzy Hash: B701A731A8022877EB21A6949C03FFE77ACAB41F50F040164FF04BA1C2E6D4690546F6
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00B9ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00B9AD52
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Load
                                      • String ID:
                                      • API String ID: 2234796835-0
                                      • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                      • Instruction ID: ff6dc15f703e632f2c78972182caf3b6e069941d0b248840be89a6a3e07f4bd5
                                      • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                      • Instruction Fuzzy Hash: A9014CB5D4020DABDF10EAA4DC42F9DB7B89B14308F0041A4A90997641FA30EA04CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA6D0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00BAA724
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateInternalProcess
                                      • String ID:
                                      • API String ID: 2186235152-0
                                      • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                      • Instruction ID: c0dc9780b59a758952974fb977e22419aa25ef4453856a04bb8479826ca906a3
                                      • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                      • Instruction Fuzzy Hash: E401AFB2214108AFCB58DF89DC80EEB77ADAF8C754F158258BA0D97241C630E851CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BA91A0 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00B9F040,?,?,00000000), ref: 00BA91DC
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateThread
                                      • String ID:
                                      • API String ID: 2422867632-0
                                      • Opcode ID: d001787dd8ca96fa65b2911aefc285a5cdad22473a2ac9871353164a03a2e4aa
                                      • Instruction ID: c5c8a1337c70d2bc562cf05681cfd03355cfc13ba450edab7d8fe3de1e632599
                                      • Opcode Fuzzy Hash: d001787dd8ca96fa65b2911aefc285a5cdad22473a2ac9871353164a03a2e4aa
                                      • Instruction Fuzzy Hash: 84E06D373943043AE2206599AC02FA7B3DCDB82B20F140066FA0DEB2C1D595F80142A4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BA9194 Relevance: 1.5, APIs: 1, Instructions: 32threadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00B9F040,?,?,00000000), ref: 00BA91DC
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateThread
                                      • String ID:
                                      • API String ID: 2422867632-0
                                      • Opcode ID: 5c585ceb2830bdb2e193b6b4898af0f194a6028ce016521ec0b8a5f0340ccfcf
                                      • Instruction ID: f04af4a5f5a25927d867377da798fdb5aed1d25bcac268455f253cc6889e9087
                                      • Opcode Fuzzy Hash: 5c585ceb2830bdb2e193b6b4898af0f194a6028ce016521ec0b8a5f0340ccfcf
                                      • Instruction Fuzzy Hash: 33F02B363943003AE330655C8C02FB777D8CF96B10F140168F74AEB2C2C6E1F8418298
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA7B4 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                      Download Yara Rule
                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,?,00B9F1C2,00B9F1C2,?,00000000,?,?), ref: 00BAA7F0
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: 89ca5c93d8534a8e2bb0be591247ae050a34565beab9314f2841f460050478fd
                                      • Instruction ID: a9ddce0767bb11a381fa99870d70308ce59e3c4f2f28232c7819452ec11fed80
                                      • Opcode Fuzzy Hash: 89ca5c93d8534a8e2bb0be591247ae050a34565beab9314f2841f460050478fd
                                      • Instruction Fuzzy Hash: 75E065B16002146FDB14DF59CC45EDB739DAF85250F058155FE0D97281D530A814C7F1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00B9F6B7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNELBASE(00008003,?,00B98D14,?), ref: 00B9F6EB
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorMode
                                      • String ID:
                                      • API String ID: 2340568224-0
                                      • Opcode ID: 90b9c3102c450d00df1cc4581827bed306a2aa966ead5096ebece5954016a104
                                      • Instruction ID: 71d0dffb2cdf0ffd4419e83a623ba84d1fcb96d294c6e8c89574e0a3ba532f52
                                      • Opcode Fuzzy Hash: 90b9c3102c450d00df1cc4581827bed306a2aa966ead5096ebece5954016a104
                                      • Instruction Fuzzy Hash: D6E08C726442042BEB14EFA4DC43FAA3796BF90314F484074F908D7283EA66E0018614
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA620 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RtlAllocateHeap.NTDLL(00BA4526,?,00BA4C9F,00BA4C9F,?,00BA4526,?,?,?,?,?,00000000,00000000,?), ref: 00BAA64D
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateHeap
                                      • String ID:
                                      • API String ID: 1279760036-0
                                      • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                      • Instruction ID: 8620e03f19522828a2144c931bd1a491cc0ee9f1401faf99d604aba7baa9933c
                                      • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                      • Instruction Fuzzy Hash: 7AE012B1200208AFDB18EF99CC41EA777ACAF88654F118598BA1C9B242C631F910CAB0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00BAA7C0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                      Download Yara Rule
                                      APIs
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,?,00B9F1C2,00B9F1C2,?,00000000,?,?), ref: 00BAA7F0
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LookupPrivilegeValue
                                      • String ID:
                                      • API String ID: 3899507212-0
                                      • Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                      • Instruction ID: ef516b17f2ed1b36044e3826dda86450b0f7e00da5717f64245e3aa8374162c6
                                      • Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                      • Instruction Fuzzy Hash: 1CE01AB12002086FDB14DF49CC85EE737ADAF89650F018154BA0C57241CA31E8108BF5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 00B9F6C0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNELBASE(00008003,?,00B98D14,?), ref: 00B9F6EB
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.632202833.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_b90000_control.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ErrorMode
                                      • String ID:
                                      • API String ID: 2340568224-0
                                      • Opcode ID: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
                                      • Instruction ID: fe1742f2628bb39697b9266b1f077b424058b8dc9ca1b6b4709ab876f37d56c3
                                      • Opcode Fuzzy Hash: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
                                      • Instruction Fuzzy Hash: 7CD0A7727503043BEA10FAA49C03F2633CDAB45B10F4900B4F948D73C3DA54F4008165
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E9967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 578133ab76f24697159b05ad21f0c4a293ae980491906306d5f583253b9dca9f
                                      • Instruction ID: 38bc928377bc2629ec188226b6746d2793e8632923809b7ff33624086ef9cdc4
                                      • Opcode Fuzzy Hash: 578133ab76f24697159b05ad21f0c4a293ae980491906306d5f583253b9dca9f
                                      • Instruction Fuzzy Hash: DBB02BB19010C0C5FB00D7600A08B17390077C0304F12C051D1020680B073CE090F1B1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Non-executed Functions

                                      Function 04F0B260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE
                                      Download Yara Rule
                                      Strings
                                      • an invalid address, %p, xrefs: 04F0B4CF
                                      • *** then kb to get the faulting stack, xrefs: 04F0B51C
                                      • read from, xrefs: 04F0B4AD, 04F0B4B2
                                      • *** enter .exr %p for the exception record, xrefs: 04F0B4F1
                                      • This failed because of error %Ix., xrefs: 04F0B446
                                      • The resource is owned exclusively by thread %p, xrefs: 04F0B374
                                      • *** enter .cxr %p for the context, xrefs: 04F0B50D
                                      • Go determine why that thread has not released the critical section., xrefs: 04F0B3C5
                                      • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04F0B38F
                                      • The critical section is owned by thread %p., xrefs: 04F0B3B9
                                      • <unknown>, xrefs: 04F0B27E, 04F0B2D1, 04F0B350, 04F0B399, 04F0B417, 04F0B48E
                                      • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 04F0B39B
                                      • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 04F0B476
                                      • The instruction at %p tried to %s , xrefs: 04F0B4B6
                                      • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 04F0B323
                                      • The resource is owned shared by %d threads, xrefs: 04F0B37E
                                      • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 04F0B2DC
                                      • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04F0B3D6
                                      • *** An Access Violation occurred in %ws:%s, xrefs: 04F0B48F
                                      • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 04F0B47D
                                      • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 04F0B484
                                      • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 04F0B53F
                                      • *** A stack buffer overrun occurred in %ws:%s, xrefs: 04F0B2F3
                                      • *** Resource timeout (%p) in %ws:%s, xrefs: 04F0B352
                                      • a NULL pointer, xrefs: 04F0B4E0
                                      • The instruction at %p referenced memory at %p., xrefs: 04F0B432
                                      • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 04F0B305
                                      • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 04F0B314
                                      • *** Inpage error in %ws:%s, xrefs: 04F0B418
                                      • write to, xrefs: 04F0B4A6
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                      • API String ID: 0-108210295
                                      • Opcode ID: ac3d975cacef2711855709418ec7c4613f8f263e7d9d874b0b8fdd3405ec30ca
                                      • Instruction ID: 847ef18780d94a6c49fa20cd05c3ed1e2821e078af7be4d4d2146c67d4a17abe
                                      • Opcode Fuzzy Hash: ac3d975cacef2711855709418ec7c4613f8f263e7d9d874b0b8fdd3405ec30ca
                                      • Instruction Fuzzy Hash: 3E813879A40200FFEB255F85EC45D7B3B26EFC6B59F409044F1042B291E3A1B522EB72
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F11C06 Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 44%
                                      			E04F11C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x4e348a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04E5B150();
				} else {
					E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x4f4589c);
				E04E5B150("Heap error detected at %p (heap handle %p)\n",  *0x4f458a0);
				_t27 =  *0x4f45898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M04F11E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04E5B150();
				} else {
					E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E04E5B150("Error code: %d - %s\n",  *0x4f45898);
				_t113 =  *0x4f458a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04E5B150();
					} else {
						E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04E5B150("Parameter1: %p\n",  *0x4f458a4);
				}
				_t115 =  *0x4f458a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04E5B150();
					} else {
						E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04E5B150("Parameter2: %p\n",  *0x4f458a8);
				}
				_t117 =  *0x4f458ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04E5B150();
					} else {
						E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04E5B150("Parameter3: %p\n",  *0x4f458ac);
				}
				_t119 =  *0x4f458b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04E5B150();
					} else {
						E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x4f458b4);
					E04E5B150("Last known valid blocks: before - %p, after - %p\n",  *0x4f458b0);
				} else {
					_t120 =  *0x4f458b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04E5B150();
				} else {
					E04E5B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E04E5B150("Stack trace available at %p\n", 0x4f458c0);
			}











                                      0x04f11c10
                                      0x04f11c16
                                      0x04f11c1e
                                      0x04f11c3d
                                      0x04f11c3e
                                      0x04f11c20
                                      0x04f11c35
                                      0x04f11c3a
                                      0x04f11c44
                                      0x04f11c55
                                      0x04f11c5a
                                      0x04f11c65
                                      0x04f11c67
                                      0x00000000
                                      0x04f11c6e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04f11c67
                                      0x04f11cdc
                                      0x04f11ce5
                                      0x04f11d04
                                      0x04f11d05
                                      0x04f11ce7
                                      0x04f11cfc
                                      0x04f11d01
                                      0x04f11d0b
                                      0x04f11d17
                                      0x04f11d1f
                                      0x04f11d25
                                      0x04f11d30
                                      0x04f11d4f
                                      0x04f11d50
                                      0x04f11d32
                                      0x04f11d47
                                      0x04f11d4c
                                      0x04f11d61
                                      0x04f11d67
                                      0x04f11d68
                                      0x04f11d6e
                                      0x04f11d79
                                      0x04f11d98
                                      0x04f11d99
                                      0x04f11d7b
                                      0x04f11d90
                                      0x04f11d95
                                      0x04f11daa
                                      0x04f11db0
                                      0x04f11db1
                                      0x04f11db7
                                      0x04f11dc2
                                      0x04f11de1
                                      0x04f11de2
                                      0x04f11dc4
                                      0x04f11dd9
                                      0x04f11dde
                                      0x04f11df3
                                      0x04f11df9
                                      0x04f11dfa
                                      0x04f11e00
                                      0x04f11e0a
                                      0x04f11e13
                                      0x04f11e32
                                      0x04f11e33
                                      0x04f11e15
                                      0x04f11e2a
                                      0x04f11e2f
                                      0x04f11e39
                                      0x04f11e4a
                                      0x04f11e02
                                      0x04f11e02
                                      0x04f11e08
                                      0x00000000
                                      0x00000000
                                      0x04f11e08
                                      0x04f11e5b
                                      0x04f11e7a
                                      0x04f11e7b
                                      0x04f11e5d
                                      0x04f11e72
                                      0x04f11e77
                                      0x04f11e95

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                      • API String ID: 0-2897834094
                                      • Opcode ID: e44efb50a2cbb7b7eb8027ba633c1a6f7b4a5b86c98190f0180040eefde4419a
                                      • Instruction ID: d141c149834b538191863fb96bad6add88da96c24352f12a5c35c0ff0f718167
                                      • Opcode Fuzzy Hash: e44efb50a2cbb7b7eb8027ba633c1a6f7b4a5b86c98190f0180040eefde4419a
                                      • Instruction Fuzzy Hash: 2E614D37B11148DFE651B7A8E685D3173A0FB48A30B09A069FA095B370DA34FC42DF09
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E63D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 96%
                                      			E04E63D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04E61B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04E61B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04E61B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04E61B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04E61B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04E74620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E04E9F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04EA1370(_t276, 0x4e34e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E04E9BB40(0,  &_v68, _t170);
									if(L04E643C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E04E9BB40(_t257,  &_v68, _t243);
								if(L04E643C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04EA1370(_t278, 0x4e34e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04E74620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E04E9F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04EA1370(_v16, 0x4e34e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E04E9BB40(_t262,  &_v68, _t244);
								if(L04E643C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04EA1370(_t282, 0x4e34e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E04E9BB40(_t262,  &_v68, _t201);
							if(L04E643C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04E74620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E04E9F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04EA1370(_t280, 0x4e34e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E04E9BB40(_t267,  &_v68, _t245);
							if(L04E643C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04EA1370(_t284, 0x4e34e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E04E9BB40(_t267,  &_v68, _t224);
						if(L04E643C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}










































                                      0x04e63d3c
                                      0x04e63d42
                                      0x04e63d44
                                      0x04e63d46
                                      0x04e63d49
                                      0x04e63d4c
                                      0x04e63d4f
                                      0x04e63d52
                                      0x04e63d55
                                      0x04e63d58
                                      0x04e63d5b
                                      0x04e63d5f
                                      0x04e63d61
                                      0x04e63d66
                                      0x04eb8213
                                      0x04eb8218
                                      0x04e64085
                                      0x04e64088
                                      0x04e6408e
                                      0x04e64094
                                      0x04e6409a
                                      0x04e640a0
                                      0x04e640a6
                                      0x04e640a9
                                      0x04e640af
                                      0x04e640b6
                                      0x04e640bd
                                      0x04e640bd
                                      0x04e63d83
                                      0x04eb821f
                                      0x04eb8229
                                      0x04eb8238
                                      0x04eb8238
                                      0x04eb823d
                                      0x04eb823d
                                      0x04e63da0
                                      0x04e63daf
                                      0x04e63db5
                                      0x04e63dba
                                      0x04e63dba
                                      0x04e63dd4
                                      0x04e63e94
                                      0x04e63eab
                                      0x04e63f6d
                                      0x04e63f84
                                      0x04e6406b
                                      0x04e6406b
                                      0x04e6406e
                                      0x04e6406e
                                      0x04e64070
                                      0x04e64074
                                      0x04eb8351
                                      0x04eb8351
                                      0x04e6407a
                                      0x04e6407f
                                      0x04eb835d
                                      0x04eb8370
                                      0x04eb8377
                                      0x04eb8379
                                      0x04eb837c
                                      0x04eb837c
                                      0x04eb835d
                                      0x00000000
                                      0x04e6407f
                                      0x04e63f8a
                                      0x04e63f8d
                                      0x04e63f90
                                      0x04e63f95
                                      0x04eb830d
                                      0x04eb830f
                                      0x04e63f9b
                                      0x04e63fac
                                      0x04e63fae
                                      0x04e63fb1
                                      0x04e63fb1
                                      0x04e63fb6
                                      0x04eb8317
                                      0x04eb831a
                                      0x00000000
                                      0x04e63fbc
                                      0x04e63fc1
                                      0x04e63fc9
                                      0x04e63fd7
                                      0x04e63fda
                                      0x04e63fdd
                                      0x04e64021
                                      0x04e64021
                                      0x04e64029
                                      0x04e64030
                                      0x04e64044
                                      0x04e64046
                                      0x04e64046
                                      0x04e64044
                                      0x04e64049
                                      0x04eb8327
                                      0x04eb8334
                                      0x04eb8339
                                      0x04eb833c
                                      0x04e6404f
                                      0x04e6404f
                                      0x04e6404f
                                      0x04e64051
                                      0x04e64056
                                      0x04e64063
                                      0x04e64063
                                      0x04e64068
                                      0x00000000
                                      0x04e64068
                                      0x04e63fdf
                                      0x04e63fe2
                                      0x04e63fe4
                                      0x04e63fe7
                                      0x04e63fef
                                      0x04e64003
                                      0x04e64005
                                      0x04e64005
                                      0x04e6400c
                                      0x04e64013
                                      0x04e64016
                                      0x04e64017
                                      0x04e6401b
                                      0x04e6401e
                                      0x00000000
                                      0x04e6401e
                                      0x04e63fb6
                                      0x04e63eb1
                                      0x04e63eb4
                                      0x04e63eb7
                                      0x04e63ebc
                                      0x04eb82a9
                                      0x04eb82ab
                                      0x04e63ec2
                                      0x04e63ed3
                                      0x04e63ed5
                                      0x04e63ed8
                                      0x04e63ed8
                                      0x04e63edd
                                      0x04eb82b3
                                      0x04eb82b6
                                      0x00000000
                                      0x04e63ee3
                                      0x04e63ee8
                                      0x04e63eed
                                      0x04e63ef0
                                      0x04e63ef3
                                      0x04e63f02
                                      0x04e63f05
                                      0x04e63f08
                                      0x04eb82c0
                                      0x04eb82c3
                                      0x04eb82c5
                                      0x04eb82c8
                                      0x04eb82d0
                                      0x04eb82e4
                                      0x04eb82e6
                                      0x04eb82e6
                                      0x04eb82ed
                                      0x04eb82f4
                                      0x04eb82f7
                                      0x04eb82f8
                                      0x04eb82fc
                                      0x04eb82ff
                                      0x04eb82ff
                                      0x04e63f0e
                                      0x04e63f11
                                      0x04e63f16
                                      0x04e63f1d
                                      0x04e63f31
                                      0x04eb8307
                                      0x04eb8307
                                      0x04e63f31
                                      0x04e63f39
                                      0x04e63f48
                                      0x04e63f4d
                                      0x04e63f50
                                      0x04e63f50
                                      0x04e63f53
                                      0x04e63f58
                                      0x04e63f65
                                      0x04e63f65
                                      0x04e63f6a
                                      0x00000000
                                      0x04e63f6a
                                      0x04e63edd
                                      0x04e63dda
                                      0x04e63ddd
                                      0x04e63de0
                                      0x04e63de5
                                      0x04eb8245
                                      0x04e63deb
                                      0x04e63df7
                                      0x04e63dfc
                                      0x04e63dfe
                                      0x04e63e01
                                      0x04e63e01
                                      0x04e63e06
                                      0x04eb824d
                                      0x04eb824f
                                      0x04eb8254
                                      0x00000000
                                      0x04e63e0c
                                      0x04e63e11
                                      0x04e63e16
                                      0x04e63e19
                                      0x04e63e29
                                      0x04e63e2c
                                      0x04e63e2f
                                      0x04eb825c
                                      0x04eb825f
                                      0x04eb8261
                                      0x04eb8264
                                      0x04eb826c
                                      0x04eb8280
                                      0x04eb8282
                                      0x04eb8282
                                      0x04eb8289
                                      0x04eb8290
                                      0x04eb8293
                                      0x04eb8294
                                      0x04eb8298
                                      0x04eb829b
                                      0x04eb829b
                                      0x04e63e35
                                      0x04e63e38
                                      0x04e63e3d
                                      0x04e63e44
                                      0x04e63e58
                                      0x04eb82a3
                                      0x04eb82a3
                                      0x04e63e58
                                      0x04e63e60
                                      0x04e63e6f
                                      0x04e63e74
                                      0x04e63e77
                                      0x04e63e77
                                      0x04e63e7a
                                      0x04e63e7f
                                      0x04e63e8c
                                      0x04e63e8c
                                      0x04e63e91
                                      0x00000000
                                      0x04e63e91

                                      Strings
                                      • WindowsExcludedProcs, xrefs: 04E63D6F
                                      • Kernel-MUI-Language-SKU, xrefs: 04E63F70
                                      • Kernel-MUI-Number-Allowed, xrefs: 04E63D8C
                                      • Kernel-MUI-Language-Allowed, xrefs: 04E63DC0
                                      • Kernel-MUI-Language-Disallowed, xrefs: 04E63E97
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                      • API String ID: 0-258546922
                                      • Opcode ID: 224ce7feabb8da16007b9fabd645b87e9d5a57dfeb2cd0bdab2341dfbed177d2
                                      • Instruction ID: 34006af6d6c8876feb4622f7e9de39db87e34682433fd1e73ceea1e372730e84
                                      • Opcode Fuzzy Hash: 224ce7feabb8da16007b9fabd645b87e9d5a57dfeb2cd0bdab2341dfbed177d2
                                      • Instruction Fuzzy Hash: 4FF13E72D40619EFDB15DF98C980AEEB7B9FF08754F15106AE906A7250E734BE01CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E88E00 Relevance: 5.1, Strings: 4, Instructions: 126COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 44%
                                      			E04E88E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x4f4d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4f48464; // 0x77010110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4f45780 & 0x00000003) != 0) {
							E04ED5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4f45780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E04E9B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4f47984; // 0x33e3ea0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4f48464; // 0x77010110
					 *0x4f4b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04E89B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4f45780 & 0x00000005) != 0) {
						_push(_t49);
						E04ED5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}




















                                      0x04e88e0f
                                      0x04e88e16
                                      0x04e88e19
                                      0x04e88e1b
                                      0x04e88e21
                                      0x04e88e7f
                                      0x04e88e85
                                      0x04ec9354
                                      0x04ec936c
                                      0x04ec9371
                                      0x04ec937b
                                      0x04ec9381
                                      0x04ec9381
                                      0x04ec937b
                                      0x04e88e9d
                                      0x04e88e9d
                                      0x04e88e29
                                      0x04e88e2c
                                      0x04e88e38
                                      0x04e88e3e
                                      0x04e88e43
                                      0x04e88eb5
                                      0x04e88eb9
                                      0x04ec92aa
                                      0x04ec92af
                                      0x04ec92e8
                                      0x04ec92e8
                                      0x04ec92af
                                      0x04e88eb9
                                      0x04e88e45
                                      0x04e88e53
                                      0x04e88e5b
                                      0x04e88e5f
                                      0x04e88e78
                                      0x04e88e78
                                      0x04e88e7d
                                      0x04e88ec3
                                      0x04e88ecd
                                      0x04e88ed2
                                      0x04e88ed2
                                      0x04e88ec5
                                      0x04e88ec5
                                      0x00000000
                                      0x04e88e7d
                                      0x04e88e67
                                      0x04e88ea4
                                      0x04ec931a
                                      0x00000000
                                      0x00000000
                                      0x04ec9320
                                      0x04e88ea4
                                      0x04e88e70
                                      0x04ec9325
                                      0x04ec9340
                                      0x04ec9345
                                      0x04ec9345
                                      0x04e88e76
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Strings
                                      • minkernel\ntdll\ldrsnap.c, xrefs: 04EC933B, 04EC9367
                                      • LdrpFindDllActivationContext, xrefs: 04EC9331, 04EC935D
                                      • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 04EC932A
                                      • Querying the active activation context failed with status 0x%08lx, xrefs: 04EC9357
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                      • API String ID: 0-3779518884
                                      • Opcode ID: 1cc4f88242542b87519f96b5704b43d5f3e41d7dd1dc6daa0208f1f814409f83
                                      • Instruction ID: d9388efe9d7562d27fd3a83e97c4f9c2263f501aa1e6cbeeec27e714bad3de16
                                      • Opcode Fuzzy Hash: 1cc4f88242542b87519f96b5704b43d5f3e41d7dd1dc6daa0208f1f814409f83
                                      • Instruction Fuzzy Hash: 3741F232A00719AFDF35BB189C48A76B6A5BB4434CF85716DEC4C57191EB60BC80C681
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E68794 Relevance: 4.0, Strings: 3, Instructions: 255COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 83%
                                      			E04E68794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E04E6934A() != 0) {
								_t159 = E04EDA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4f45780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E04ED5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4f45780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E04E6849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04E68999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04E68999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4f45c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4f45c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04E72280(_t92, 0x4f486cc);
															_t94 = E04F29DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E04E861A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4f45c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04E68A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4f45c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4f45c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E04E9F380(_t136, 0x4e31184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04E72280(_t108, 0x4f486cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E04E861A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04F29D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E04E6FFB0(_t118, _t156, 0x4f486cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04E99A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}












































                                      0x04e68799
                                      0x04e6879d
                                      0x04e687a1
                                      0x04e687a3
                                      0x04e687a8
                                      0x04e687c3
                                      0x04e687c3
                                      0x04e687c8
                                      0x04e687d1
                                      0x04e687d4
                                      0x04e687d8
                                      0x04e687e5
                                      0x04e687ec
                                      0x04eb9bfe
                                      0x04eb9c00
                                      0x04eb9c02
                                      0x04eb9c08
                                      0x04eb9c0d
                                      0x04eb9c0f
                                      0x04eb9c14
                                      0x04eb9c2d
                                      0x04eb9c32
                                      0x04eb9c37
                                      0x04eb9c3a
                                      0x04eb9c3c
                                      0x04eb9c42
                                      0x04eb9c42
                                      0x04eb9c3c
                                      0x04eb9c02
                                      0x04e687da
                                      0x04e687df
                                      0x04e687e3
                                      0x00000000
                                      0x00000000
                                      0x04e687e3
                                      0x04e687f2
                                      0x00000000
                                      0x04e687fb
                                      0x04e687fd
                                      0x04e687fe
                                      0x04e6880e
                                      0x04e6880f
                                      0x04e68810
                                      0x04e68814
                                      0x04e6881a
                                      0x04e6881c
                                      0x04e6881f
                                      0x04e68821
                                      0x04e68822
                                      0x04e68824
                                      0x04e68826
                                      0x04e6882c
                                      0x04e6882e
                                      0x04eb9c48
                                      0x04eb9c48
                                      0x04e68834
                                      0x04e68834
                                      0x04e68837
                                      0x00000000
                                      0x00000000
                                      0x04e68837
                                      0x04e6882e
                                      0x04e6883d
                                      0x04e68840
                                      0x04e68843
                                      0x04e68846
                                      0x04e68849
                                      0x04e6884c
                                      0x04e6884e
                                      0x04e68850
                                      0x04e68852
                                      0x04e68854
                                      0x04e68857
                                      0x04e688b4
                                      0x04e688b6
                                      0x04e688b6
                                      0x04e68859
                                      0x04e68859
                                      0x04e68859
                                      0x04e68861
                                      0x04e68866
                                      0x04e6886a
                                      0x04e6893d
                                      0x04e68941
                                      0x00000000
                                      0x04e68947
                                      0x04e68947
                                      0x04e6894a
                                      0x04e6894c
                                      0x00000000
                                      0x04e68952
                                      0x04e68955
                                      0x04e6895a
                                      0x04e6895d
                                      0x04e6895d
                                      0x04e6895f
                                      0x04e68961
                                      0x04e68961
                                      0x04e68968
                                      0x00000000
                                      0x00000000
                                      0x04e6896a
                                      0x04e6896b
                                      0x04e6896e
                                      0x00000000
                                      0x04e68970
                                      0x04e68970
                                      0x04e68970
                                      0x04e68970
                                      0x04e68972
                                      0x04e68972
                                      0x04e68974
                                      0x00000000
                                      0x04e6897a
                                      0x04e6897a
                                      0x04e6897d
                                      0x00000000
                                      0x04e68983
                                      0x04eb9c65
                                      0x04eb9c6d
                                      0x04eb9c72
                                      0x04eb9c75
                                      0x04eb9c75
                                      0x04eb9c82
                                      0x04eb9c86
                                      0x04eb9c87
                                      0x04eb9c88
                                      0x04eb9c89
                                      0x04eb9c8c
                                      0x04eb9c90
                                      0x04eb9c95
                                      0x04eb9c97
                                      0x04eb9ca0
                                      0x04eb9ca3
                                      0x04eb9ca9
                                      0x04eb9ca9
                                      0x00000000
                                      0x04eb9ca9
                                      0x04eb9ca3
                                      0x00000000
                                      0x04eb9c97
                                      0x04e6897d
                                      0x00000000
                                      0x04e68974
                                      0x04e68988
                                      0x04e68992
                                      0x04e68996
                                      0x00000000
                                      0x04e68996
                                      0x04e6894c
                                      0x00000000
                                      0x04e68870
                                      0x04e6887b
                                      0x04e6887d
                                      0x04e6887f
                                      0x04e68881
                                      0x04e68884
                                      0x04e68884
                                      0x04e68886
                                      0x04e68889
                                      0x04e6888c
                                      0x04e6888e
                                      0x04e68891
                                      0x04e68891
                                      0x04e68898
                                      0x00000000
                                      0x00000000
                                      0x04e6889a
                                      0x04e6889b
                                      0x04e6889e
                                      0x00000000
                                      0x00000000
                                      0x04e688a0
                                      0x04e688a8
                                      0x04e688b0
                                      0x04e688b2
                                      0x04e688d3
                                      0x04e688d5
                                      0x00000000
                                      0x04e688d7
                                      0x04e688db
                                      0x04e688dc
                                      0x04e688e0
                                      0x04e688e8
                                      0x04e688ee
                                      0x04e688f0
                                      0x04e688f3
                                      0x04e688fc
                                      0x04e68901
                                      0x04e68906
                                      0x04e6890c
                                      0x04e6890c
                                      0x04e6890f
                                      0x04e68916
                                      0x04e68917
                                      0x04e68918
                                      0x04e68919
                                      0x04e6891a
                                      0x04e6891f
                                      0x04e68921
                                      0x04eb9c52
                                      0x04eb9c55
                                      0x04eb9c5b
                                      0x04eb9cac
                                      0x04eb9cc0
                                      0x04eb9cc0
                                      0x04eb9c55
                                      0x04e68927
                                      0x04e68927
                                      0x04e6892f
                                      0x04e68933
                                      0x00000000
                                      0x04e688f5
                                      0x04e688f5
                                      0x00000000
                                      0x04e688f7
                                      0x04e688f7
                                      0x04e688fa
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e688fa
                                      0x04e688f5
                                      0x04e688f3
                                      0x00000000
                                      0x04e688d5
                                      0x00000000
                                      0x04e688b2
                                      0x04e688c9
                                      0x00000000
                                      0x04e688c9
                                      0x04e6887f
                                      0x04e6886a
                                      0x04e68857
                                      0x04e68852
                                      0x04e688bf
                                      0x04e688bf
                                      0x04e687aa
                                      0x04e687ad
                                      0x04e687ae
                                      0x04e687b4
                                      0x04e687b5
                                      0x04e687b6
                                      0x04e687b8
                                      0x04e687bd
                                      0x04e687c1
                                      0x04e687f4
                                      0x04e687fa
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e687c1
                                      0x00000000

                                      Strings
                                      • minkernel\ntdll\ldrsnap.c, xrefs: 04EB9C28
                                      • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04EB9C18
                                      • LdrpDoPostSnapWork, xrefs: 04EB9C1E
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                      • API String ID: 0-1948996284
                                      • Opcode ID: 0b1fa1a217e277f2b731e4c07af881e6c92682c15b0be90fcd66106416b11404
                                      • Instruction ID: 35b20f63d2be2f5ade9480d61388542b7fb9fac6f829249371a232650b548522
                                      • Opcode Fuzzy Hash: 0b1fa1a217e277f2b731e4c07af881e6c92682c15b0be90fcd66106416b11404
                                      • Instruction Fuzzy Hash: 3D912771A41219EFDF28EF59C4809BA73B5FF84398F546169D94AAB241EB30FD01CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E67E41 Relevance: 3.9, Strings: 3, Instructions: 174COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 98%
                                      			E04E67E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E04E6CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E04E5C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4f45780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E04ED5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4f45780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04E77D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04E77D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E04ED7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04E77D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04E77D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E04ED7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E04E8A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E04E5B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}




















                                      0x04e67e4c
                                      0x04e67e50
                                      0x04e67e55
                                      0x04e67e58
                                      0x04e67e5d
                                      0x04e67e71
                                      0x04e67f33
                                      0x04e67e77
                                      0x04e67e77
                                      0x04e67e79
                                      0x04e67e79
                                      0x04e67e7e
                                      0x04e67f45
                                      0x04eb9848
                                      0x00000000
                                      0x04eb9848
                                      0x04e67f4e
                                      0x04e67f53
                                      0x04e67f5a
                                      0x00000000
                                      0x00000000
                                      0x04eb985a
                                      0x04eb9862
                                      0x04eb9866
                                      0x00000000
                                      0x04eb986c
                                      0x00000000
                                      0x04eb986c
                                      0x04e67e84
                                      0x04e67e84
                                      0x04e67e8d
                                      0x04eb9871
                                      0x04e67eb8
                                      0x04e67ec0
                                      0x04e67ec0
                                      0x04e67e9a
                                      0x04eb987e
                                      0x00000000
                                      0x00000000
                                      0x04eb9884
                                      0x04eb988b
                                      0x04eb98a7
                                      0x04eb98ac
                                      0x04eb98b1
                                      0x04eb98b6
                                      0x04eb98b8
                                      0x04eb98b8
                                      0x04eb98b9
                                      0x00000000
                                      0x04eb98b9
                                      0x04e67ea0
                                      0x04e67ea7
                                      0x00000000
                                      0x00000000
                                      0x04e67eac
                                      0x04e67eb1
                                      0x04e67ec6
                                      0x04e67ed0
                                      0x04eb98cc
                                      0x04e67ed6
                                      0x04e67ed6
                                      0x04e67ed6
                                      0x04e67ede
                                      0x04e67ee3
                                      0x04eb98e3
                                      0x04eb98f0
                                      0x04eb9902
                                      0x04eb98f2
                                      0x04eb98fb
                                      0x04eb98fb
                                      0x04eb9907
                                      0x04eb991d
                                      0x04eb991d
                                      0x04eb9907
                                      0x04eb98e3
                                      0x04e67ef0
                                      0x04e67f14
                                      0x04e67f14
                                      0x04e67f1e
                                      0x04eb9946
                                      0x04e67f24
                                      0x04e67f24
                                      0x04e67f24
                                      0x04e67f2c
                                      0x04eb996a
                                      0x04eb9975
                                      0x04eb9975
                                      0x04eb997e
                                      0x04eb9993
                                      0x04eb9993
                                      0x04eb997e
                                      0x00000000
                                      0x04e67ef2
                                      0x04e67efc
                                      0x04e67f0a
                                      0x04e67f0e
                                      0x04eb9933
                                      0x00000000
                                      0x04eb9933
                                      0x00000000
                                      0x04e67f0e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e67eb1

                                      Strings
                                      • LdrpCompleteMapModule, xrefs: 04EB9898
                                      • Could not validate the crypto signature for DLL %wZ, xrefs: 04EB9891
                                      • minkernel\ntdll\ldrmap.c, xrefs: 04EB98A2
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                      • API String ID: 0-1676968949
                                      • Opcode ID: 05fb55ce1e5bdea061d11f746cdb502cb4cb55c2d0dc1de3f97ae1cd766b1cc6
                                      • Instruction ID: 5218b6cd1565b04f20e2da6f8a8911f343b0f816a984d722c84ff48b89b9fdb9
                                      • Opcode Fuzzy Hash: 05fb55ce1e5bdea061d11f746cdb502cb4cb55c2d0dc1de3f97ae1cd766b1cc6
                                      • Instruction Fuzzy Hash: 955123716407459BE721CF68C944BAABBE4EB0175CF04265AEA929B3D1D734FD00CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5E620 Relevance: 3.9, Strings: 3, Instructions: 165COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 93%
                                      			E04E5E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E04E5F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E04E995D0();
						}
						if(_t78 != 0) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E04E9FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E04E9BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04E99600();
					if(_t97 < 0) {
						goto L6;
					}
					E04E9BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L04E5F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E04E9BB40(_t83, _t102 + 0x24, _t78);
								if(L04E643C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E04E9BB40(_t84, _t102 + 0x24, _t94);
									if(L04E643C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}































                                      0x04e5e620
                                      0x04e5e628
                                      0x04e5e62f
                                      0x04e5e631
                                      0x04e5e635
                                      0x04e5e637
                                      0x04e5e63e
                                      0x04eb5503
                                      0x04eb5503
                                      0x04e5e64c
                                      0x04e5e64c
                                      0x04e5e651
                                      0x00000000
                                      0x00000000
                                      0x04e5e661
                                      0x04e5e665
                                      0x04eb542a
                                      0x04e5e715
                                      0x04e5e71a
                                      0x04e5e71c
                                      0x04e5e720
                                      0x04e5e720
                                      0x04e5e727
                                      0x04e5e736
                                      0x04e5e736
                                      0x04e5e743
                                      0x04e5e743
                                      0x04e5e673
                                      0x04e5e678
                                      0x04e5e67d
                                      0x04e5e682
                                      0x04e5e685
                                      0x04e5e692
                                      0x04e5e69b
                                      0x04e5e6a3
                                      0x04e5e6ad
                                      0x04e5e6b1
                                      0x04e5e6b2
                                      0x04e5e6bb
                                      0x04e5e6bf
                                      0x04e5e6c0
                                      0x04e5e6c8
                                      0x04e5e6cc
                                      0x04e5e6d5
                                      0x04e5e6d9
                                      0x00000000
                                      0x00000000
                                      0x04e5e6e5
                                      0x04e5e6ea
                                      0x04e5e6f9
                                      0x04e5e70b
                                      0x04e5e70f
                                      0x04eb5439
                                      0x04eb545e
                                      0x04eb545e
                                      0x00000000
                                      0x04eb545e
                                      0x04eb543b
                                      0x04eb543e
                                      0x04eb5440
                                      0x04eb5445
                                      0x04eb5472
                                      0x04eb5475
                                      0x04eb548d
                                      0x04eb5493
                                      0x04eb54a9
                                      0x00000000
                                      0x00000000
                                      0x04eb54ab
                                      0x04eb54b4
                                      0x04eb54bc
                                      0x04eb54c8
                                      0x04eb54de
                                      0x04eb54fb
                                      0x04eb54e0
                                      0x04eb54e6
                                      0x04eb54eb
                                      0x04eb54eb
                                      0x04eb54de
                                      0x00000000
                                      0x04eb54bc
                                      0x04eb5477
                                      0x04eb547a
                                      0x04eb5480
                                      0x04eb5483
                                      0x04eb5486
                                      0x04eb548b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb548b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb5447
                                      0x04eb5447
                                      0x04eb5447
                                      0x04eb5447
                                      0x04eb544e
                                      0x00000000
                                      0x00000000
                                      0x04eb5450
                                      0x04eb5452
                                      0x04eb5455
                                      0x04eb545a
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb545c
                                      0x04eb546a
                                      0x04eb546d
                                      0x04eb546f
                                      0x00000000
                                      0x04eb546f
                                      0x04e5e70f

                                      Strings
                                      • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 04E5E68C
                                      • InstallLanguageFallback, xrefs: 04E5E6DB
                                      • @, xrefs: 04E5E6C0
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                      • API String ID: 0-1757540487
                                      • Opcode ID: a3a215072c673f2e41dada49f12ae019374ffca6ebcedfeae265c44192407058
                                      • Instruction ID: 8ae0b1fd6e4e09c08177f1c4d0a2c81af60b8d4aedad660046aa389d137f8378
                                      • Opcode Fuzzy Hash: a3a215072c673f2e41dada49f12ae019374ffca6ebcedfeae265c44192407058
                                      • Instruction Fuzzy Hash: E8518EB2508355ABD714DF64C440AABB3E8BF88719F05192EF986D7250F734EA04C7A2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED51BE Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 77%
                                      			E04ED51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x4f305f0);
				E04EAD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E04E6EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E04ED53CA(0);
						return E04EAD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E04E9F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04E73690(1, _t117, 0x4e31810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E04E9AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04E74620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E04E9AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E04ED500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04E99860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}






















                                      0x04ed51be
                                      0x04ed51c3
                                      0x04ed51c8
                                      0x04ed51cd
                                      0x04ed51d0
                                      0x04ed51d3
                                      0x04ed51d8
                                      0x04ed51db
                                      0x04ed51de
                                      0x04ed51e0
                                      0x04ed51e3
                                      0x04ed51e6
                                      0x04ed51e8
                                      0x04ed5342
                                      0x04ed5351
                                      0x04ed5356
                                      0x04ed535a
                                      0x04ed5360
                                      0x04ed5363
                                      0x04ed5366
                                      0x04ed5369
                                      0x04ed5369
                                      0x04ed536b
                                      0x04ed536b
                                      0x04ed5370
                                      0x04ed53a3
                                      0x04ed53a4
                                      0x04ed53a6
                                      0x04ed53ab
                                      0x04ed53ab
                                      0x04ed53ae
                                      0x04ed53ae
                                      0x04ed53b5
                                      0x04ed53bf
                                      0x04ed53bf
                                      0x04ed5375
                                      0x04ed5396
                                      0x04ed53a0
                                      0x04ed53a0
                                      0x00000000
                                      0x04ed5396
                                      0x04ed5377
                                      0x04ed5379
                                      0x04ed537f
                                      0x04ed538c
                                      0x04ed5390
                                      0x00000000
                                      0x04ed5390
                                      0x04ed51ee
                                      0x04ed51f1
                                      0x04ed5301
                                      0x04ed5310
                                      0x04ed5315
                                      0x04ed5318
                                      0x04ed531b
                                      0x04ed5320
                                      0x04ed532e
                                      0x04ed5331
                                      0x00000000
                                      0x04ed5331
                                      0x04ed5328
                                      0x04ed5329
                                      0x00000000
                                      0x04ed5329
                                      0x04ed51fa
                                      0x04ed5235
                                      0x04ed5236
                                      0x04ed5239
                                      0x04ed523f
                                      0x04ed5240
                                      0x04ed5241
                                      0x04ed5242
                                      0x04ed5246
                                      0x04ed5247
                                      0x04ed524e
                                      0x04ed5251
                                      0x04ed5267
                                      0x04ed5269
                                      0x04ed526e
                                      0x04ed527d
                                      0x04ed527e
                                      0x04ed5281
                                      0x04ed5282
                                      0x04ed5287
                                      0x04ed5288
                                      0x04ed528a
                                      0x04ed528f
                                      0x04ed5294
                                      0x00000000
                                      0x00000000
                                      0x04ed529a
                                      0x04ed529c
                                      0x04ed529e
                                      0x04ed529e
                                      0x04ed52a4
                                      0x04ed52b0
                                      0x00000000
                                      0x00000000
                                      0x04ed52ba
                                      0x04ed52bc
                                      0x04ed52bc
                                      0x04ed52d4
                                      0x04ed52d9
                                      0x04ed52dc
                                      0x04ed52e1
                                      0x00000000
                                      0x00000000
                                      0x04ed52e7
                                      0x04ed52f4
                                      0x00000000
                                      0x04ed52f4
                                      0x04ed5270
                                      0x00000000
                                      0x04ed5270
                                      0x04ed51fc
                                      0x04ed51fd
                                      0x04ed5202
                                      0x04ed5203
                                      0x04ed5205
                                      0x04ed520a
                                      0x04ed520f
                                      0x00000000
                                      0x00000000
                                      0x04ed521b
                                      0x04ed5226
                                      0x04ed522b
                                      0x04ed521d
                                      0x04ed521d
                                      0x04ed5222
                                      0x04ed5222
                                      0x04ed522d
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: Legacy$UEFI
                                      • API String ID: 2994545307-634100481
                                      • Opcode ID: b3bb59e8daef1186c20a2d9a630454c2557980eb5eaf2689eabd68a4bc501dbd
                                      • Instruction ID: 1c279c2891e8c386c493e9a9b427609fe067d0799a194bb0a713cc0c2217af2b
                                      • Opcode Fuzzy Hash: b3bb59e8daef1186c20a2d9a630454c2557980eb5eaf2689eabd68a4bc501dbd
                                      • Instruction Fuzzy Hash: 88516F71A00608AFDB24DFA8C980ABDB7F9FF48704F54542DE549EB255E671F901CB10
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5B171 Relevance: 1.7, APIs: 1, Instructions: 166COMMONLIBRARYCODE
                                      Download Yara Rule
                                      C-Code - Quality: 78%
                                      			E04E5B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x4f2f7a8);
				E04EAD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E04EAD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E04E9D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E04E9F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L04EADEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E04E9B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E04E9B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E04E9E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E04E9A890() != 0) {
					goto L6;
				}
				goto L3;
			}






















                                      0x04e5b171
                                      0x04e5b171
                                      0x04e5b171
                                      0x04e5b171
                                      0x04e5b171
                                      0x04e5b176
                                      0x04e5b17b
                                      0x04e5b180
                                      0x04e5b186
                                      0x04e5b18f
                                      0x04e5b198
                                      0x04e5b1a4
                                      0x04e5b1aa
                                      0x04eb4802
                                      0x04eb4802
                                      0x04eb4805
                                      0x04eb480c
                                      0x04eb480e
                                      0x04e5b1d1
                                      0x04e5b1d3
                                      0x04e5b1de
                                      0x04e5b1de
                                      0x04eb4817
                                      0x04eb481e
                                      0x04eb4820
                                      0x04eb4822
                                      0x04eb4822
                                      0x04eb4824
                                      0x04eb4824
                                      0x04eb482a
                                      0x00000000
                                      0x00000000
                                      0x04eb4835
                                      0x04eb483a
                                      0x04eb483d
                                      0x04eb483f
                                      0x04eb4842
                                      0x04eb4842
                                      0x04eb4842
                                      0x04eb4846
                                      0x04eb484c
                                      0x04eb484e
                                      0x04eb4851
                                      0x04eb4851
                                      0x04eb4853
                                      0x04eb4854
                                      0x04eb4854
                                      0x04eb4858
                                      0x04eb485a
                                      0x04eb485a
                                      0x04eb485d
                                      0x04eb485f
                                      0x04eb4861
                                      0x04eb4861
                                      0x04eb4866
                                      0x04eb486b
                                      0x04eb486e
                                      0x04eb4871
                                      0x04eb4876
                                      0x04eb4876
                                      0x04eb4878
                                      0x04eb487b
                                      0x04eb4884
                                      0x04eb4884
                                      0x00000000
                                      0x04eb487d
                                      0x04eb487d
                                      0x04eb4882
                                      0x04eb4889
                                      0x04eb4889
                                      0x04eb488f
                                      0x04eb4891
                                      0x04eb48e0
                                      0x04eb48e2
                                      0x04eb48e4
                                      0x04eb48e4
                                      0x04eb48e7
                                      0x04eb48e7
                                      0x04eb48ed
                                      0x04eb48f4
                                      0x04eb48f6
                                      0x04eb4951
                                      0x04eb4951
                                      0x04eb4953
                                      0x04eb4953
                                      0x04eb4956
                                      0x04eb4956
                                      0x04eb4958
                                      0x04eb4959
                                      0x04eb4959
                                      0x04eb495d
                                      0x04eb495d
                                      0x04eb495f
                                      0x04eb495f
                                      0x04eb4965
                                      0x04eb4969
                                      0x04eb49ba
                                      0x04eb49ba
                                      0x04eb49c1
                                      0x04eb49c5
                                      0x04eb49cc
                                      0x04eb49d4
                                      0x04eb49d7
                                      0x04eb49da
                                      0x04eb49e4
                                      0x04eb49e5
                                      0x04eb49f3
                                      0x04eb4a02
                                      0x00000000
                                      0x04eb4a02
                                      0x04eb4972
                                      0x04eb4974
                                      0x00000000
                                      0x00000000
                                      0x04eb4976
                                      0x04eb4979
                                      0x04eb4982
                                      0x04eb4983
                                      0x04eb4984
                                      0x04eb498b
                                      0x04eb498d
                                      0x04eb4991
                                      0x04eb4993
                                      0x04eb4999
                                      0x04eb499d
                                      0x04eb49a2
                                      0x04eb49a2
                                      0x04eb49a2
                                      0x04eb4999
                                      0x04eb49ac
                                      0x00000000
                                      0x04eb49b3
                                      0x04eb48f8
                                      0x04eb48fe
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb48fe
                                      0x04eb4895
                                      0x04eb489c
                                      0x04eb48ad
                                      0x04eb48b2
                                      0x04eb48b5
                                      0x04eb48b7
                                      0x04eb48ba
                                      0x04eb48bc
                                      0x04eb48c6
                                      0x04eb48c6
                                      0x04eb48cb
                                      0x04eb48d1
                                      0x04eb48d4
                                      0x04eb48d8
                                      0x04eb48d8
                                      0x00000000
                                      0x04eb48d8
                                      0x04eb48be
                                      0x04eb48c0
                                      0x00000000
                                      0x00000000
                                      0x04eb48c2
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb48c4
                                      0x00000000
                                      0x04eb4882
                                      0x04eb487b
                                      0x04eb4904
                                      0x04eb4906
                                      0x00000000
                                      0x00000000
                                      0x04eb4908
                                      0x04eb490e
                                      0x00000000
                                      0x00000000
                                      0x04eb4910
                                      0x04eb4917
                                      0x04eb4917
                                      0x00000000
                                      0x04eb4917
                                      0x04e5b1ba
                                      0x04eb47f9
                                      0x04eb47fc
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb47fc
                                      0x04e5b1c0
                                      0x04e5b1c0
                                      0x04e5b1c3
                                      0x04e5b1cb
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      APIs
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: _vswprintf_s
                                      • String ID:
                                      • API String ID: 677850445-0
                                      • Opcode ID: 80df5f8f0aac66c56c0622b58be390f1fdde72e739d066f7dd40de15112813f9
                                      • Instruction ID: e9c1019b0d23111fad7d4ebd726f63f0c4cf9ee73d496801634bf5c6e287d7b3
                                      • Opcode Fuzzy Hash: 80df5f8f0aac66c56c0622b58be390f1fdde72e739d066f7dd40de15112813f9
                                      • Instruction Fuzzy Hash: 0951D371D102698EEF35CF648844BFEBBB1AF00718F1051A9E8D9AB2C2D7706941CBD0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7B944 Relevance: 1.7, APIs: 1, Instructions: 166COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 76%
                                      			E04E7B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x4f4d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04E77D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04F28CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04E99E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E04E9B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E04E9CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04E77D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04F28F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E04E9AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4f48628; // 0x0
								_v68 = _t77;
								_t78 =  *0x4f4862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4f48628; // 0x0
							_t116 =  *0x4f4862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}
















































                                      0x04e7b94c
                                      0x04e7b956
                                      0x04e7b95c
                                      0x04e7b95e
                                      0x04e7b964
                                      0x04e7b969
                                      0x04e7b96d
                                      0x04e7b96d
                                      0x04e7b970
                                      0x04e7b974
                                      0x04e7b97a
                                      0x04e7badf
                                      0x04e7badf
                                      0x04e7bae2
                                      0x04e7bae4
                                      0x04e7bae6
                                      0x04e7baf0
                                      0x04ec2cb8
                                      0x04e7baf6
                                      0x04e7baf6
                                      0x04e7baf6
                                      0x04e7bafd
                                      0x04e7bb1f
                                      0x04e7bb1f
                                      0x04e7baff
                                      0x04e7bb00
                                      0x04e7bb00
                                      0x04e7bb03
                                      0x04e7bb03
                                      0x04e7bacb
                                      0x04e7bacf
                                      0x04e7bad0
                                      0x04e7bad1
                                      0x04e7badc
                                      0x04e7badc
                                      0x04e7b980
                                      0x04e7b980
                                      0x04e7b988
                                      0x04e7b98b
                                      0x04e7b98d
                                      0x04e7b990
                                      0x04e7b993
                                      0x04e7b999
                                      0x04e7b99b
                                      0x04e7b9a1
                                      0x04e7b9a5
                                      0x04e7b9aa
                                      0x04e7b9b0
                                      0x04e7b9bb
                                      0x04e7b9c0
                                      0x04e7b9c3
                                      0x04e7b9ca
                                      0x04e7b9cc
                                      0x04e7b9cf
                                      0x04e7b9d3
                                      0x04e7b9d7
                                      0x04e7ba94
                                      0x04e7ba94
                                      0x04e7ba98
                                      0x04e7baa3
                                      0x04ec2ccb
                                      0x04e7baa9
                                      0x04e7baa9
                                      0x04e7baa9
                                      0x04e7bab1
                                      0x04ec2cd5
                                      0x04ec2cdd
                                      0x04ec2cdd
                                      0x04e7babb
                                      0x04e7babc
                                      0x04e7bac2
                                      0x04e7bac3
                                      0x04e7bac3
                                      0x04e7bac6
                                      0x00000000
                                      0x04e7b9dd
                                      0x04e7b9dd
                                      0x04e7b9e7
                                      0x04e7b9e7
                                      0x04e7b9ec
                                      0x04e7b9ec
                                      0x04e7b9f1
                                      0x04e7b9f5
                                      0x04e7b9fa
                                      0x04e7ba00
                                      0x04e7ba0c
                                      0x04e7ba10
                                      0x04e7ba10
                                      0x04e7ba12
                                      0x04e7ba18
                                      0x00000000
                                      0x00000000
                                      0x04e7bb26
                                      0x04e7bb26
                                      0x04e7ba1e
                                      0x04e7ba1e
                                      0x04e7ba23
                                      0x04e7ba25
                                      0x04e7ba2c
                                      0x04e7ba30
                                      0x04e7ba35
                                      0x04e7ba35
                                      0x04e7ba41
                                      0x04e7ba46
                                      0x04e7ba4c
                                      0x04e7ba50
                                      0x04e7ba54
                                      0x04e7ba6a
                                      0x04e7ba6e
                                      0x04e7ba70
                                      0x04e7ba74
                                      0x04e7ba78
                                      0x04e7ba7a
                                      0x04e7ba7c
                                      0x04e7ba8e
                                      0x04e7ba90
                                      0x04e7ba92
                                      0x04e7bb14
                                      0x04e7bb14
                                      0x04e7bb16
                                      0x04e7bb16
                                      0x00000000
                                      0x04e7ba7c
                                      0x04e7bb0a
                                      0x04e7bb0d
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e7bb0f

                                      APIs
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04E7B9A5
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                      • String ID:
                                      • API String ID: 885266447-0
                                      • Opcode ID: e029c7849be20d056b9028293a7b0b75487a9e3509b1f9139904e7ca22307bde
                                      • Instruction ID: d5e5923a6b9fc599267c6ea6955986121dff91cc248aaa86c020d3a344d03b3b
                                      • Opcode Fuzzy Hash: e029c7849be20d056b9028293a7b0b75487a9e3509b1f9139904e7ca22307bde
                                      • Instruction Fuzzy Hash: FB514871A08345CFC720EF28C48092ABBE5FB88668F14996EF99587355E730FC44CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E82581 Relevance: 1.6, Strings: 1, Instructions: 329COMMONCrypto
                                      Download Yara Rule
                                      C-Code - Quality: 67%
                                      			E04E82581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t225;
				signed int _t229;
				signed int _t251;
				signed int _t253;
				intOrPtr _t255;
				signed int _t258;
				signed int _t265;
				signed int _t268;
				signed int _t276;
				intOrPtr _t282;
				signed int _t284;
				signed int _t286;
				void* _t287;
				signed int _t288;
				unsigned int _t291;
				signed int _t295;
				signed int _t297;
				signed int _t301;
				intOrPtr _t313;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t334;
				signed int _t336;
				void* _t337;
				void* _t339;
				void* _t340;

				_t334 = _t336;
				_t337 = _t336 - 0x4c;
				_v8 =  *0x4f4d360 ^ _t334;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t329 = 0x4f4b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t291 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t340 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t282 = 0x48;
				_t311 = 0 | _t340 == 0x00000000;
				_t322 = 0;
				_v37 = _t340 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t282 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t330 = 0xc0000106;
						goto L32;
					} else {
						_t329 = L04E74620(_t291,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t282);
						_v52 = _t329;
						__eflags = _t329;
						if(_t329 == 0) {
							_t330 = 0xc0000017;
							goto L32;
						} else {
							 *(_t329 + 0x44) =  *(_t329 + 0x44) & 0x00000000;
							_t50 = _t329 + 0x48; // 0x48
							_t324 = _t50;
							_t311 = _v32;
							 *((intOrPtr*)(_t329 + 0x3c)) = _t282;
							_t284 = 0;
							 *((short*)(_t329 + 0x30)) = _v48;
							__eflags = _t311;
							if(_t311 != 0) {
								 *(_t329 + 0x18) = _t324;
								__eflags = _t311 - 0x4f48478;
								 *_t329 = ((0 | _t311 == 0x04f48478) - 0x00000001 & 0xfffffffb) + 7;
								E04E9F3E0(_t324,  *((intOrPtr*)(_t311 + 4)),  *_t311 & 0x0000ffff);
								_t311 = _v32;
								_t337 = _t337 + 0xc;
								_t284 = 1;
								__eflags = _a8;
								_t324 = _t324 + (( *_t311 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t276 = E04EE39F2(_t324);
									_t311 = _v32;
									_t324 = _t276;
								}
							}
							_t295 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t330 = _v68;
								__eflags = 0;
								 *((short*)(_t324 - 2)) = 0;
								goto L32;
							} else {
								_t286 = _t329 + _t284 * 4;
								_v56 = _t286;
								do {
									__eflags = _t311;
									if(_t311 != 0) {
										_t225 =  *(_v60 + _t295 * 4);
										__eflags = _t225;
										if(_t225 == 0) {
											goto L30;
										} else {
											__eflags = _t225 == 5;
											if(_t225 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t286 =  *(_v60 + _t295 * 4);
										 *(_t286 + 0x18) = _t324;
										_t229 =  *(_v60 + _t295 * 4);
										__eflags = _t229 - 8;
										if(_t229 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t229 * 4 +  &M04E82959))) {
												case 0:
													__ax =  *0x4f48488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E04E9F3E0(__edi,  *0x4f4848c, __ax & 0x0000ffff);
														__eax =  *0x4f48488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E04E9F3E0(_t324, _v80, _v64);
													_t271 = _v64;
													goto L26;
												case 2:
													 *0x4f48480 & 0x0000ffff = E04E9F3E0(__edi,  *0x4f48484,  *0x4f48480 & 0x0000ffff);
													__eax =  *0x4f48480 & 0x0000ffff;
													__eax = ( *0x4f48480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E04E9F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E04E9F3E0(_t324, _v76, _v36);
														_t271 = _v36;
													}
													L26:
													_t337 = _t337 + 0xc;
													_t324 = _t324 + (_t271 >> 1) * 2 + 2;
													__eflags = _t324;
													L27:
													_push(0x3b);
													_pop(_t273);
													 *((short*)(_t324 - 2)) = _t273;
													goto L28;
												case 6:
													__ebx = "\\W[w\\W[w";
													__eflags = __ebx - "\\W[w\\W[w";
													if(__ebx != "\\W[w\\W[w") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E04E9F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\W[w\\W[w";
														} while (__ebx != "\\W[w\\W[w");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4f48478 & 0x0000ffff = E04E9F3E0(__edi,  *0x4f4847c,  *0x4f48478 & 0x0000ffff);
													__eax =  *0x4f48478 & 0x0000ffff;
													__eax = ( *0x4f48478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E04EE39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4f46e58 & 0x0000ffff = E04E9F3E0(__edi,  *0x4f46e5c,  *0x4f46e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4f46e58 & 0x0000ffff;
													__eax = ( *0x4f46e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t295 = _v16;
													_t311 = _v32;
													L29:
													_t286 = _t286 + 4;
													__eflags = _t286;
													_v56 = _t286;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t295 = _t295 + 1;
									_v16 = _t295;
									__eflags = _t295 - _v48;
								} while (_t295 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t229 =  *(_v60 + _t322 * 4);
						if(_t229 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t229 * 4 +  &M04E82935))) {
							case 0:
								__ax =  *0x4f48488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t311 =  &_v64;
								_v80 = E04E82E3E(0,  &_v64);
								_t282 = _t282 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4f48480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4f48480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E04E6EEF0(0x4f479a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E04E6EB70(__ecx, 0x4f479a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t203 = _v72;
											__eflags = _t203;
											if(_t203 != 0) {
												L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t203);
											}
											_t204 = _v52;
											__eflags = _t204;
											if(_t204 != 0) {
												__eflags = _t330;
												if(_t330 < 0) {
													L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t204);
													_t204 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t291 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4f47b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E04E6EB70(__ecx, 0x4f479a0);
										__eax = _v52;
										L36:
										_pop(_t323);
										_pop(_t331);
										__eflags = _v8 ^ _t334;
										_pop(_t283);
										return E04E9B640(_t204, _t283, _v8 ^ _t334, _t311, _t323, _t331);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t278 = _v56;
								if(_v56 != 0) {
									_t311 =  &_v36;
									_t280 = E04E82E3E(_t278,  &_v36);
									_t291 = _v36;
									_v76 = _t280;
								}
								if(_t291 == 0) {
									goto L44;
								} else {
									_t282 = _t282 + 2 + _t291;
								}
								goto L14;
							case 6:
								__eax =  *0x4f45764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4f48478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4f48478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4f46e58 & 0x0000ffff;
								__eax = ( *0x4f46e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t322 = _t322 + 1;
								if(_t322 >= _v48) {
									goto L16;
								} else {
									_t311 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					asm("int 0x29");
					asm("out 0x28, al");
					0xed108f40();
					asm("daa");
					0xed0e5748();
					0xf1434854();
					_t287 = 0x25;
					asm("in al, dx");
					asm("daa");
					0xed10476c();
					asm("daa");
					0xf1440178();
					_pop(_t339);
					asm("in al, dx");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x4f2ff00);
					E04EAD08C(_t287, _t324, _t329);
					_v44 =  *[fs:0x18];
					_t325 = 0;
					 *_a24 = 0;
					_t288 = _a12;
					__eflags = _t288;
					if(_t288 == 0) {
						_t251 = 0xc0000100;
					} else {
						_v8 = 0;
						_t332 = 0xc0000100;
						_v52 = 0xc0000100;
						_t253 = 4;
						while(1) {
							_v40 = _t253;
							__eflags = _t253;
							if(_t253 == 0) {
								break;
							}
							_t301 = _t253 * 0xc;
							_v48 = _t301;
							__eflags = _t288 -  *((intOrPtr*)(_t301 + 0x4e31664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t268 = E04E9E5C0(_a8,  *((intOrPtr*)(_t301 + 0x4e31668)), _t288);
									_t339 = _t339 + 0xc;
									__eflags = _t268;
									if(__eflags == 0) {
										_t332 = E04ED51BE(_t288,  *((intOrPtr*)(_v48 + 0x4e3166c)), _a16, _t325, _t332, __eflags, _a20, _a24);
										_v52 = _t332;
										break;
									} else {
										_t253 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t253 = _t253 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t332;
						__eflags = _t332;
						if(_t332 < 0) {
							__eflags = _t332 - 0xc0000100;
							if(_t332 == 0xc0000100) {
								_t297 = _a4;
								__eflags = _t297;
								if(_t297 != 0) {
									_v36 = _t297;
									__eflags =  *_t297 - _t325;
									if( *_t297 == _t325) {
										_t332 = 0xc0000100;
										goto L76;
									} else {
										_t313 =  *((intOrPtr*)(_v44 + 0x30));
										_t255 =  *((intOrPtr*)(_t313 + 0x10));
										__eflags =  *((intOrPtr*)(_t255 + 0x48)) - _t297;
										if( *((intOrPtr*)(_t255 + 0x48)) == _t297) {
											__eflags =  *(_t313 + 0x1c);
											if( *(_t313 + 0x1c) == 0) {
												L106:
												_t332 = E04E82AE4( &_v36, _a8, _t288, _a16, _a20, _a24);
												_v32 = _t332;
												__eflags = _t332 - 0xc0000100;
												if(_t332 != 0xc0000100) {
													goto L69;
												} else {
													_t325 = 1;
													_t297 = _v36;
													goto L75;
												}
											} else {
												_t258 = E04E66600( *(_t313 + 0x1c));
												__eflags = _t258;
												if(_t258 != 0) {
													goto L106;
												} else {
													_t297 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t332 = E04E82C50(_t297, _a8, _t288, _a16, _a20, _a24, _t325);
											L76:
											_v32 = _t332;
											goto L69;
										}
									}
									goto L108;
								} else {
									E04E6EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t332 = _a24;
									_t265 = E04E82AE4( &_v36, _a8, _t288, _a16, _a20, _t332);
									_v32 = _t265;
									__eflags = _t265 - 0xc0000100;
									if(_t265 == 0xc0000100) {
										_v32 = E04E82C50(_v36, _a8, _t288, _a16, _a20, _t332, 1);
									}
									_v8 = _t325;
									E04E82ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t251 = _t332;
					}
					L70:
					return E04EAD0D1(_t251);
				}
				L108:
			}



















































                                      0x04e82584
                                      0x04e82586
                                      0x04e82590
                                      0x04e82596
                                      0x04e82597
                                      0x04e82598
                                      0x04e82599
                                      0x04e8259e
                                      0x04e825a4
                                      0x04e825a9
                                      0x04e825ac
                                      0x04e825ae
                                      0x04e825b1
                                      0x04e825b2
                                      0x04e825b5
                                      0x04e825b8
                                      0x04e825bb
                                      0x04e825bc
                                      0x04e825bf
                                      0x04e825c2
                                      0x04e825c5
                                      0x04e825c6
                                      0x04e825cb
                                      0x04e825ce
                                      0x04e825d8
                                      0x04e825db
                                      0x04e825dd
                                      0x04e825de
                                      0x04e825e1
                                      0x04e825e3
                                      0x04e825e9
                                      0x04e826da
                                      0x04e826da
                                      0x04e826dd
                                      0x04e826e2
                                      0x04ec5b56
                                      0x00000000
                                      0x04e826e8
                                      0x04e826f9
                                      0x04e826fb
                                      0x04e826fe
                                      0x04e82700
                                      0x04ec5b60
                                      0x00000000
                                      0x04e82706
                                      0x04e82706
                                      0x04e8270a
                                      0x04e8270a
                                      0x04e8270d
                                      0x04e82713
                                      0x04e82716
                                      0x04e82718
                                      0x04e8271c
                                      0x04e8271e
                                      0x04ec5b6c
                                      0x04ec5b6f
                                      0x04ec5b7f
                                      0x04ec5b89
                                      0x04ec5b8e
                                      0x04ec5b93
                                      0x04ec5b96
                                      0x04ec5b9c
                                      0x04ec5ba0
                                      0x04ec5ba3
                                      0x04ec5bab
                                      0x04ec5bb0
                                      0x04ec5bb3
                                      0x04ec5bb3
                                      0x04ec5ba3
                                      0x04e82724
                                      0x04e82726
                                      0x04e82729
                                      0x04e8272c
                                      0x04e8279d
                                      0x04e8279d
                                      0x04e827a0
                                      0x04e827a2
                                      0x00000000
                                      0x04e8272e
                                      0x04e8272e
                                      0x04e82731
                                      0x04e82734
                                      0x04e82734
                                      0x04e82736
                                      0x04ec5bc1
                                      0x04ec5bc1
                                      0x04ec5bc4
                                      0x00000000
                                      0x04ec5bca
                                      0x04ec5bca
                                      0x04ec5bcd
                                      0x00000000
                                      0x04ec5bd3
                                      0x00000000
                                      0x04ec5bd3
                                      0x04ec5bcd
                                      0x04e8273c
                                      0x04e8273c
                                      0x04e82742
                                      0x04e82747
                                      0x04e8274a
                                      0x04e8274d
                                      0x04e82750
                                      0x00000000
                                      0x04e82756
                                      0x04e82756
                                      0x00000000
                                      0x04e82902
                                      0x04e82908
                                      0x04e8290b
                                      0x00000000
                                      0x04e82911
                                      0x04e8291c
                                      0x04e82921
                                      0x00000000
                                      0x04e82921
                                      0x00000000
                                      0x00000000
                                      0x04e82880
                                      0x04e82887
                                      0x04e8288c
                                      0x00000000
                                      0x00000000
                                      0x04e82805
                                      0x04e8280a
                                      0x04e82814
                                      0x04e82816
                                      0x00000000
                                      0x00000000
                                      0x04e8281e
                                      0x04e82821
                                      0x04e82823
                                      0x00000000
                                      0x04e82829
                                      0x04e82829
                                      0x04e82831
                                      0x04e8283c
                                      0x04e8283e
                                      0x00000000
                                      0x04e8283e
                                      0x00000000
                                      0x00000000
                                      0x04e8284e
                                      0x04e82850
                                      0x04e82851
                                      0x04e82854
                                      0x04e82857
                                      0x04e8285a
                                      0x04e8285c
                                      0x04e8285d
                                      0x00000000
                                      0x00000000
                                      0x04e8275d
                                      0x04e82761
                                      0x00000000
                                      0x04e82767
                                      0x04e8276e
                                      0x04e82773
                                      0x04e82773
                                      0x04e82776
                                      0x04e82778
                                      0x04e8277e
                                      0x04e8277e
                                      0x04e82781
                                      0x04e82781
                                      0x04e82783
                                      0x04e82784
                                      0x00000000
                                      0x00000000
                                      0x04ec5bd8
                                      0x04ec5bde
                                      0x04ec5be4
                                      0x04ec5be6
                                      0x04ec5be8
                                      0x04ec5be9
                                      0x04ec5bee
                                      0x04ec5bf8
                                      0x04ec5bff
                                      0x04ec5c01
                                      0x04ec5c04
                                      0x04ec5c07
                                      0x04ec5c0b
                                      0x04ec5c0d
                                      0x04ec5c0d
                                      0x04ec5c15
                                      0x04ec5c18
                                      0x04ec5c1b
                                      0x04ec5c1b
                                      0x04ec5c1e
                                      0x00000000
                                      0x00000000
                                      0x04e828c3
                                      0x04e828c8
                                      0x04e828d2
                                      0x04e828d4
                                      0x04e828d8
                                      0x04e828db
                                      0x04ec5c26
                                      0x04ec5c28
                                      0x04ec5c2d
                                      0x04ec5c2d
                                      0x00000000
                                      0x00000000
                                      0x04ec5c34
                                      0x04ec5c36
                                      0x04ec5c49
                                      0x04ec5c4e
                                      0x04ec5c54
                                      0x04ec5c5b
                                      0x04ec5c5d
                                      0x04ec5c60
                                      0x04e82788
                                      0x04e82788
                                      0x04e8278b
                                      0x04e8278e
                                      0x04e8278e
                                      0x04e8278e
                                      0x04e82791
                                      0x00000000
                                      0x00000000
                                      0x04e82756
                                      0x04e82750
                                      0x00000000
                                      0x04e82794
                                      0x04e82794
                                      0x04e82795
                                      0x04e82798
                                      0x04e82798
                                      0x00000000
                                      0x04e82734
                                      0x04e8272c
                                      0x04e82700
                                      0x04e825ef
                                      0x04e825ef
                                      0x04e825ef
                                      0x04e825f2
                                      0x04e825f8
                                      0x00000000
                                      0x00000000
                                      0x04e825fe
                                      0x00000000
                                      0x04e828e6
                                      0x04e828ec
                                      0x04e828ef
                                      0x04e828f5
                                      0x04e828f8
                                      0x04e828f8
                                      0x00000000
                                      0x04e828f8
                                      0x00000000
                                      0x00000000
                                      0x04e82866
                                      0x04e82866
                                      0x04e82876
                                      0x04e82879
                                      0x00000000
                                      0x00000000
                                      0x04e827e0
                                      0x04e827e7
                                      0x04e827e9
                                      0x04e827eb
                                      0x04ec5afd
                                      0x00000000
                                      0x04ec5afd
                                      0x00000000
                                      0x00000000
                                      0x04e82633
                                      0x04e82638
                                      0x04e8263b
                                      0x04e8263c
                                      0x04e8263e
                                      0x04e82640
                                      0x04e82642
                                      0x04e82647
                                      0x04e82649
                                      0x04e8264e
                                      0x04e82650
                                      0x04e82653
                                      0x04e82659
                                      0x04e826a2
                                      0x04e826a7
                                      0x04e826ac
                                      0x04e826b2
                                      0x04ec5b11
                                      0x04ec5b15
                                      0x04ec5b17
                                      0x00000000
                                      0x04e826b8
                                      0x04e826b8
                                      0x04e826ba
                                      0x04e827a6
                                      0x04e827a6
                                      0x04e827a9
                                      0x04e827ab
                                      0x04e827b9
                                      0x04e827b9
                                      0x04e827be
                                      0x04e827c1
                                      0x04e827c3
                                      0x04e827c5
                                      0x04e827c7
                                      0x04ec5c74
                                      0x04ec5c79
                                      0x04ec5c79
                                      0x04e827c7
                                      0x00000000
                                      0x04e826c0
                                      0x04e826c0
                                      0x04e826c3
                                      0x04e826c6
                                      0x04e826c6
                                      0x04e826c9
                                      0x04e826c9
                                      0x00000000
                                      0x04e826c9
                                      0x04e826ba
                                      0x04e8265b
                                      0x04e8265b
                                      0x04e8265e
                                      0x04e82667
                                      0x04e8266d
                                      0x04e82677
                                      0x04e8267c
                                      0x04e8267f
                                      0x04e82681
                                      0x04ec5b49
                                      0x04ec5b4e
                                      0x04e827cd
                                      0x04e827d0
                                      0x04e827d1
                                      0x04e827d2
                                      0x04e827d4
                                      0x04e827dd
                                      0x04e82687
                                      0x04e82687
                                      0x04e8268a
                                      0x04e8268b
                                      0x04e8268e
                                      0x04e8268f
                                      0x04e82691
                                      0x04e82696
                                      0x04e82698
                                      0x04e8269d
                                      0x04e8269f
                                      0x00000000
                                      0x04e8269f
                                      0x04e82681
                                      0x00000000
                                      0x00000000
                                      0x04e82846
                                      0x00000000
                                      0x00000000
                                      0x04e82605
                                      0x04e8260a
                                      0x04e8260c
                                      0x04e82611
                                      0x04e82616
                                      0x04e82619
                                      0x04e82619
                                      0x04e8261e
                                      0x00000000
                                      0x04e82624
                                      0x04e82627
                                      0x04e82627
                                      0x00000000
                                      0x00000000
                                      0x04ec5b1f
                                      0x00000000
                                      0x00000000
                                      0x04e82894
                                      0x04e8289b
                                      0x04e8289d
                                      0x04e828a1
                                      0x04ec5b2b
                                      0x04ec5b2e
                                      0x04ec5b2e
                                      0x04e828a7
                                      0x04e828a9
                                      0x04ec5b04
                                      0x04ec5b09
                                      0x04ec5b09
                                      0x04ec5b09
                                      0x00000000
                                      0x00000000
                                      0x04ec5b35
                                      0x04ec5b3c
                                      0x04e828fb
                                      0x04e828fb
                                      0x04e826cc
                                      0x04e826cc
                                      0x04e826d0
                                      0x00000000
                                      0x04e826d2
                                      0x04e826d2
                                      0x00000000
                                      0x04e826d2
                                      0x00000000
                                      0x00000000
                                      0x04e825fe
                                      0x04e8292d
                                      0x04e82930
                                      0x04e82935
                                      0x04e82937
                                      0x04e8293e
                                      0x04e8293f
                                      0x04e8294a
                                      0x04e82956
                                      0x04e82957
                                      0x04e82962
                                      0x04e82963
                                      0x04e8296e
                                      0x04e8296f
                                      0x04e8297a
                                      0x04e8297b
                                      0x04e8297e
                                      0x04e8297f
                                      0x04e82980
                                      0x04e82981
                                      0x04e82982
                                      0x04e82983
                                      0x04e82984
                                      0x04e82985
                                      0x04e82986
                                      0x04e82987
                                      0x04e82988
                                      0x04e82989
                                      0x04e8298a
                                      0x04e8298b
                                      0x04e8298c
                                      0x04e8298d
                                      0x04e8298e
                                      0x04e8298f
                                      0x04e82990
                                      0x04e82992
                                      0x04e82997
                                      0x04e829a3
                                      0x04e829a6
                                      0x04e829ab
                                      0x04e829ad
                                      0x04e829b0
                                      0x04e829b2
                                      0x04ec5c80
                                      0x04e829b8
                                      0x04e829b8
                                      0x04e829bb
                                      0x04e829c0
                                      0x04e829c5
                                      0x04e829c6
                                      0x04e829c6
                                      0x04e829c9
                                      0x04e829cb
                                      0x00000000
                                      0x00000000
                                      0x04e829cd
                                      0x04e829d0
                                      0x04e829d9
                                      0x04e829db
                                      0x04e829dd
                                      0x04e82a7f
                                      0x04e82a84
                                      0x04e82a87
                                      0x04e82a89
                                      0x04ec5ca1
                                      0x04ec5ca3
                                      0x00000000
                                      0x04e82a8f
                                      0x04e82a8f
                                      0x00000000
                                      0x04e82a8f
                                      0x00000000
                                      0x04e829e3
                                      0x04e829e3
                                      0x04e829e3
                                      0x00000000
                                      0x04e829e3
                                      0x04e829dd
                                      0x00000000
                                      0x04e829db
                                      0x04e829e6
                                      0x04e829e9
                                      0x04e829eb
                                      0x04e829ed
                                      0x04e829f3
                                      0x04e829f5
                                      0x04e829f8
                                      0x04e829fa
                                      0x04e82a97
                                      0x04e82a9a
                                      0x04e82a9d
                                      0x04e82add
                                      0x00000000
                                      0x04e82a9f
                                      0x04e82aa2
                                      0x04e82aa5
                                      0x04e82aa8
                                      0x04e82aab
                                      0x04ec5cab
                                      0x04ec5caf
                                      0x04ec5cc5
                                      0x04ec5cda
                                      0x04ec5cdc
                                      0x04ec5cdf
                                      0x04ec5ce5
                                      0x00000000
                                      0x04ec5ceb
                                      0x04ec5ced
                                      0x04ec5cee
                                      0x00000000
                                      0x04ec5cee
                                      0x04ec5cb1
                                      0x04ec5cb4
                                      0x04ec5cb9
                                      0x04ec5cbb
                                      0x00000000
                                      0x04ec5cbd
                                      0x04ec5cbd
                                      0x00000000
                                      0x04ec5cbd
                                      0x04ec5cbb
                                      0x04e82ab1
                                      0x04e82ab1
                                      0x04e82ac4
                                      0x04e82ac6
                                      0x04e82ac6
                                      0x00000000
                                      0x04e82ac6
                                      0x04e82aab
                                      0x00000000
                                      0x04e82a00
                                      0x04e82a09
                                      0x04e82a0e
                                      0x04e82a21
                                      0x04e82a24
                                      0x04e82a35
                                      0x04e82a3a
                                      0x04e82a3d
                                      0x04e82a42
                                      0x04e82a59
                                      0x04e82a59
                                      0x04e82a5c
                                      0x04e82a5f
                                      0x04e82a5f
                                      0x04e829fa
                                      0x04e829f3
                                      0x04e82a64
                                      0x04e82a64
                                      0x04e82a6b
                                      0x04e82a6b
                                      0x04e82a6d
                                      0x04e82a72
                                      0x04e82a72
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: PATH
                                      • API String ID: 0-1036084923
                                      • Opcode ID: cdab447e3f61694f5a6547a480bd38ceae8cd409af6629cc83f8381048bf5cec
                                      • Instruction ID: c4ef5747f04d7d42ed31a9b0caf68dadfb70157b0bbe944aedecafd6b1d57451
                                      • Opcode Fuzzy Hash: cdab447e3f61694f5a6547a480bd38ceae8cd409af6629cc83f8381048bf5cec
                                      • Instruction Fuzzy Hash: B0C19E75E00219EFDF25EF99D880AAEB7B1FF48744F04506DE909AB250E735B802DB60
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8FAB0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 80%
                                      			E04E8FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E04E6EEF0(0x4f47b60);
					_t134 =  *0x4f47b84; // 0x775b7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4f47b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4f47b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04E66D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E04E676E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E04EF8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E04E5B150();
													}
													_t116 = E04EF6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E04E675CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4f48638; // 0x33efbf0
																	_t122 = L04E638A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E04E676E2(_t154);
																			goto L41;
																		}
																	} else {
																		E04E676E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L04E8FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L04E670F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E04E8FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E04E8FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E04E8FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E04E8FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E04E8FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4f47b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4f47b84 = _t75;
						_t73 = E04E6EB70(_t134, 0x4f47b60);
						if( *0x4f47b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E04E6FF60( *0x4f47b20);
							}
						}
						goto L5;
					}
				}
			}

















































                                      0x04e8fab0
                                      0x04e8fab2
                                      0x04e8fab3
                                      0x04e8fab4
                                      0x04e8fabc
                                      0x04e8fac0
                                      0x04e8fb14
                                      0x04e8fb17
                                      0x04e8fac2
                                      0x04e8fac8
                                      0x04e8facd
                                      0x04e8fad3
                                      0x04e8fad3
                                      0x04e8fadd
                                      0x04e8fb18
                                      0x04e8fb1b
                                      0x04e8fb1d
                                      0x04e8fb1e
                                      0x04e8fb1f
                                      0x04e8fb20
                                      0x04e8fb21
                                      0x04e8fb22
                                      0x04e8fb23
                                      0x04e8fb24
                                      0x04e8fb25
                                      0x04e8fb26
                                      0x04e8fb27
                                      0x04e8fb28
                                      0x04e8fb29
                                      0x04e8fb2a
                                      0x04e8fb2b
                                      0x04e8fb2c
                                      0x04e8fb2d
                                      0x04e8fb2e
                                      0x04e8fb2f
                                      0x04e8fb3a
                                      0x04e8fb3b
                                      0x04e8fb3e
                                      0x04e8fb41
                                      0x04e8fb44
                                      0x04e8fb47
                                      0x04e8fb4a
                                      0x04e8fb4d
                                      0x04e8fb53
                                      0x04ecbdcb
                                      0x04ecbdcb
                                      0x04e8fb59
                                      0x04e8fb5b
                                      0x04e8fb5b
                                      0x04e8fb5e
                                      0x04ecbdd5
                                      0x04ecbdd8
                                      0x00000000
                                      0x04ecbdda
                                      0x00000000
                                      0x04ecbdda
                                      0x04e8fb64
                                      0x04e8fb64
                                      0x04e8fb64
                                      0x04e8fb67
                                      0x04e8fb6e
                                      0x04e8fb70
                                      0x04e8fb72
                                      0x00000000
                                      0x04e8fb78
                                      0x04e8fb7a
                                      0x04e8fb7a
                                      0x04e8fb7d
                                      0x04e8fb80
                                      0x04ecbddf
                                      0x04ecbde1
                                      0x00000000
                                      0x04ecbde3
                                      0x00000000
                                      0x04ecbde3
                                      0x04e8fb86
                                      0x04e8fb86
                                      0x04e8fb86
                                      0x04e8fb8b
                                      0x04e8fb90
                                      0x04e8fb92
                                      0x04e8fb94
                                      0x04e8fb9a
                                      0x04e8fb9b
                                      0x04e8fba1
                                      0x04ecbde8
                                      0x04ecbdeb
                                      0x04ecbded
                                      0x04ecbeb5
                                      0x04ecbeb5
                                      0x04ecbebb
                                      0x04ecbebd
                                      0x04ecbec3
                                      0x04ecbed2
                                      0x04ecbedd
                                      0x04ecbedd
                                      0x04ecbeed
                                      0x00000000
                                      0x04ecbdf3
                                      0x04ecbdfe
                                      0x04ecbe06
                                      0x04ecbe0b
                                      0x04ecbe0d
                                      0x04ecbe0f
                                      0x04ecbe14
                                      0x04ecbe19
                                      0x04ecbe20
                                      0x04ecbe25
                                      0x04ecbe27
                                      0x04ecbe35
                                      0x04ecbe39
                                      0x04ecbe46
                                      0x04ecbe4f
                                      0x04ecbe54
                                      0x04ecbe56
                                      0x04ecbef8
                                      0x04ecbef8
                                      0x00000000
                                      0x04ecbe5c
                                      0x04ecbe5c
                                      0x04ecbe60
                                      0x00000000
                                      0x04ecbe66
                                      0x04ecbe66
                                      0x04ecbe7f
                                      0x04ecbe84
                                      0x04ecbe87
                                      0x04ecbe89
                                      0x04ecbe8b
                                      0x04ecbe99
                                      0x04ecbe9d
                                      0x04ecbea0
                                      0x04ecbeac
                                      0x04ecbeaf
                                      0x04ecbeb1
                                      0x04ecbeb3
                                      0x04ecbeb3
                                      0x00000000
                                      0x04ecbea2
                                      0x04ecbea2
                                      0x00000000
                                      0x04ecbea2
                                      0x04ecbe8d
                                      0x04ecbe8d
                                      0x04ecbe92
                                      0x00000000
                                      0x04ecbe92
                                      0x04ecbe8b
                                      0x04ecbe60
                                      0x04ecbe3b
                                      0x04ecbe3b
                                      0x04ecbe3e
                                      0x00000000
                                      0x04ecbe40
                                      0x04ecbe40
                                      0x04ecbe44
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04ecbe44
                                      0x04ecbe3e
                                      0x04ecbe29
                                      0x04ecbe29
                                      0x00000000
                                      0x04ecbe29
                                      0x04ecbe27
                                      0x00000000
                                      0x04e8fba7
                                      0x04e8fba7
                                      0x04e8fbab
                                      0x04ecbf02
                                      0x04e8fbb1
                                      0x04e8fbb1
                                      0x04e8fbb8
                                      0x04e8fbbd
                                      0x04e8fbbd
                                      0x04e8fbbf
                                      0x04e8fbbf
                                      0x04e8fbc5
                                      0x04e8fbcb
                                      0x04e8fbf8
                                      0x04e8fbf8
                                      0x04e8fbfa
                                      0x00000000
                                      0x04e8fc00
                                      0x04e8fc00
                                      0x04e8fc03
                                      0x00000000
                                      0x04e8fc09
                                      0x04e8fc09
                                      0x04e8fc0f
                                      0x04e8fc15
                                      0x04e8fc23
                                      0x04e8fc23
                                      0x04e8fc25
                                      0x04e8fc27
                                      0x04e8fc75
                                      0x04e8fc7c
                                      0x04e8fc84
                                      0x00000000
                                      0x04e8fc29
                                      0x04e8fc29
                                      0x04e8fc2d
                                      0x04e8fc30
                                      0x04ecbf0f
                                      0x00000000
                                      0x04e8fc36
                                      0x04e8fc38
                                      0x04e8fc3b
                                      0x04e8fc41
                                      0x04ecbf17
                                      0x04ecbf19
                                      0x04ecbf48
                                      0x04ecbf4b
                                      0x00000000
                                      0x04ecbf1b
                                      0x04ecbf22
                                      0x04ecbf24
                                      0x04ecbf26
                                      0x00000000
                                      0x04ecbf2c
                                      0x04ecbf37
                                      0x04ecbf39
                                      0x04ecbf3b
                                      0x00000000
                                      0x04ecbf41
                                      0x04ecbf41
                                      0x04ecbf41
                                      0x04ecbf41
                                      0x04ecbf45
                                      0x00000000
                                      0x04ecbf45
                                      0x04ecbf3b
                                      0x04ecbf26
                                      0x00000000
                                      0x04e8fc47
                                      0x04e8fc47
                                      0x04e8fc49
                                      0x04e8fcb2
                                      0x04e8fcb4
                                      0x04e8fcb6
                                      0x04e8fcdc
                                      0x04e8fcdc
                                      0x00000000
                                      0x04e8fcb8
                                      0x04e8fcc3
                                      0x04e8fcc5
                                      0x04e8fcc7
                                      0x00000000
                                      0x04e8fcc9
                                      0x04e8fcc9
                                      0x04e8fccd
                                      0x00000000
                                      0x04e8fccd
                                      0x04e8fcc7
                                      0x00000000
                                      0x04e8fc4b
                                      0x04e8fc4b
                                      0x04e8fc4e
                                      0x04e8fc4e
                                      0x04e8fc51
                                      0x04e8fc51
                                      0x04e8fc54
                                      0x04e8fc5a
                                      0x04e8fc5c
                                      0x04e8fc5f
                                      0x04e8fc61
                                      0x04e8fc63
                                      0x04e8fc65
                                      0x04e8fc67
                                      0x04e8fc6e
                                      0x04e8fc72
                                      0x04e8fc72
                                      0x04e8fc72
                                      0x04e8fc72
                                      0x04e8fc67
                                      0x04e8fc61
                                      0x00000000
                                      0x04e8fc5a
                                      0x04e8fc49
                                      0x04e8fc41
                                      0x04e8fc30
                                      0x04e8fc27
                                      0x04e8fc03
                                      0x04e8fbcd
                                      0x04e8fbd3
                                      0x04e8fbd9
                                      0x04e8fbdc
                                      0x04e8fbde
                                      0x04e8fc99
                                      0x04e8fc9b
                                      0x04e8fc9d
                                      0x04e8fcd5
                                      0x04e8fcd5
                                      0x04e8fc89
                                      0x04e8fc89
                                      0x00000000
                                      0x04e8fc9f
                                      0x04e8fc9f
                                      0x04e8fca3
                                      0x00000000
                                      0x04e8fca3
                                      0x00000000
                                      0x04e8fbe4
                                      0x04e8fbe4
                                      0x04e8fbe4
                                      0x04e8fbe4
                                      0x04e8fbe9
                                      0x04e8fbf2
                                      0x00000000
                                      0x04e8fbf2
                                      0x04e8fbde
                                      0x04e8fbcb
                                      0x04e8fbab
                                      0x04e8fc8b
                                      0x04e8fc8b
                                      0x04e8fc8c
                                      0x04e8fb80
                                      0x04e8fb72
                                      0x04e8fb5e
                                      0x04e8fc8d
                                      0x04e8fc91
                                      0x04e8fadf
                                      0x04e8fadf
                                      0x04e8fae1
                                      0x04e8fae4
                                      0x04e8fae7
                                      0x04e8faec
                                      0x04e8faf8
                                      0x04e8fb00
                                      0x04e8fb07
                                      0x04e8fb0f
                                      0x04e8fb0f
                                      0x04e8fb07
                                      0x00000000
                                      0x04e8faf8
                                      0x04e8fadd

                                      Strings
                                      • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 04ECBE0F
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
                                      • API String ID: 0-865735534
                                      • Opcode ID: 26aac74459431b3af6e0d46ffad190751e693f59a3ef7c01b32e3e99acbdceac
                                      • Instruction ID: 675b41976ebbd338c4df324e160133ac23a78ef08f1febbed8579174e203cf56
                                      • Opcode Fuzzy Hash: 26aac74459431b3af6e0d46ffad190751e693f59a3ef7c01b32e3e99acbdceac
                                      • Instruction Fuzzy Hash: E1A1E471B00605CFEF25EF68C4507AAB7A5AF44718F0455ADE90EDB680EB34F942CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E52D8A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 63%
                                      			E04E52D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4f45350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4f47bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E04E997C0();
				}
				if( *0x4f479c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x4f479c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04E81624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04E77D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E04EEFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04E99520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E04E8E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L04EADF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4f46901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4f46901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04E99980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E04E995D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04E77D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04E77D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E04ED7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E04EEFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4f45350;
							if(_t109 != 0x4f45350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E04EEFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E04EE5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}




































                                      0x04e52d8a
                                      0x04e52d8a
                                      0x04e52d92
                                      0x04e52d96
                                      0x04e52d9e
                                      0x04e52da0
                                      0x04e52da3
                                      0x04e52da5
                                      0x04e52da8
                                      0x04e52dab
                                      0x04e52db2
                                      0x04eaf9aa
                                      0x04eaf9ab
                                      0x04eaf9ae
                                      0x04eaf9ae
                                      0x04e52db8
                                      0x04e52dc2
                                      0x04eaf9b9
                                      0x04eaf9be
                                      0x04eaf9bf
                                      0x04eaf9bf
                                      0x04e52dcf
                                      0x04eaf9c9
                                      0x04e52dd5
                                      0x04e52dd5
                                      0x04e52dd5
                                      0x04e52dde
                                      0x04e52de1
                                      0x04e52e70
                                      0x04e52e72
                                      0x04e52e72
                                      0x04e52de7
                                      0x04e52deb
                                      0x04e52e7c
                                      0x04e52e83
                                      0x04e52e85
                                      0x04e52e8b
                                      0x04e52e8d
                                      0x04e52e92
                                      0x04e52e92
                                      0x04e52e85
                                      0x04e52df1
                                      0x04e52df7
                                      0x04e52df9
                                      0x04e52df9
                                      0x04e52dfc
                                      0x04e52dff
                                      0x04e52e02
                                      0x00000000
                                      0x04e52e05
                                      0x04e52e0c
                                      0x04eaf9d9
                                      0x04e52e12
                                      0x04e52e12
                                      0x04e52e12
                                      0x04e52e1a
                                      0x04eaf9e3
                                      0x04eaf9e9
                                      0x04eaf9f0
                                      0x04eaf9f6
                                      0x04eaf9f8
                                      0x04eaf9f8
                                      0x04eaf9f0
                                      0x04e52e23
                                      0x04eafa02
                                      0x04eafa03
                                      0x04eafa05
                                      0x04eafa06
                                      0x00000000
                                      0x04e52e29
                                      0x04e52e29
                                      0x04e52e2e
                                      0x04e52e34
                                      0x04e52e3e
                                      0x00000000
                                      0x00000000
                                      0x04e52e44
                                      0x04e52e47
                                      0x04e52e4d
                                      0x00000000
                                      0x00000000
                                      0x04e52e4f
                                      0x04e52e54
                                      0x00000000
                                      0x00000000
                                      0x04e52e5a
                                      0x04e52e5f
                                      0x04e52e9a
                                      0x04e52ea4
                                      0x04e52ea5
                                      0x04e52ea8
                                      0x04e52eaf
                                      0x04e52eb2
                                      0x04e52eb5
                                      0x04eafae9
                                      0x04eafaeb
                                      0x04eafaed
                                      0x04eafaef
                                      0x04eafaf7
                                      0x04eafaf8
                                      0x04eafafd
                                      0x04eafaff
                                      0x04eafb04
                                      0x04eafb04
                                      0x04eafaff
                                      0x04e52ec0
                                      0x04e52ec4
                                      0x04e52ec6
                                      0x04e52ec8
                                      0x04eafb14
                                      0x04eafb18
                                      0x04eafb1e
                                      0x04eafb21
                                      0x04eafb21
                                      0x04e52ece
                                      0x04e52ece
                                      0x04e52ece
                                      0x04e52ed7
                                      0x04e52e61
                                      0x04e52e63
                                      0x04eafa6b
                                      0x04eafa71
                                      0x04eafa76
                                      0x04eafa78
                                      0x04eafa8a
                                      0x04eafa7a
                                      0x04eafa83
                                      0x04eafa83
                                      0x04eafa8f
                                      0x04eafa91
                                      0x04eafa97
                                      0x04eafa9d
                                      0x04eafaa4
                                      0x04eafaaa
                                      0x04eafaaf
                                      0x04eafab1
                                      0x04eafac3
                                      0x04eafab3
                                      0x04eafabc
                                      0x04eafabc
                                      0x04eafac8
                                      0x04eafacb
                                      0x04eafadf
                                      0x04eafadf
                                      0x04eafacb
                                      0x04eafaa4
                                      0x04eafa91
                                      0x04e52e6f
                                      0x04e52e6f
                                      0x04e52e5f
                                      0x04eafa13
                                      0x04eafa15
                                      0x04eafa17
                                      0x04eafa1f
                                      0x04eafa21
                                      0x04eafa22
                                      0x04eafa25
                                      0x04eafa28
                                      0x04eafa2f
                                      0x04eafa2f
                                      0x04eafa2a
                                      0x04eafa2a
                                      0x04eafa2a
                                      0x04eafa31
                                      0x04eafa34
                                      0x04eafa36
                                      0x04eafa3c
                                      0x04eafa3e
                                      0x04eafa41
                                      0x04eafa43
                                      0x04eafa45
                                      0x04eafa45
                                      0x04eafa41
                                      0x04eafa3c
                                      0x04eafa4a
                                      0x04eafa4f
                                      0x04eafa51
                                      0x04eafa53
                                      0x04eafa56
                                      0x04eafa5b
                                      0x04eafa5e
                                      0x00000000
                                      0x04eafa5e
                                      0x04e52e23

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: RTL: Re-Waiting
                                      • API String ID: 0-316354757
                                      • Opcode ID: 50e7d4976cbb9d9eca2456e8012d672ab7579f4288c805909704cc281e991ed1
                                      • Instruction ID: 9763d2a2ac52fe90ce6468a9034e026eaa5f76aded1154b56e092f628b8d839c
                                      • Opcode Fuzzy Hash: 50e7d4976cbb9d9eca2456e8012d672ab7579f4288c805909704cc281e991ed1
                                      • Instruction Fuzzy Hash: 15612731B00644AFEB32DF68C880BBE77E5EB4431CF142699DA519B2D0DB34BD418B91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F20EA5 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 80%
                                      			E04F20EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E04F1FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04F21074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04E99730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E04F1A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E04F1A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4f48b04 >> 0x14) + (_v44 -  *0x4f48b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04E77D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E04F1138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04E77D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E04F0FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4f48724 & 0x00000008) != 0) {
						E04F152F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E04F215B5(0x4f48ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}
























                                      0x04f20eb7
                                      0x04f20eb9
                                      0x04f20ec0
                                      0x04f20ec2
                                      0x04f20ecd
                                      0x04f2105b
                                      0x04f2105b
                                      0x04f21061
                                      0x04f21066
                                      0x04f21066
                                      0x04f2106b
                                      0x04f21073
                                      0x04f21073
                                      0x04f20ed3
                                      0x04f20ed6
                                      0x04f20edc
                                      0x04f20ee0
                                      0x04f20ee7
                                      0x04f20ef0
                                      0x04f20ef5
                                      0x04f20efa
                                      0x04f20efc
                                      0x04f20efd
                                      0x04f20f03
                                      0x04f20f04
                                      0x04f20f06
                                      0x04f20f07
                                      0x04f20f09
                                      0x04f20f0e
                                      0x04f20f14
                                      0x04f20f23
                                      0x04f20f2d
                                      0x04f20f34
                                      0x04f20f34
                                      0x04f20f14
                                      0x04f20f52
                                      0x00000000
                                      0x00000000
                                      0x04f20f58
                                      0x04f20f73
                                      0x04f20f74
                                      0x04f20f79
                                      0x04f20f7d
                                      0x04f20f80
                                      0x04f20f86
                                      0x04f20fab
                                      0x04f20fb5
                                      0x04f20fc6
                                      0x04f20fd1
                                      0x04f20fe3
                                      0x04f20fd3
                                      0x04f20fdc
                                      0x04f20fdc
                                      0x04f20feb
                                      0x04f21009
                                      0x04f21009
                                      0x04f21015
                                      0x04f21027
                                      0x04f21017
                                      0x04f21020
                                      0x04f21020
                                      0x04f2102f
                                      0x04f2103c
                                      0x04f2103c
                                      0x04f21048
                                      0x04f21050
                                      0x04f21050
                                      0x04f21055
                                      0x00000000
                                      0x04f21055
                                      0x04f20f88
                                      0x04f20f9e
                                      0x04f20fa2
                                      0x04f20fa9
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04f20fa9
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: `
                                      • API String ID: 0-2679148245
                                      • Opcode ID: 104c4b61a1476b99b76666baebceb7b6c2583766fcb4a49b937ce18df6352ae3
                                      • Instruction ID: c02eaffad5470d58f8e9091ae727d6e02f80b905d3e951ac720662e8936f9c5f
                                      • Opcode Fuzzy Hash: 104c4b61a1476b99b76666baebceb7b6c2583766fcb4a49b937ce18df6352ae3
                                      • Instruction Fuzzy Hash: DD51BE716043929FE324DF28DA80B1BB7E5FBC4314F044A2DF98697290DA71F806CB66
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8F0BF Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 76%
                                      			E04E8F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04E74120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04E99830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04E99990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E04E995D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x3e1ce81a
							_t109 = L04E74620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x20033e1c
								E04E9F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x20033e1c
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E04E995D0();
										L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

























                                      0x04e8f0d3
                                      0x04e8f0d9
                                      0x04e8f0e0
                                      0x04e8f0e7
                                      0x04e8f0f2
                                      0x04e8f0f4
                                      0x04e8f0f8
                                      0x04e8f100
                                      0x04e8f108
                                      0x04e8f10d
                                      0x04e8f115
                                      0x04e8f116
                                      0x04e8f11f
                                      0x04e8f123
                                      0x04e8f124
                                      0x04e8f12c
                                      0x04e8f130
                                      0x04e8f134
                                      0x04e8f13d
                                      0x04e8f144
                                      0x04e8f14b
                                      0x04e8f152
                                      0x04ecbab0
                                      0x04ecbab0
                                      0x04e8f158
                                      0x04e8f158
                                      0x04e8f15a
                                      0x04e8f160
                                      0x04e8f165
                                      0x04e8f166
                                      0x04e8f16f
                                      0x04e8f173
                                      0x04ecbaa7
                                      0x04ecbaa7
                                      0x04ecbaab
                                      0x00000000
                                      0x04e8f179
                                      0x04e8f179
                                      0x04e8f18d
                                      0x04e8f191
                                      0x04ecbaa2
                                      0x00000000
                                      0x04e8f197
                                      0x04e8f19b
                                      0x04e8f1a2
                                      0x04e8f1a9
                                      0x04e8f1af
                                      0x04e8f1b2
                                      0x04e8f1b6
                                      0x04e8f1b9
                                      0x04e8f1c0
                                      0x04e8f1c4
                                      0x04e8f1d8
                                      0x04e8f1df
                                      0x04e8f1e3
                                      0x04e8f1e6
                                      0x04e8f1eb
                                      0x04e8f1ee
                                      0x04e8f1f4
                                      0x04e8f20f
                                      0x04ecbab7
                                      0x04ecbabb
                                      0x04ecbacc
                                      0x04ecbad1
                                      0x04e8f215
                                      0x04e8f218
                                      0x04e8f226
                                      0x04e8f22b
                                      0x00000000
                                      0x04e8f22b
                                      0x04e8f1f6
                                      0x04e8f1f6
                                      0x04e8f1f9
                                      0x04e8f1fb
                                      0x04e8f1fb
                                      0x04e8f1f4
                                      0x04e8f191
                                      0x04e8f173
                                      0x04e8f152
                                      0x04e8f203

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: @
                                      • API String ID: 0-2766056989
                                      • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                      • Instruction ID: f04dd798a6b52aab2524d7f034fb866c71fe198078731d7563618c7245d2e280
                                      • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                      • Instruction Fuzzy Hash: 7C519D71604710AFD320DF29C841A6BBBF8FF48714F009A2EF99987690E7B4E915CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED3540 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 75%
                                      			E04ED3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x4f4d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04E90BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E04ED3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E04E9FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E04ED3540;
						E04E9FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E04EADDD0( &_v1072, _t75, _t79, _t80, _t81);
						E04EE0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E04E997C0();
					}
					return E04E9B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E04ED3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E04ED3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E04E9FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04E99650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E04ED3787(_a4,  &_v352, _t80);
						}
					}
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E04E995D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}































                                      0x04ed3552
                                      0x04ed355a
                                      0x04ed355d
                                      0x04ed3566
                                      0x04ed3567
                                      0x04ed357e
                                      0x04ed358f
                                      0x04ed35a1
                                      0x04ed35a5
                                      0x04ed366b
                                      0x04ed366b
                                      0x04ed366d
                                      0x04ed3672
                                      0x04ed3679
                                      0x04ed3685
                                      0x04ed368d
                                      0x04ed369d
                                      0x04ed36a7
                                      0x04ed36b8
                                      0x04ed36c6
                                      0x04ed36c7
                                      0x04ed36dc
                                      0x04ed36e1
                                      0x04ed36e7
                                      0x04ed36e9
                                      0x04ed36e9
                                      0x04ed3703
                                      0x04ed3703
                                      0x04ed35b5
                                      0x04ed35c0
                                      0x04ed35c4
                                      0x00000000
                                      0x00000000
                                      0x04ed35ca
                                      0x04ed35d7
                                      0x04ed35e2
                                      0x04ed35e6
                                      0x04ed35e8
                                      0x04ed35f5
                                      0x04ed35fa
                                      0x04ed3603
                                      0x04ed3604
                                      0x04ed3609
                                      0x04ed360a
                                      0x04ed3612
                                      0x04ed3613
                                      0x04ed361e
                                      0x04ed3622
                                      0x04ed3628
                                      0x04ed362f
                                      0x04ed362f
                                      0x04ed3636
                                      0x04ed3638
                                      0x04ed363b
                                      0x04ed3642
                                      0x04ed3642
                                      0x04ed3636
                                      0x04ed3657
                                      0x04ed3657
                                      0x04ed365c
                                      0x04ed3662
                                      0x04ed3669
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: BinaryHash
                                      • API String ID: 2994545307-2202222882
                                      • Opcode ID: c11565f9727139f7df5bebad80874029ca98201a21706365463d92786397991d
                                      • Instruction ID: c87ab060ebaf31a68c0267ff4968f46751123e65f1e4b24294ea2bf0b5f01092
                                      • Opcode Fuzzy Hash: c11565f9727139f7df5bebad80874029ca98201a21706365463d92786397991d
                                      • Instruction Fuzzy Hash: CA4133F1D0052C9EEF21DB50CC81FAEB77CAB44718F0055A5AA19AB240DB70AE89CF95
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED3884 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 72%
                                      			E04ED3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04E99650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04E74620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04E99650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}















                                      0x04ed3893
                                      0x04ed3896
                                      0x04ed3899
                                      0x04ed389f
                                      0x04ed38a0
                                      0x04ed38a4
                                      0x04ed38a9
                                      0x04ed38ac
                                      0x04ed38ad
                                      0x04ed38ae
                                      0x04ed38af
                                      0x04ed38b1
                                      0x04ed38b4
                                      0x04ed38bb
                                      0x04ed38bc
                                      0x04ed38bd
                                      0x04ed38c4
                                      0x04ed38c8
                                      0x04ed38ca
                                      0x04ed38ca
                                      0x04ed38d5
                                      0x04ed393e
                                      0x04ed3940
                                      0x04ed3942
                                      0x04ed3952
                                      0x04ed3954
                                      0x04ed3961
                                      0x04ed3961
                                      0x04ed3967
                                      0x04ed396e
                                      0x04ed396e
                                      0x04ed3947
                                      0x04ed394c
                                      0x00000000
                                      0x04ed394c
                                      0x04ed38ea
                                      0x04ed38ee
                                      0x04ed38f8
                                      0x04ed38f9
                                      0x04ed38ff
                                      0x04ed3900
                                      0x04ed3902
                                      0x04ed3903
                                      0x04ed390b
                                      0x04ed390f
                                      0x04ed3950
                                      0x00000000
                                      0x04ed3950
                                      0x04ed3915
                                      0x04ed391d
                                      0x04ed391d
                                      0x04ed3922
                                      0x04ed3926
                                      0x00000000
                                      0x04ed3928
                                      0x04ed392b
                                      0x04ed392b
                                      0x04ed3935
                                      0x04ed3937
                                      0x04ed3937
                                      0x00000000
                                      0x04ed3935
                                      0x04ed3926
                                      0x04ed38f0
                                      0x00000000

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID: BinaryName
                                      • API String ID: 2994545307-215506332
                                      • Opcode ID: ff6351ec849e759c29ab028440c327db00795c632d82d1495bfbafba2b84f90f
                                      • Instruction ID: 5756d47c9cbc502094e94ae239a4ac4ffb6593f03d9e2719b68fbc46c4775214
                                      • Opcode Fuzzy Hash: ff6351ec849e759c29ab028440c327db00795c632d82d1495bfbafba2b84f90f
                                      • Instruction Fuzzy Hash: 45310376D00509AFEB25DB58C945EAFB7B4EB80B24F115169EC04A7688D730BE02C7A2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8D294 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 33%
                                      			E04E8D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4f4d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04E74120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E04E9B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E04E998D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E04E995D0();
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

































                                      0x04e8d29c
                                      0x04e8d2a6
                                      0x04e8d2b1
                                      0x04e8d2b5
                                      0x04e8d2b6
                                      0x04e8d2bc
                                      0x04e8d2bd
                                      0x04e8d2be
                                      0x04e8d2bf
                                      0x04e8d2c2
                                      0x04e8d2c4
                                      0x04e8d2cc
                                      0x04e8d384
                                      0x04e8d34b
                                      0x04e8d34f
                                      0x04e8d350
                                      0x04e8d351
                                      0x04e8d35c
                                      0x04e8d35c
                                      0x04e8d2d6
                                      0x04e8d2da
                                      0x04e8d2e1
                                      0x04e8d361
                                      0x04e8d369
                                      0x04e8d36d
                                      0x04e8d2e3
                                      0x04e8d2e3
                                      0x04e8d2e3
                                      0x04e8d2e5
                                      0x04e8d2ed
                                      0x04e8d2f5
                                      0x04e8d2fa
                                      0x04e8d302
                                      0x04e8d303
                                      0x04e8d30b
                                      0x04e8d30f
                                      0x04e8d313
                                      0x04e8d318
                                      0x04e8d31c
                                      0x04e8d320
                                      0x04e8d379
                                      0x04e8d37d
                                      0x00000000
                                      0x00000000
                                      0x04ecaffe
                                      0x04ecb001
                                      0x04ecb011
                                      0x00000000
                                      0x04e8d322
                                      0x04e8d322
                                      0x04e8d330
                                      0x04e8d337
                                      0x04e8d35d
                                      0x04e8d339
                                      0x04e8d33f
                                      0x04e8d38c
                                      0x04e8d38c
                                      0x04e8d33f
                                      0x04e8d349
                                      0x00000000
                                      0x04e8d349

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: @
                                      • API String ID: 0-2766056989
                                      • Opcode ID: f79bdc3099e6d0c4018e3ac09f6c78c9ff765b9d26d563d0333ea4819bd6d6db
                                      • Instruction ID: b49a561ec315c26ff088d2fe1f62a7f497f0a32465046722ebae39669f7968b3
                                      • Opcode Fuzzy Hash: f79bdc3099e6d0c4018e3ac09f6c78c9ff765b9d26d563d0333ea4819bd6d6db
                                      • Instruction Fuzzy Hash: 1E3186B16483059FDB11EF18C980DABBBE8EB85754F00192EF59C93290E638ED05DB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E61B8F Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 72%
                                      			E04E61B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E04E9BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E04E9A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E04E9A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04E74620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}









                                      0x04e61b8f
                                      0x04e61b9a
                                      0x04e61b9c
                                      0x04e61b9e
                                      0x04e61ba3
                                      0x04eb7010
                                      0x04eb7010
                                      0x00000000
                                      0x04e61ba9
                                      0x04e61ba9
                                      0x04e61bae
                                      0x00000000
                                      0x04e61bc5
                                      0x04e61bca
                                      0x04e61bcf
                                      0x04e61bd0
                                      0x04e61bd1
                                      0x04e61bd2
                                      0x04e61bd6
                                      0x04e61bdc
                                      0x04e61be0
                                      0x04eb6ffc
                                      0x04eb7000
                                      0x00000000
                                      0x04eb7006
                                      0x04eb7009
                                      0x04eb7009
                                      0x04e61be6
                                      0x04e61bec
                                      0x04e61c0b
                                      0x04e61c0b
                                      0x04e61c0c
                                      0x04e61c11
                                      0x04e61c12
                                      0x04e61c15
                                      0x04e61c1b
                                      0x04e61c1f
                                      0x04e61c31
                                      0x04e61c33
                                      0x04eb7026
                                      0x04eb7026
                                      0x04e61c21
                                      0x04e61c24
                                      0x04e61c24
                                      0x04e61bee
                                      0x04e61bee
                                      0x04e61bf2
                                      0x04e61c3a
                                      0x04e61bf4
                                      0x04e61bf4
                                      0x04e61c05
                                      0x04e61c05
                                      0x04e61c09
                                      0x04e61c3e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e61c09
                                      0x04e61bec
                                      0x04e61be0
                                      0x04e61bae
                                      0x04e61c2e

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: WindowsExcludedProcs
                                      • API String ID: 0-3583428290
                                      • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                      • Instruction ID: 15e514dedf3858c145ce57f1c95acd42575888f514c00ab28d206c5df361bd0a
                                      • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                      • Instruction Fuzzy Hash: B921F836641518ABDB26DF958840F9FF7ADAF80795F055466F9058B600E630FD00D7E1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7F716 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E7F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}











                                      0x04e7f71d
                                      0x04e7f722
                                      0x04e7f726
                                      0x04ec4770
                                      0x04e7f765
                                      0x04e7f769
                                      0x04e7f769
                                      0x04e7f732
                                      0x04ec477a
                                      0x00000000
                                      0x04ec477a
                                      0x04e7f738
                                      0x04e7f73a
                                      0x04e7f73c
                                      0x04e7f73f
                                      0x04e7f746
                                      0x04e7f778
                                      0x04e7f7a9
                                      0x04e7f7a9
                                      0x04e7f754
                                      0x04e7f75a
                                      0x04e7f75d
                                      0x04e7f75f
                                      0x04e7f761
                                      0x04e7f76f
                                      0x04e7f771
                                      0x04e7f771
                                      0x04e7f76f
                                      0x04e7f763
                                      0x00000000
                                      0x04e7f763
                                      0x04e7f77d
                                      0x04e7f7a3
                                      0x04e7f7a5
                                      0x00000000
                                      0x04e7f7a5
                                      0x04e7f77f
                                      0x04e7f782
                                      0x04e7f784
                                      0x04e7f786
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e7f788
                                      0x04e7f748
                                      0x04e7f74d
                                      0x04e7f78d
                                      0x04e7f793
                                      0x04e7f7b7
                                      0x04e7f7bc
                                      0x00000000
                                      0x04e7f7bc
                                      0x04e7f798
                                      0x00000000
                                      0x00000000
                                      0x04e7f79d
                                      0x04e7f7b0
                                      0x00000000
                                      0x04e7f7b0
                                      0x04e7f79f
                                      0x00000000
                                      0x04e7f74f
                                      0x04e7f74f
                                      0x00000000
                                      0x04e7f74f

                                      Strings
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Actx
                                      • API String ID: 0-89312691
                                      • Opcode ID: 0ffb1447e0ed74c2a65d42fd1f00d88434b23b7713f78a7cf88de1ca2841a8da
                                      • Instruction ID: 3c760d6c03a96ea6587c4845cb28d3bf6424b73676f80a60a0df45b7eda9617d
                                      • Opcode Fuzzy Hash: 0ffb1447e0ed74c2a65d42fd1f00d88434b23b7713f78a7cf88de1ca2841a8da
                                      • Instruction Fuzzy Hash: BC11C4357287028BEB244F1DC9917B67295EF85738F24653EE461CB395EB70F841A740
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F08DF1 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 71%
                                      			E04F08DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4f30d50);
				E04EAD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E04EE5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L04EADEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L04EADEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E04EAD130(_t34, _t39, _t40);
			}





                                      0x04f08df1
                                      0x04f08df1
                                      0x04f08df1
                                      0x04f08df1
                                      0x04f08df1
                                      0x04f08df1
                                      0x04f08df3
                                      0x04f08df8
                                      0x04f08dfd
                                      0x04f08e00
                                      0x04f08e0e
                                      0x04f08e2a
                                      0x04f08e36
                                      0x04f08e38
                                      0x04f08e3c
                                      0x04f08e46
                                      0x04f08e46
                                      0x04f08e36
                                      0x04f08e50
                                      0x04f08e56
                                      0x04f08e59
                                      0x04f08e5c
                                      0x04f08e60
                                      0x04f08e67
                                      0x04f08e6d
                                      0x04f08e73
                                      0x04f08e74
                                      0x04f08eb1
                                      0x04f08ebd

                                      Strings
                                      • Critical error detected %lx, xrefs: 04F08E21
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Critical error detected %lx
                                      • API String ID: 0-802127002
                                      • Opcode ID: d7d9c74e06c370f61c1c89de68e6b629e8918746cb075a45b73558e1da659fb4
                                      • Instruction ID: 8f9a7e985672f37a04f1a96fdd208851461b0f3c40ea163d0272b683766f7575
                                      • Opcode Fuzzy Hash: d7d9c74e06c370f61c1c89de68e6b629e8918746cb075a45b73558e1da659fb4
                                      • Instruction Fuzzy Hash: 251187B1D10348EBEF24DFA88905BDDBBB1BB44358F20921ED428AB2C2C7306602DF14
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EEFF10 Relevance: 1.3, Strings: 1, Instructions: 44COMMON
                                      Download Yara Rule
                                      Strings
                                      • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 04EEFF60
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                      • API String ID: 0-1911121157
                                      • Opcode ID: a9acbce6209071d2af1b60b623cf7f641a62adc513434b060d597b31554a90ac
                                      • Instruction ID: 8f932c2eae7059230c6c6bd4ab87210109a384be7e90e0bf5e045847bb991348
                                      • Opcode Fuzzy Hash: a9acbce6209071d2af1b60b623cf7f641a62adc513434b060d597b31554a90ac
                                      • Instruction Fuzzy Hash: 37118B75950148EFEB22EB50C948FA8BBB2FF48708F149454E5086A6A1CB79B950CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F25BA5 Relevance: .6, Instructions: 592COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 88%
                                      			E04F25BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4f31178);
				E04EAD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04F24C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E04E9D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04F25542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x4f460e8;
								if( *0x4f460e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x4f460e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04E99710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04E96DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E04E9F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E04E9F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E04E9F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E04E9FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E04E9FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E04E9F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E04E9F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04F24CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E04EAD130(_t427, _t494, _t511);
				}
			}










































































                                      0x04f25ba5
                                      0x04f25baa
                                      0x04f25baf
                                      0x04f25bb4
                                      0x04f25bb6
                                      0x04f25bbc
                                      0x04f25bbe
                                      0x04f25bc4
                                      0x04f25bcd
                                      0x04f25bd3
                                      0x04f25bd6
                                      0x04f25bdc
                                      0x04f25be0
                                      0x04f25be3
                                      0x04f25beb
                                      0x04f25bf2
                                      0x04f25bf8
                                      0x04f25bfe
                                      0x04f25c04
                                      0x04f25c0e
                                      0x04f25c18
                                      0x04f25c1f
                                      0x04f25c25
                                      0x04f25c2a
                                      0x04f25c2c
                                      0x04f25c32
                                      0x04f25c3a
                                      0x04f25c3f
                                      0x04f25c42
                                      0x04f25c48
                                      0x04f25c5b
                                      0x04f25c5b
                                      0x04f25c2c
                                      0x04f25cb7
                                      0x04f25cb9
                                      0x04f25cbf
                                      0x04f25cc2
                                      0x04f25cca
                                      0x04f25ccb
                                      0x04f25ccb
                                      0x04f25cd1
                                      0x04f25cd7
                                      0x04f25cda
                                      0x04f25ce1
                                      0x04f25ce4
                                      0x04f25ce7
                                      0x04f25ced
                                      0x04f25cf3
                                      0x04f25cf9
                                      0x04f25cff
                                      0x04f25d08
                                      0x04f25d0a
                                      0x04f25d0e
                                      0x04f25d10
                                      0x00000000
                                      0x00000000
                                      0x04f25d16
                                      0x04f25d1a
                                      0x00000000
                                      0x00000000
                                      0x04f25d20
                                      0x04f25d22
                                      0x04f25d25
                                      0x04f25d2f
                                      0x04f25d2f
                                      0x04f25d33
                                      0x04f25d3d
                                      0x04f25d49
                                      0x04f25d4b
                                      0x00000000
                                      0x00000000
                                      0x04f25d5a
                                      0x04f25d5d
                                      0x04f25d60
                                      0x00000000
                                      0x00000000
                                      0x04f25d66
                                      0x04f25d69
                                      0x00000000
                                      0x00000000
                                      0x04f25d6f
                                      0x04f25d6f
                                      0x04f25d73
                                      0x04f25d79
                                      0x04f25d7f
                                      0x04f25d86
                                      0x04f25d95
                                      0x04f25d98
                                      0x04f25dba
                                      0x04f25dcb
                                      0x04f25dce
                                      0x04f25dd3
                                      0x04f25dd6
                                      0x04f25dd8
                                      0x04f25de6
                                      0x04f25dec
                                      0x04f25dee
                                      0x04f25df1
                                      0x04f25df3
                                      0x04f2635a
                                      0x04f2635a
                                      0x00000000
                                      0x04f2635a
                                      0x04f25dfe
                                      0x04f25e02
                                      0x04f25e05
                                      0x04f25e07
                                      0x04f25e10
                                      0x04f25e13
                                      0x04f25e1b
                                      0x04f25e1c
                                      0x04f25e21
                                      0x04f25e22
                                      0x04f25e23
                                      0x04f25e25
                                      0x04f25e2a
                                      0x04f25e2c
                                      0x04f25e2e
                                      0x04f25e36
                                      0x04f25e39
                                      0x04f25e42
                                      0x04f25e47
                                      0x04f25e4d
                                      0x04f25e54
                                      0x04f25e54
                                      0x04f25e54
                                      0x04f25e2e
                                      0x04f25e5c
                                      0x04f25e5f
                                      0x04f25e62
                                      0x04f25e64
                                      0x04f25e6b
                                      0x04f25e70
                                      0x04f25e7a
                                      0x04f25e7a
                                      0x04f25e7a
                                      0x04f25e6b
                                      0x04f25e7e
                                      0x04f25e7f
                                      0x04f25e7f
                                      0x04f25e81
                                      0x04f25e87
                                      0x04f25e8b
                                      0x04f25e8c
                                      0x04f25e8c
                                      0x04f25e8c
                                      0x04f25e9a
                                      0x04f25e9c
                                      0x04f25ea2
                                      0x04f25ea6
                                      0x04f25f50
                                      0x04f25f50
                                      0x04f25f57
                                      0x04f25f66
                                      0x04f25f66
                                      0x04f25f66
                                      0x04f25f68
                                      0x04f25f6a
                                      0x04f263d0
                                      0x00000000
                                      0x04f25f70
                                      0x04f25f70
                                      0x04f25f91
                                      0x04f25f9c
                                      0x04f25f9e
                                      0x04f25fa4
                                      0x04f25fa6
                                      0x04f2638c
                                      0x04f26392
                                      0x04f263a1
                                      0x04f263a7
                                      0x04f263af
                                      0x04f263af
                                      0x04f263bd
                                      0x04f263d8
                                      0x00000000
                                      0x04f263d8
                                      0x04f25fac
                                      0x04f25fb2
                                      0x04f25fb4
                                      0x04f25fbd
                                      0x04f25fc6
                                      0x04f25fce
                                      0x04f25fd4
                                      0x04f25fdc
                                      0x04f25fec
                                      0x04f25fed
                                      0x04f25fee
                                      0x04f25fef
                                      0x04f25ff9
                                      0x04f25ffa
                                      0x04f25ffb
                                      0x04f25ffc
                                      0x04f26000
                                      0x04f26004
                                      0x04f26012
                                      0x04f26012
                                      0x04f26018
                                      0x04f26019
                                      0x04f2601a
                                      0x04f2601b
                                      0x04f2601c
                                      0x04f26020
                                      0x04f26059
                                      0x04f2605c
                                      0x04f26061
                                      0x04f26061
                                      0x04f26022
                                      0x04f26022
                                      0x04f26022
                                      0x04f26025
                                      0x04f2602a
                                      0x04f2602b
                                      0x04f26031
                                      0x04f26037
                                      0x04f26038
                                      0x04f2603e
                                      0x04f26048
                                      0x04f26049
                                      0x04f2604a
                                      0x04f2604b
                                      0x04f2604c
                                      0x04f2604d
                                      0x04f26053
                                      0x04f26054
                                      0x04f26054
                                      0x04f26062
                                      0x04f26065
                                      0x04f26067
                                      0x04f2606a
                                      0x04f26070
                                      0x04f26075
                                      0x04f26076
                                      0x04f26081
                                      0x04f26087
                                      0x04f26095
                                      0x04f26099
                                      0x04f2609e
                                      0x04f260a4
                                      0x04f260ae
                                      0x04f260b0
                                      0x04f260b3
                                      0x04f260b6
                                      0x04f260b8
                                      0x04f260ba
                                      0x04f260ba
                                      0x04f260ba
                                      0x04f260ba
                                      0x04f260be
                                      0x04f260c0
                                      0x04f260c5
                                      0x04f260c5
                                      0x04f260c5
                                      0x04f260c6
                                      0x04f260cd
                                      0x04f26114
                                      0x04f260cf
                                      0x04f260cf
                                      0x04f260d4
                                      0x04f260d5
                                      0x04f260da
                                      0x04f260db
                                      0x04f260e1
                                      0x04f260e2
                                      0x04f260e8
                                      0x04f260f8
                                      0x04f260fd
                                      0x04f260fe
                                      0x04f26102
                                      0x04f26104
                                      0x04f26107
                                      0x04f26109
                                      0x04f2610b
                                      0x04f2610b
                                      0x04f2610b
                                      0x04f2610b
                                      0x04f2610f
                                      0x04f2610f
                                      0x04f26117
                                      0x04f2611a
                                      0x04f2611f
                                      0x04f26125
                                      0x04f26134
                                      0x04f26139
                                      0x04f2613f
                                      0x04f26146
                                      0x04f26148
                                      0x04f2614b
                                      0x04f2614d
                                      0x04f2614f
                                      0x04f2614f
                                      0x04f2614f
                                      0x04f2614f
                                      0x04f26153
                                      0x04f26159
                                      0x04f26159
                                      0x04f2615c
                                      0x04f26163
                                      0x04f26169
                                      0x04f2616c
                                      0x04f26172
                                      0x04f26181
                                      0x04f26186
                                      0x04f26187
                                      0x04f2618b
                                      0x04f26191
                                      0x04f26195
                                      0x04f261a3
                                      0x04f261bb
                                      0x04f261c0
                                      0x04f261c3
                                      0x04f261cc
                                      0x04f261d0
                                      0x04f261dc
                                      0x04f261de
                                      0x04f261e1
                                      0x04f261e4
                                      0x04f261e6
                                      0x04f261e8
                                      0x04f261e8
                                      0x04f261e8
                                      0x04f261e8
                                      0x04f261e6
                                      0x04f261ec
                                      0x04f261f3
                                      0x04f26203
                                      0x04f26209
                                      0x04f2620a
                                      0x04f26216
                                      0x04f2621d
                                      0x04f26227
                                      0x04f26241
                                      0x04f26246
                                      0x04f2624c
                                      0x04f26257
                                      0x04f26259
                                      0x04f2625c
                                      0x04f2625e
                                      0x04f26260
                                      0x04f26260
                                      0x04f26260
                                      0x04f26260
                                      0x04f2625e
                                      0x04f26264
                                      0x04f26267
                                      0x04f26269
                                      0x04f26315
                                      0x04f26315
                                      0x04f2631b
                                      0x04f2631e
                                      0x04f26324
                                      0x04f26327
                                      0x04f2632f
                                      0x04f26330
                                      0x04f26333
                                      0x04f2633a
                                      0x04f2633c
                                      0x04f26335
                                      0x04f26335
                                      0x04f26335
                                      0x04f2633f
                                      0x04f26342
                                      0x04f2634c
                                      0x04f26352
                                      0x04f26355
                                      0x04f26355
                                      0x04f26359
                                      0x00000000
                                      0x04f2626f
                                      0x04f26275
                                      0x04f26275
                                      0x04f26278
                                      0x04f2627e
                                      0x04f2627e
                                      0x04f26281
                                      0x04f26287
                                      0x04f2628d
                                      0x04f26298
                                      0x04f2629c
                                      0x04f262a2
                                      0x04f2629e
                                      0x04f2629e
                                      0x04f2629e
                                      0x04f262a7
                                      0x04f262a7
                                      0x04f262aa
                                      0x04f262b0
                                      0x04f262f0
                                      0x04f262f0
                                      0x04f262f2
                                      0x04f262f8
                                      0x04f262fd
                                      0x04f262b2
                                      0x04f262b2
                                      0x04f262b2
                                      0x04f262b5
                                      0x04f262dd
                                      0x04f262e2
                                      0x04f262e5
                                      0x04f262b7
                                      0x04f262b8
                                      0x04f262bb
                                      0x04f262bd
                                      0x04f262c0
                                      0x04f262c4
                                      0x04f262cd
                                      0x04f262cd
                                      0x04f262c0
                                      0x04f262bb
                                      0x04f262b5
                                      0x04f26302
                                      0x04f26303
                                      0x04f26305
                                      0x04f26305
                                      0x04f26305
                                      0x04f2630c
                                      0x04f2630c
                                      0x00000000
                                      0x04f2627e
                                      0x04f26269
                                      0x04f25eac
                                      0x04f25ebb
                                      0x04f25ebe
                                      0x04f25ecb
                                      0x04f25ecb
                                      0x04f25ece
                                      0x04f25ece
                                      0x04f25ed4
                                      0x04f25ed7
                                      0x04f25ed9
                                      0x04f25edb
                                      0x04f25edb
                                      0x04f25ee1
                                      0x04f25ee1
                                      0x04f25ee3
                                      0x04f25f20
                                      0x04f25f20
                                      0x04f25ee5
                                      0x04f25ee5
                                      0x04f25ee5
                                      0x04f25ee8
                                      0x04f25f11
                                      0x04f25f18
                                      0x04f25eea
                                      0x04f25eea
                                      0x04f25eed
                                      0x04f25ef2
                                      0x04f25ef8
                                      0x04f25efb
                                      0x04f25f0a
                                      0x04f25f0a
                                      0x04f25eed
                                      0x04f25ee8
                                      0x04f25f22
                                      0x04f25f28
                                      0x00000000
                                      0x00000000
                                      0x04f25f30
                                      0x04f25f31
                                      0x04f25f37
                                      0x04f25f3a
                                      0x04f25f3d
                                      0x04f25f44
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04f25f46
                                      0x04f25f48
                                      0x04f25f4d
                                      0x00000000
                                      0x04f25f4d
                                      0x04f25dda
                                      0x04f25ddf
                                      0x00000000
                                      0x04f25ddf
                                      0x04f25dd8
                                      0x04f25da7
                                      0x04f25da9
                                      0x04f25dac
                                      0x04f25dae
                                      0x00000000
                                      0x04f25db4
                                      0x04f25db4
                                      0x00000000
                                      0x04f25db4
                                      0x04f25dae
                                      0x04f25d88
                                      0x04f25d8d
                                      0x04f26363
                                      0x04f26369
                                      0x04f2636a
                                      0x04f26370
                                      0x04f26372
                                      0x04f2637a
                                      0x04f2637b
                                      0x04f2637d
                                      0x00000000
                                      0x00000000
                                      0x04f2637f
                                      0x04f26385
                                      0x00000000
                                      0x04f26385
                                      0x04f25d38
                                      0x04f25d3b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04f25d3b
                                      0x04f25d27
                                      0x04f25d29
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04f26360
                                      0x00000000
                                      0x04f26360
                                      0x04f25c10
                                      0x04f25c10
                                      0x04f263da
                                      0x04f263e5
                                      0x04f263e5

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7a542679dcb07f3919f8b17800ac01128fe4e4d4a25534a428012e855a19b1ff
                                      • Instruction ID: 12e93294ac55d7367aec42ff426f9581c7fb9ce30e8b02d6a00a9ccdba82066d
                                      • Opcode Fuzzy Hash: 7a542679dcb07f3919f8b17800ac01128fe4e4d4a25534a428012e855a19b1ff
                                      • Instruction Fuzzy Hash: 46422B75D00269DFEB24CF68C980BA9B7B1FF45304F1481AAD94DEB241E774A986CF50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E74120 Relevance: .4, Instructions: 444COMMONCrypto
                                      Download Yara Rule
                                      C-Code - Quality: 92%
                                      			E04E74120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x4f4d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E04E8F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04E76E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04E74620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04E76E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M04E745F8))) {
												case 0:
													_v568 = 0x4e31078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x4e311c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04E74620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E04E9F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E04E9F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E04E552A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E04E6EB70(1, 0x4f479a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E04E6AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E04E995D0();
																			L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E04E9B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04E93D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E04E9B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}















































































                                      0x04e74128
                                      0x04e74135
                                      0x04e7413c
                                      0x04e74141
                                      0x04e74145
                                      0x04e74147
                                      0x04e7414e
                                      0x04e74151
                                      0x04e74159
                                      0x04e7415c
                                      0x04e74160
                                      0x04e74164
                                      0x04e74168
                                      0x04e7416c
                                      0x04e7417f
                                      0x04e74181
                                      0x04e7446a
                                      0x04e7446a
                                      0x04e7418c
                                      0x04e74195
                                      0x04e74199
                                      0x04e74432
                                      0x04e74439
                                      0x04e7443d
                                      0x04e74442
                                      0x04e74447
                                      0x00000000
                                      0x04e7419f
                                      0x04e741a3
                                      0x04e741b1
                                      0x04e741b9
                                      0x04e741bd
                                      0x04e745db
                                      0x04e745db
                                      0x00000000
                                      0x04e741c3
                                      0x04e741c3
                                      0x04e741ce
                                      0x04e741d4
                                      0x04ebe138
                                      0x04ebe13e
                                      0x04ebe169
                                      0x04ebe16d
                                      0x04ebe19e
                                      0x04ebe16f
                                      0x04ebe16f
                                      0x04ebe175
                                      0x04ebe179
                                      0x04ebe18f
                                      0x04ebe193
                                      0x00000000
                                      0x04ebe199
                                      0x00000000
                                      0x04ebe199
                                      0x04ebe193
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e741da
                                      0x04e741da
                                      0x04e741df
                                      0x04e741e4
                                      0x04e741ec
                                      0x04e74203
                                      0x04e74207
                                      0x04ebe1fd
                                      0x04e74222
                                      0x04e74226
                                      0x04ebe1f3
                                      0x04ebe1f3
                                      0x04e7422c
                                      0x04e7422c
                                      0x04e74233
                                      0x04ebe1ed
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e74239
                                      0x04e74239
                                      0x04e74239
                                      0x04e74239
                                      0x04e74233
                                      0x04e74226
                                      0x04e741ee
                                      0x04e741ee
                                      0x04e741f4
                                      0x04e74575
                                      0x04ebe1b1
                                      0x04ebe1b1
                                      0x00000000
                                      0x04e7457b
                                      0x04e7457b
                                      0x04e74582
                                      0x04ebe1ab
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e74588
                                      0x04e74588
                                      0x04e7458c
                                      0x04ebe1c4
                                      0x04ebe1c4
                                      0x00000000
                                      0x04e74592
                                      0x04e74592
                                      0x04e74599
                                      0x04ebe1be
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e7459f
                                      0x04e7459f
                                      0x04e745a3
                                      0x04ebe1d7
                                      0x04ebe1e4
                                      0x00000000
                                      0x04e745a9
                                      0x04e745a9
                                      0x04e745b0
                                      0x04ebe1d1
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e745b6
                                      0x04e745b6
                                      0x04e745b6
                                      0x00000000
                                      0x04e745b6
                                      0x04e745b0
                                      0x04e745a3
                                      0x04e74599
                                      0x04e7458c
                                      0x04e74582
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e741f4
                                      0x04e7423e
                                      0x04e74241
                                      0x04e745c0
                                      0x04e745c4
                                      0x00000000
                                      0x04e745ca
                                      0x04e745ca
                                      0x00000000
                                      0x04ebe207
                                      0x04ebe20f
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e745d1
                                      0x00000000
                                      0x00000000
                                      0x04e745ca
                                      0x00000000
                                      0x04e74247
                                      0x04e74247
                                      0x04e74247
                                      0x04e74249
                                      0x04e74249
                                      0x04e74249
                                      0x04e74251
                                      0x04e74251
                                      0x04e74257
                                      0x04e7425f
                                      0x04e7426e
                                      0x04e74270
                                      0x04e7427a
                                      0x04ebe219
                                      0x04ebe219
                                      0x04e74280
                                      0x04e74282
                                      0x04e74456
                                      0x04e745ea
                                      0x00000000
                                      0x04e745f0
                                      0x04ebe223
                                      0x00000000
                                      0x04ebe223
                                      0x04e7445c
                                      0x04e7445c
                                      0x00000000
                                      0x04e7445c
                                      0x00000000
                                      0x04e74288
                                      0x04e7428c
                                      0x04ebe298
                                      0x04e74292
                                      0x04e74292
                                      0x04e7429e
                                      0x04e742a3
                                      0x04e742a7
                                      0x04e742ac
                                      0x04ebe22d
                                      0x04e742b2
                                      0x04e742b2
                                      0x04e742b9
                                      0x04e742bc
                                      0x04e742c2
                                      0x04e742ca
                                      0x04e742cd
                                      0x04e742cd
                                      0x04e742d4
                                      0x04e7433f
                                      0x04e7433f
                                      0x04e742d6
                                      0x04e742d6
                                      0x04e742d9
                                      0x04e742dd
                                      0x04e742eb
                                      0x04ebe23a
                                      0x04e742f1
                                      0x04e74305
                                      0x04e7430d
                                      0x04e74315
                                      0x04e74318
                                      0x04e7431f
                                      0x04e74322
                                      0x04e7432e
                                      0x04e7433b
                                      0x04e7433b
                                      0x00000000
                                      0x04e7432e
                                      0x04e742eb
                                      0x04e7434c
                                      0x04e7434e
                                      0x04e74352
                                      0x04e74359
                                      0x04e7435e
                                      0x04e74361
                                      0x04e7436e
                                      0x04e7438a
                                      0x04e7438e
                                      0x04e74396
                                      0x04e7439e
                                      0x04e743a1
                                      0x04e743ad
                                      0x04e743bb
                                      0x04e743bb
                                      0x04e743ad
                                      0x04e7436e
                                      0x04e743bf
                                      0x04e743c5
                                      0x04e74463
                                      0x04e74463
                                      0x04e743ce
                                      0x04e743d5
                                      0x04e743d9
                                      0x04e743df
                                      0x04e74475
                                      0x04e74479
                                      0x04e74491
                                      0x04e74491
                                      0x04e74479
                                      0x04e743e5
                                      0x04e743eb
                                      0x04e743f4
                                      0x04e743f6
                                      0x04e743f9
                                      0x04e743fc
                                      0x04e743ff
                                      0x04e744e8
                                      0x04e744ed
                                      0x04e744f3
                                      0x04ebe247
                                      0x00000000
                                      0x04e744f9
                                      0x04e74504
                                      0x04e74508
                                      0x04e7450f
                                      0x04ebe269
                                      0x00000000
                                      0x04e74515
                                      0x04e74519
                                      0x04e74531
                                      0x04e74534
                                      0x04e74537
                                      0x04e7453e
                                      0x04e74541
                                      0x04e7454a
                                      0x04ebe255
                                      0x04ebe255
                                      0x04ebe25b
                                      0x04ebe25e
                                      0x04ebe261
                                      0x04ebe261
                                      0x04e74555
                                      0x04e74559
                                      0x04e7455d
                                      0x04ebe26d
                                      0x04ebe270
                                      0x04ebe274
                                      0x04ebe27a
                                      0x04ebe27d
                                      0x04ebe28e
                                      0x04ebe28e
                                      0x04e74563
                                      0x04e74563
                                      0x04e74569
                                      0x04e74569
                                      0x00000000
                                      0x04e7455d
                                      0x04e7450f
                                      0x00000000
                                      0x04e744f3
                                      0x04e743ff
                                      0x04e74405
                                      0x04e74405
                                      0x04e74405
                                      0x04e742ac
                                      0x04e7428c
                                      0x04e74282
                                      0x04e74407
                                      0x04e7440d
                                      0x04ebe2af
                                      0x04ebe2af
                                      0x04e74413
                                      0x04e74413
                                      0x00000000
                                      0x04e741d4
                                      0x00000000
                                      0x04e741c3
                                      0x04e741bd
                                      0x04e74415
                                      0x04e74415
                                      0x04e74416
                                      0x04e74417
                                      0x04e74429
                                      0x04e7416e
                                      0x04e7416e
                                      0x04e74175
                                      0x04e74498
                                      0x04e7449f
                                      0x04ebe12d
                                      0x00000000
                                      0x04ebe133
                                      0x00000000
                                      0x04ebe133
                                      0x04e744a5
                                      0x04e744a5
                                      0x04e744aa
                                      0x00000000
                                      0x04e744bb
                                      0x04e744ca
                                      0x04e744d6
                                      0x04e744d7
                                      0x04e744d8
                                      0x04e744e3
                                      0x04e744e3
                                      0x04e744aa
                                      0x04e7417b
                                      0x04e7417b
                                      0x04e7417b
                                      0x00000000
                                      0x04e7417b
                                      0x04e74175
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 453f3f0fd04ff52960230251d10c2b0d243d50a3803197279810be7b943f529e
                                      • Instruction ID: 20bf1857487f5c750e231e2f7042e8b2e6e73b52333fc0e5a2d88965fe054407
                                      • Opcode Fuzzy Hash: 453f3f0fd04ff52960230251d10c2b0d243d50a3803197279810be7b943f529e
                                      • Instruction Fuzzy Hash: 06F170706082519FC724CF59C480ABAB7E1FF88768F15692EF486CB390E734E951DB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6D5E0 Relevance: .4, Instructions: 353COMMONCrypto
                                      Download Yara Rule
                                      C-Code - Quality: 87%
                                      			E04E6D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x4f4d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04E66600(0x4f452d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4f47b9c; // 0x0
							_t281 = L04E74620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E04E9F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4f47b90; // 0x774a0000
								if(_t384 == 0) {
									_t353 =  *0x4f47b8c; // 0x33e3db8
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x33e3e68
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E04E72280(_t200, 0x4f484d8);
									_t277 =  *0x4f485f4; // 0x33e4210
									_t351 =  *0x4f485f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x76080000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x33e2f98
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x33e41a8
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x33e2f98
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x33e1ff0
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E04E6FFB0(_t287, _t353, 0x4f484d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E04EACC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04E66600(0x4f452d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04E67926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x4f4b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E04EDE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4f48472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x4f4b218; // 0x0
														asm("ror edi, cl");
														 *0x4f4b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04E72280(_t250, 0x4f484d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04E93898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E04E6FFB0(_t293, _t353, 0x4f484d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E04E937F5(_t353, 0);
																}
																E04E90413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04E89B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E04E802D6(_t174);
																}
																L04E777F0( *0x4f47b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E04E8C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L04E6EC7F(_t353);
										L04E819B8(_t287, 0, _t353, 0);
										_t200 = E04E5F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E04E9B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x4f4b2f8; // 0xe10000
									if((_t206 |  *0x4f4b2fc) == 0 || ( *0x4f4b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x4f4b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E04F06B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E04F06AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E04E6E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L04E6EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04E99730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E04E6E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04E68F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04E93C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}








































































































                                      0x04e6d5f2
                                      0x04e6d5f5
                                      0x04e6d5f5
                                      0x04e6d5fd
                                      0x04e6d600
                                      0x04e6d60a
                                      0x04e6d60d
                                      0x04e6d617
                                      0x04e6d61d
                                      0x04e6d627
                                      0x04e6d62e
                                      0x04e6d911
                                      0x04e6d913
                                      0x00000000
                                      0x04e6d919
                                      0x04e6d919
                                      0x04e6d919
                                      0x04e6d634
                                      0x04e6d634
                                      0x04e6d634
                                      0x04e6d634
                                      0x04e6d640
                                      0x04e6d8bf
                                      0x00000000
                                      0x04e6d646
                                      0x04e6d646
                                      0x04e6d64d
                                      0x04e6d652
                                      0x04ebb2fc
                                      0x04ebb2fc
                                      0x04ebb302
                                      0x04ebb33b
                                      0x04ebb341
                                      0x00000000
                                      0x04ebb304
                                      0x04ebb304
                                      0x04ebb319
                                      0x04ebb31e
                                      0x04ebb324
                                      0x04ebb326
                                      0x04ebb332
                                      0x04ebb347
                                      0x04ebb34c
                                      0x04ebb351
                                      0x04ebb35a
                                      0x00000000
                                      0x04ebb328
                                      0x04ebb328
                                      0x00000000
                                      0x04ebb328
                                      0x04ebb326
                                      0x04e6d658
                                      0x04e6d658
                                      0x04e6d65b
                                      0x04e6d665
                                      0x00000000
                                      0x04e6d66b
                                      0x04e6d66b
                                      0x04e6d66b
                                      0x04e6d66b
                                      0x04e6d66d
                                      0x04e6d672
                                      0x04e6d67a
                                      0x00000000
                                      0x00000000
                                      0x04e6d680
                                      0x04e6d686
                                      0x04e6d8ce
                                      0x04e6d8d4
                                      0x04e6d8da
                                      0x04e6d8dd
                                      0x04e6d8dd
                                      0x04e6d8e0
                                      0x04e6d68c
                                      0x04e6d691
                                      0x04e6d69d
                                      0x04e6d6a2
                                      0x04e6d6a7
                                      0x04e6d6b0
                                      0x04e6d6b0
                                      0x04e6d6b5
                                      0x04e6d6e0
                                      0x04e6d6b7
                                      0x04e6d6b7
                                      0x04e6d6b9
                                      0x04e6d6b9
                                      0x04e6d6bb
                                      0x04e6d6bd
                                      0x04e6d6ce
                                      0x04e6d6d0
                                      0x04e6d6d2
                                      0x04ebb363
                                      0x04ebb365
                                      0x00000000
                                      0x04ebb36b
                                      0x00000000
                                      0x04ebb36b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e6d6bf
                                      0x04e6d6bf
                                      0x04e6d6e5
                                      0x04e6d6e7
                                      0x04e6d6e9
                                      0x04e6d6e9
                                      0x04e6d6ec
                                      0x04e6d6ec
                                      0x04e6d6ef
                                      0x04e6d6f5
                                      0x04e6d6f9
                                      0x04e6d6fb
                                      0x04e6d6fd
                                      0x04e6d701
                                      0x04e6d703
                                      0x04e6d70a
                                      0x04e6d70a
                                      0x04e6d70a
                                      0x04e6d701
                                      0x04e6d70d
                                      0x04e6d710
                                      0x04e6d710
                                      0x04e6d6c1
                                      0x04e6d6c1
                                      0x04e6d6c1
                                      0x04e6d6c6
                                      0x04ebb36d
                                      0x04ebb36f
                                      0x00000000
                                      0x04ebb375
                                      0x04ebb375
                                      0x04ebb375
                                      0x00000000
                                      0x04ebb375
                                      0x00000000
                                      0x04e6d6cc
                                      0x04e6d6d8
                                      0x04e6d6d8
                                      0x04e6d6d8
                                      0x00000000
                                      0x04e6d6c6
                                      0x04e6d6bf
                                      0x00000000
                                      0x04e6d6da
                                      0x04e6d6da
                                      0x04e6d716
                                      0x04e6d71b
                                      0x04e6d720
                                      0x04e6d726
                                      0x04e6d726
                                      0x04e6d72d
                                      0x00000000
                                      0x04e6d733
                                      0x04e6d739
                                      0x04e6d742
                                      0x04e6d750
                                      0x04e6d758
                                      0x04e6d764
                                      0x04e6d776
                                      0x04e6d77a
                                      0x04e6d783
                                      0x04e6d928
                                      0x04e6d92c
                                      0x04e6d93d
                                      0x04e6d944
                                      0x04e6d94f
                                      0x04e6d954
                                      0x04e6d956
                                      0x04e6d95f
                                      0x04e6d961
                                      0x04e6d973
                                      0x04e6d973
                                      0x04e6d956
                                      0x04e6d944
                                      0x04e6d92c
                                      0x04e6d78b
                                      0x04ebb394
                                      0x04e6d791
                                      0x04e6d798
                                      0x04ebb3a3
                                      0x04ebb3bb
                                      0x04ebb3bb
                                      0x04e6d7a5
                                      0x04e6d866
                                      0x04e6d870
                                      0x04e6d884
                                      0x04e6d892
                                      0x04e6d898
                                      0x04e6d89e
                                      0x04e6d8a0
                                      0x04e6d8a6
                                      0x04e6d8ac
                                      0x04e6d8ae
                                      0x04e6d8b4
                                      0x04e6d8b4
                                      0x04e6d8ae
                                      0x04e6d7a5
                                      0x04e6d78b
                                      0x04e6d7b1
                                      0x04ebb3c5
                                      0x04ebb3c5
                                      0x04e6d7c3
                                      0x04e6d7ca
                                      0x04e6d7e5
                                      0x04e6d7eb
                                      0x04e6d8eb
                                      0x04e6d8ed
                                      0x00000000
                                      0x04e6d8f3
                                      0x04e6d8f3
                                      0x04e6d8f3
                                      0x00000000
                                      0x04e6d8ed
                                      0x04e6d7cc
                                      0x04e6d7cc
                                      0x04e6d7d2
                                      0x00000000
                                      0x04e6d7d4
                                      0x04e6d7d4
                                      0x04e6d7d7
                                      0x04e6d7df
                                      0x04ebb3d4
                                      0x04ebb3d9
                                      0x04ebb3dc
                                      0x04ebb3dc
                                      0x04ebb3df
                                      0x04ebb3e2
                                      0x04ebb468
                                      0x04ebb46d
                                      0x04ebb46f
                                      0x04ebb46f
                                      0x04ebb475
                                      0x04e6d8f8
                                      0x04e6d8f9
                                      0x04e6d8fd
                                      0x04ebb3e8
                                      0x04ebb3e8
                                      0x04ebb3eb
                                      0x04ebb3ed
                                      0x00000000
                                      0x04ebb3ef
                                      0x04ebb3ef
                                      0x04ebb3f1
                                      0x04ebb3f4
                                      0x04ebb3fe
                                      0x04ebb404
                                      0x04ebb409
                                      0x04ebb40e
                                      0x04ebb410
                                      0x04ebb410
                                      0x04ebb414
                                      0x04ebb414
                                      0x04ebb41b
                                      0x04ebb420
                                      0x04ebb423
                                      0x04ebb425
                                      0x04ebb427
                                      0x04ebb42a
                                      0x04ebb42d
                                      0x04ebb42d
                                      0x04ebb42a
                                      0x04ebb432
                                      0x04ebb436
                                      0x04ebb438
                                      0x04ebb43b
                                      0x04ebb43b
                                      0x04ebb449
                                      0x04ebb44e
                                      0x04ebb454
                                      0x04ebb458
                                      0x04ebb458
                                      0x04ebb45d
                                      0x00000000
                                      0x04ebb45d
                                      0x04ebb3ed
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e6d7df
                                      0x04e6d7d2
                                      0x04e6d7ca
                                      0x04ebb37c
                                      0x04ebb37e
                                      0x04ebb385
                                      0x04ebb38a
                                      0x00000000
                                      0x04ebb38a
                                      0x04e6d742
                                      0x04e6d7f1
                                      0x04e6d7f8
                                      0x04ebb49b
                                      0x04ebb49b
                                      0x04e6d800
                                      0x04e6d837
                                      0x04e6d843
                                      0x04e6d845
                                      0x04e6d847
                                      0x04e6d84a
                                      0x04e6d84b
                                      0x04e6d84e
                                      0x04e6d857
                                      0x04e6d802
                                      0x04e6d802
                                      0x04e6d80d
                                      0x00000000
                                      0x04e6d818
                                      0x04e6d818
                                      0x04e6d824
                                      0x04e6d831
                                      0x04ebb4a5
                                      0x04ebb4ab
                                      0x04ebb4b3
                                      0x04ebb4b8
                                      0x04ebb4bb
                                      0x00000000
                                      0x04ebb4c1
                                      0x04ebb4c1
                                      0x04ebb4c8
                                      0x00000000
                                      0x04ebb4ce
                                      0x04ebb4d4
                                      0x04ebb4e1
                                      0x04ebb4e3
                                      0x04ebb4e5
                                      0x00000000
                                      0x04ebb4eb
                                      0x04ebb4f0
                                      0x04ebb4f2
                                      0x04e6dac9
                                      0x04e6dacc
                                      0x04e6dacf
                                      0x04e6dad1
                                      0x04e6dd78
                                      0x04e6dd78
                                      0x04e6dcf2
                                      0x00000000
                                      0x04e6dad7
                                      0x04e6dad9
                                      0x04e6dadb
                                      0x00000000
                                      0x00000000
                                      0x04e6dae1
                                      0x04e6dae1
                                      0x04e6dae4
                                      0x04e6dae6
                                      0x04ebb4f9
                                      0x04ebb4f9
                                      0x04ebb500
                                      0x04e6daec
                                      0x04e6daec
                                      0x04e6daf5
                                      0x04e6daf8
                                      0x04e6dafb
                                      0x04e6db03
                                      0x04e6db11
                                      0x04e6db16
                                      0x04e6db19
                                      0x04e6db1b
                                      0x04ebb52c
                                      0x04ebb531
                                      0x04ebb534
                                      0x04e6db21
                                      0x04e6db21
                                      0x04e6db24
                                      0x04e6dcd9
                                      0x04e6dce2
                                      0x04e6dce5
                                      0x04e6dd6a
                                      0x04e6dd6d
                                      0x00000000
                                      0x04e6dd73
                                      0x04ebb51a
                                      0x04ebb51c
                                      0x04ebb51f
                                      0x04ebb524
                                      0x00000000
                                      0x04ebb524
                                      0x04e6dce7
                                      0x04e6dce7
                                      0x04e6dce7
                                      0x00000000
                                      0x04e6dce7
                                      0x00000000
                                      0x04e6db2a
                                      0x04e6db2c
                                      0x04e6db31
                                      0x04e6db33
                                      0x04e6db36
                                      0x04e6db39
                                      0x04e6db3b
                                      0x04e6db66
                                      0x04e6db66
                                      0x04e6db3d
                                      0x04e6db3d
                                      0x04e6db3e
                                      0x04e6db46
                                      0x04e6db47
                                      0x04e6db49
                                      0x04e6db4c
                                      0x04e6db53
                                      0x04e6db55
                                      0x04e6db58
                                      0x04e6db5a
                                      0x04ebb50a
                                      0x04ebb50f
                                      0x04ebb512
                                      0x04e6db60
                                      0x04e6db60
                                      0x04e6db63
                                      0x04e6db63
                                      0x00000000
                                      0x04e6db63
                                      0x04e6db5a
                                      0x04e6db3b
                                      0x04e6db24
                                      0x04e6db69
                                      0x04e6db69
                                      0x04e6db6c
                                      0x04e6db6f
                                      0x04e6db74
                                      0x04ebb557
                                      0x04ebb557
                                      0x04ebb55e
                                      0x04e6db7a
                                      0x04e6db7c
                                      0x04e6db7f
                                      0x04e6db82
                                      0x04e6db85
                                      0x00000000
                                      0x04e6db8b
                                      0x04e6db8b
                                      0x04e6db8d
                                      0x04e6db9b
                                      0x04e6db9b
                                      0x04e6db9d
                                      0x04e6dba0
                                      0x04e6dba2
                                      0x04e6dba4
                                      0x04e6dba7
                                      0x04e6dba9
                                      0x04e6dbae
                                      0x04e6dbae
                                      0x04e6dbb1
                                      0x04e6dbb4
                                      0x04e6dbb4
                                      0x04e6dbb7
                                      0x04e6dbba
                                      0x04e6dcd2
                                      0x04e6dcd4
                                      0x00000000
                                      0x04e6dbc0
                                      0x04e6dbc0
                                      0x04e6dbd2
                                      0x04e6dbd7
                                      0x04e6dbda
                                      0x04e6dbdd
                                      0x04e6dbdf
                                      0x00000000
                                      0x04e6dbe5
                                      0x04e6dbe5
                                      0x04e6dbee
                                      0x04e6dbf1
                                      0x04ebb541
                                      0x04ebb544
                                      0x00000000
                                      0x04ebb546
                                      0x04ebb546
                                      0x00000000
                                      0x04ebb546
                                      0x04e6dbf7
                                      0x04e6dbf7
                                      0x04e6dbfd
                                      0x04e6dbfd
                                      0x04e6dbff
                                      0x04e6dc0b
                                      0x04e6dc15
                                      0x04e6dc1b
                                      0x04e6dc1d
                                      0x04e6dc21
                                      0x04e6dc21
                                      0x04e6dc23
                                      0x04e6dc23
                                      0x04e6dc26
                                      0x04e6dc29
                                      0x04e6dc2b
                                      0x00000000
                                      0x00000000
                                      0x04e6dc31
                                      0x04e6dc34
                                      0x04e6dc36
                                      0x04e6dcbf
                                      0x04e6dcbf
                                      0x04e6dcc2
                                      0x00000000
                                      0x04e6dc3c
                                      0x04e6dc41
                                      0x04e6dc43
                                      0x00000000
                                      0x04e6dc45
                                      0x04e6dc45
                                      0x04e6dc47
                                      0x00000000
                                      0x04e6dc4d
                                      0x04e6dc4d
                                      0x04e6dc50
                                      0x04e6dc52
                                      0x04e6dc55
                                      0x04e6dcfa
                                      0x04e6dcfe
                                      0x04e6dd08
                                      0x04e6dd0a
                                      0x04e6dd0c
                                      0x00000000
                                      0x04e6dd12
                                      0x04e6dd15
                                      0x04e6dd2d
                                      0x04e6dd2f
                                      0x04e6dd32
                                      0x04e6dd35
                                      0x00000000
                                      0x04e6dd35
                                      0x04e6dc5b
                                      0x04e6dc5b
                                      0x04e6dc5e
                                      0x04e6dc61
                                      0x04e6dc64
                                      0x04e6dc67
                                      0x04e6dc67
                                      0x04e6dc6a
                                      0x04e6dc6c
                                      0x04e6dc8e
                                      0x04e6dc8e
                                      0x04e6dc91
                                      0x04e6dc93
                                      0x04e6dcce
                                      0x04e6dcce
                                      0x04e6dc95
                                      0x04e6dc9c
                                      0x04e6dc6e
                                      0x04e6dc72
                                      0x04e6dc75
                                      0x04e6dc77
                                      0x04e6dc79
                                      0x04ebb551
                                      0x04ebb551
                                      0x00000000
                                      0x04e6dc7f
                                      0x04e6dc7f
                                      0x04e6dc81
                                      0x00000000
                                      0x04e6dc83
                                      0x04e6dc86
                                      0x04e6dc88
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e6dc88
                                      0x04e6dc81
                                      0x04e6dc79
                                      0x04e6dc6c
                                      0x04e6dc55
                                      0x04e6dc47
                                      0x04e6dc43
                                      0x00000000
                                      0x04e6dc36
                                      0x04e6dc23
                                      0x00000000
                                      0x04e6dbff
                                      0x04e6dbf1
                                      0x04e6dbdf
                                      0x04e6db8f
                                      0x04e6db92
                                      0x04e6db95
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e6db95
                                      0x04e6db8d
                                      0x04e6db85
                                      0x04e6db74
                                      0x04e6dc9f
                                      0x04e6dca2
                                      0x04e6dcb0
                                      0x04e6dcb0
                                      0x04e6dad1
                                      0x04ebb4e5
                                      0x04ebb4c8
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e6d831
                                      0x04e6d80d
                                      0x00000000
                                      0x04e6d800
                                      0x04ebb47f
                                      0x04ebb485
                                      0x00000000
                                      0x04ebb485
                                      0x04e6d665
                                      0x04e6d652
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 91d4cb008bfff115780ebc42786e51d3aeabcab2a65f219b398f44e7946267a9
                                      • Instruction ID: ab044dfe5b3d4e7d62536a156d3d5f20c1cbd4fffa890d4d1196b6a0e5f06f9b
                                      • Opcode Fuzzy Hash: 91d4cb008bfff115780ebc42786e51d3aeabcab2a65f219b398f44e7946267a9
                                      • Instruction Fuzzy Hash: C5E1D034B40319CFEB249F14CC44FAAB7B1BF85358F4421A9D94A97690EB74BD81CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6849B Relevance: .3, Instructions: 290COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 92%
                                      			E04E6849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x4f2f9c0);
				E04EAD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4f47b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E04E6CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04E72280( *[fs:0x30], 0x4f48550);
						_t139 =  *0x4f47b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E04E8F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E04E6FFB0(_t193, _t235, 0x4f48550);
								L5:
								return E04EAD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04E51C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4f47b9c; // 0x0
							_t235 = L04E74620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4f47b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E04E8A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E04E6FFB0(_t193, _t235, 0x4f48550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L04E777F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L04E777F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4f47b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4f47b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E04E937C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4f47b9c; // 0x0
									_t214 = L04E74620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E04E937F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4f47b10 =  *0x4f47b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4f47b04 =  *0x4f47b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L04E777F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L04E777F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4f47b08 =  *0x4f47b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E04E957C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E04E9F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L04E777F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E04E8A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L04E777F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E04E996C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

































                                      0x04e6849b
                                      0x04e6849b
                                      0x04e6849b
                                      0x04e6849b
                                      0x04e6849d
                                      0x04e684a2
                                      0x04e684a7
                                      0x04e684b1
                                      0x04e684d8
                                      0x00000000
                                      0x04e684b3
                                      0x04e684c4
                                      0x04e684c9
                                      0x04e684cd
                                      0x04e684cf
                                      0x04e684cf
                                      0x04e684d6
                                      0x04e684e6
                                      0x04e684e9
                                      0x04e684ec
                                      0x04e684ef
                                      0x04e684f2
                                      0x04e684f4
                                      0x04e684fc
                                      0x04e68501
                                      0x04e68506
                                      0x04e68509
                                      0x04e686e0
                                      0x04e686e5
                                      0x04e686e8
                                      0x04e686ed
                                      0x04e686f0
                                      0x04e686f2
                                      0x04eb9afd
                                      0x04eb9b02
                                      0x04e684da
                                      0x04e684df
                                      0x04e684df
                                      0x04e686fa
                                      0x04e686fd
                                      0x04e686fe
                                      0x04e68701
                                      0x04e68706
                                      0x04e68709
                                      0x04e6870b
                                      0x00000000
                                      0x00000000
                                      0x04e68711
                                      0x04e68725
                                      0x04e68727
                                      0x04e6872a
                                      0x04e6872c
                                      0x04eb9af0
                                      0x04eb9af5
                                      0x04e68732
                                      0x04e68732
                                      0x04e68732
                                      0x04e68735
                                      0x04e68737
                                      0x04e68515
                                      0x04e68515
                                      0x04e68518
                                      0x04e6851d
                                      0x04e68523
                                      0x04e68527
                                      0x04e6852b
                                      0x04e68537
                                      0x04e68539
                                      0x04e6853c
                                      0x04e6853e
                                      0x04e6868c
                                      0x04e68691
                                      0x04e68699
                                      0x04e6869b
                                      0x04e68744
                                      0x04e68748
                                      0x04e686a1
                                      0x04e686a1
                                      0x04e686a1
                                      0x04e686a4
                                      0x04e686a8
                                      0x04eb9bdf
                                      0x04eb9bdf
                                      0x04e686ae
                                      0x04e686b0
                                      0x00000000
                                      0x04e686b6
                                      0x00000000
                                      0x04eb9be9
                                      0x04e686b0
                                      0x04e68544
                                      0x04e6854a
                                      0x04e6854d
                                      0x04e68551
                                      0x04e6876e
                                      0x04e68778
                                      0x04e6877b
                                      0x04e68780
                                      0x04e68557
                                      0x04e68557
                                      0x04e6855d
                                      0x04e6855d
                                      0x04e6856b
                                      0x04e6856e
                                      0x04e68570
                                      0x04e68573
                                      0x04e68576
                                      0x04e68576
                                      0x04e68579
                                      0x04e6857b
                                      0x00000000
                                      0x00000000
                                      0x04e68581
                                      0x04e685a0
                                      0x04e685a2
                                      0x04e685a5
                                      0x04e685a7
                                      0x04eb9b1b
                                      0x04eb9b1b
                                      0x04e6862e
                                      0x04e6862e
                                      0x04e68631
                                      0x04e68631
                                      0x04e68634
                                      0x04e68636
                                      0x04e68669
                                      0x04e68669
                                      0x04e6866b
                                      0x04eb9bbf
                                      0x04eb9bc4
                                      0x04eb9bc8
                                      0x04eb9bce
                                      0x04eb9bce
                                      0x04e68671
                                      0x04e68671
                                      0x04e68674
                                      0x04e68676
                                      0x04eb9bae
                                      0x04eb9bae
                                      0x04e68676
                                      0x04e6867c
                                      0x04e6867e
                                      0x04e68688
                                      0x04e68688
                                      0x00000000
                                      0x04e6867e
                                      0x04e68638
                                      0x04e68638
                                      0x04e6863b
                                      0x04e6863e
                                      0x04e6863f
                                      0x04e68642
                                      0x04e68645
                                      0x04e68648
                                      0x04e6864d
                                      0x04eb9b69
                                      0x04eb9b6e
                                      0x04eb9b7b
                                      0x04eb9b81
                                      0x04eb9b85
                                      0x04eb9b89
                                      0x04eb9ba7
                                      0x04eb9b8b
                                      0x04eb9b91
                                      0x04eb9b9a
                                      0x04eb9b9f
                                      0x04eb9b9f
                                      0x04e68788
                                      0x04e6878d
                                      0x04e68763
                                      0x04e68763
                                      0x04e68766
                                      0x00000000
                                      0x04e68766
                                      0x04eb9b70
                                      0x00000000
                                      0x04eb9b70
                                      0x04e68656
                                      0x04e6865a
                                      0x04e6865c
                                      0x04e68752
                                      0x04e68756
                                      0x00000000
                                      0x00000000
                                      0x04e6875e
                                      0x00000000
                                      0x04e6875e
                                      0x04e68662
                                      0x04e68662
                                      0x04e68662
                                      0x04e68666
                                      0x00000000
                                      0x04e68666
                                      0x04e685b7
                                      0x04e685b9
                                      0x04e685bc
                                      0x04e685bf
                                      0x04e685cc
                                      0x04e685d1
                                      0x04e685d4
                                      0x04e685db
                                      0x04e685de
                                      0x04e685e0
                                      0x04eb9b5f
                                      0x00000000
                                      0x04eb9b5f
                                      0x04e685e6
                                      0x04e685ea
                                      0x04e686c3
                                      0x04e686c5
                                      0x04e686c8
                                      0x04e686ca
                                      0x04eb9b16
                                      0x00000000
                                      0x04eb9b16
                                      0x04e686d6
                                      0x04e685f6
                                      0x04e685f6
                                      0x04e685f9
                                      0x04e68602
                                      0x04e68606
                                      0x04e6860a
                                      0x04e6860b
                                      0x04e6860e
                                      0x04e68611
                                      0x00000000
                                      0x04e68611
                                      0x04e685f3
                                      0x00000000
                                      0x04e685f3
                                      0x04e68619
                                      0x04e6861e
                                      0x04e6861e
                                      0x04e68621
                                      0x04e68622
                                      0x04e68623
                                      0x04e68625
                                      0x04e6862c
                                      0x00000000
                                      0x04e6873d
                                      0x00000000
                                      0x04e6873d
                                      0x04e68737
                                      0x04e6850f
                                      0x04e68512
                                      0x00000000
                                      0x04e68512
                                      0x00000000
                                      0x04e684d6

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c9b7f25354d1e9126abe844aec8e56242c4856bd3505109f1fa2ad3f9b5a8c4d
                                      • Instruction ID: 4b192d085fe388300532f35291f8d6c8d908822f3a81b10e2e75ce0e32f80b6e
                                      • Opcode Fuzzy Hash: c9b7f25354d1e9126abe844aec8e56242c4856bd3505109f1fa2ad3f9b5a8c4d
                                      • Instruction Fuzzy Hash: E0B16EB4E01209DFDB14EF99C984AEEBBB5FF48348F106529E506AB245DB70BD41CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8513A Relevance: .3, Instructions: 258COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 67%
                                      			E04E8513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4f4d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E04E9D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04E72280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04E74620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E04E9F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E04E6FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x4f4b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E04E9B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}































































                                      0x04e85142
                                      0x04e8514c
                                      0x04e85150
                                      0x04e85157
                                      0x04e85159
                                      0x04e8515e
                                      0x04e85165
                                      0x04e85169
                                      0x04e8516c
                                      0x04e85172
                                      0x04e85176
                                      0x04e8517a
                                      0x04e8517a
                                      0x04e8517a
                                      0x04e8517f
                                      0x04ec6d8b
                                      0x04ec6d8e
                                      0x04ec6d91
                                      0x04ec6d95
                                      0x04ec6d98
                                      0x04ec6d9c
                                      0x04ec6da0
                                      0x04ec6da3
                                      0x04ec6da7
                                      0x04ec6e26
                                      0x04ec6e26
                                      0x04ec6e2a
                                      0x04e851f9
                                      0x04e851f9
                                      0x04e851fe
                                      0x04ec6e33
                                      0x04ec6e33
                                      0x04ec6e39
                                      0x04ec6e3d
                                      0x04ec6e46
                                      0x04ec6e50
                                      0x00000000
                                      0x00000000
                                      0x04ec6e52
                                      0x04ec6e53
                                      0x04ec6e56
                                      0x04ec6e5d
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04ec6e5f
                                      0x04ec6e67
                                      0x04ec6e77
                                      0x04ec6e7f
                                      0x04ec6e80
                                      0x04ec6e88
                                      0x04ec6e90
                                      0x04ec6e9f
                                      0x04ec6ea5
                                      0x04ec6ea9
                                      0x04ec6eb1
                                      0x04ec6ebf
                                      0x00000000
                                      0x00000000
                                      0x04ec6ecf
                                      0x04ec6ed3
                                      0x00000000
                                      0x00000000
                                      0x04ec6edb
                                      0x04ec6ede
                                      0x04ec6ee1
                                      0x04ec6ee8
                                      0x04ec6eeb
                                      0x04ec6eed
                                      0x04ec6ef0
                                      0x04ec6ef4
                                      0x04ec6ef8
                                      0x04ec6efc
                                      0x00000000
                                      0x00000000
                                      0x04ec6f0d
                                      0x04ec6f11
                                      0x04ec6f32
                                      0x04ec6f37
                                      0x04ec6f3b
                                      0x04ec6f3e
                                      0x04ec6f41
                                      0x04ec6f46
                                      0x00000000
                                      0x00000000
                                      0x04ec6f4c
                                      0x04ec6f50
                                      0x04ec6f50
                                      0x04ec6f54
                                      0x04ec6f62
                                      0x04ec6f65
                                      0x04ec6f6d
                                      0x04ec6f7b
                                      0x04ec6f7b
                                      0x04ec6f93
                                      0x04ec6f98
                                      0x04ec6fa0
                                      0x04ec6fa6
                                      0x04ec6fb3
                                      0x04ec6fb6
                                      0x04ec6fbf
                                      0x04ec6fc1
                                      0x04ec6fd5
                                      0x04ec6fda
                                      0x04ec6fda
                                      0x04ec6fdd
                                      0x04ec6fe2
                                      0x04ec6fe7
                                      0x04ec6feb
                                      0x04ec6fef
                                      0x04ec6ff3
                                      0x04e8520c
                                      0x04e8520c
                                      0x04e8520f
                                      0x04e85215
                                      0x04e85234
                                      0x04e8523a
                                      0x04e8523a
                                      0x04e85244
                                      0x04e85245
                                      0x04e85246
                                      0x04e85251
                                      0x04e85251
                                      0x04ec6f13
                                      0x04ec6f17
                                      0x04ec6f17
                                      0x04ec6f18
                                      0x04ec6f1b
                                      0x04ec6f1f
                                      0x04ec6f23
                                      0x00000000
                                      0x04ec6f28
                                      0x04e85204
                                      0x04e85204
                                      0x04e85208
                                      0x00000000
                                      0x04e85208
                                      0x04e85185
                                      0x04e85188
                                      0x04e8518a
                                      0x04e8518e
                                      0x04e85195
                                      0x04ec6db1
                                      0x04ec6db5
                                      0x04ec6db9
                                      0x04e8519b
                                      0x04e8519b
                                      0x04e8519e
                                      0x04e851a7
                                      0x04e851a9
                                      0x04e851a9
                                      0x04e851b5
                                      0x04e851b8
                                      0x04e851bb
                                      0x04e851be
                                      0x04e851c1
                                      0x04e851c5
                                      0x04e851c9
                                      0x04e851cd
                                      0x04e851cd
                                      0x04e851d8
                                      0x04e851dc
                                      0x04e851e0
                                      0x04ec6dcc
                                      0x04ec6dd0
                                      0x04ec6dd5
                                      0x04ec6ddd
                                      0x04ec6de1
                                      0x04ec6de1
                                      0x04ec6de5
                                      0x04ec6deb
                                      0x04ec6df1
                                      0x04ec6df7
                                      0x04ec6dfd
                                      0x04ec6e01
                                      0x04ec6e05
                                      0x04ec6e09
                                      0x04ec6e0d
                                      0x04ec6e11
                                      0x04ec6e11
                                      0x04e851eb
                                      0x04ec6e1a
                                      0x04ec6e1f
                                      0x04ec6e21
                                      0x04ec6e23
                                      0x00000000
                                      0x04e851f1
                                      0x04e851f1
                                      0x00000000
                                      0x04e851f1

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a10ccb6485be43738c12de8b1288351145b4eb5656efe9c816af9ee1b93c87ef
                                      • Instruction ID: 3d5d6a9bdd81398038a39a6c509081c10f726f16287e0683c924b916e2a242f4
                                      • Opcode Fuzzy Hash: a10ccb6485be43738c12de8b1288351145b4eb5656efe9c816af9ee1b93c87ef
                                      • Instruction Fuzzy Hash: F1C101756083809FD754CF28C580A6AFBF1BF88308F145A6EF8998B352D775E946CB42
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E803E2 Relevance: .3, Instructions: 254COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 74%
                                      			E04E803E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x4f4d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04E80548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E04E9B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E04E6B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4f47c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04E77D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04E77D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E04ED7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04E99830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E04ED69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4f47c04 != 0) {
						_t118 = _v12;
						_t120 = E04EDA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4f47bd8;
						if( *0x4f47bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E04E995D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E04E999A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E04ED3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E04E5B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E04E9AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4f48474 - 3;
										if( *0x4f48474 != 3) {
											 *0x4f479dc =  *0x4f479dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04E77D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04E77D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E04ED7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4f48708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4f47b00; // 0x0
							asm("ror esi, cl");
							 *0x4f4b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E04E995D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04E67F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}








































                                      0x04e803f1
                                      0x04e803f7
                                      0x04e803f9
                                      0x04e803fb
                                      0x04e803fd
                                      0x04e80400
                                      0x04e8040a
                                      0x04ec4c7a
                                      0x04e80537
                                      0x04e80547
                                      0x04e80410
                                      0x04e80410
                                      0x04e80414
                                      0x04e80417
                                      0x04e8041a
                                      0x04e80421
                                      0x04e80424
                                      0x04e8042b
                                      0x04e8043b
                                      0x04e8043e
                                      0x04e8043f
                                      0x04e8043f
                                      0x04e80446
                                      0x04e80449
                                      0x04e8044c
                                      0x04e8044f
                                      0x04e80459
                                      0x04ec4c8d
                                      0x04e8045f
                                      0x04e8045f
                                      0x04e8045f
                                      0x04e80467
                                      0x04ec4c97
                                      0x04ec4c9d
                                      0x04ec4ca4
                                      0x04ec4caa
                                      0x04ec4caf
                                      0x04ec4cb1
                                      0x04ec4cc3
                                      0x04ec4cb3
                                      0x04ec4cbc
                                      0x04ec4cbc
                                      0x04ec4cc8
                                      0x04ec4ccb
                                      0x04ec4cd7
                                      0x04ec4cda
                                      0x04ec4cdf
                                      0x04ec4cdf
                                      0x04ec4ccb
                                      0x04ec4ca4
                                      0x04e8046d
                                      0x04e8046f
                                      0x04e8046f
                                      0x04e80471
                                      0x04e80476
                                      0x04e8047a
                                      0x04e8047b
                                      0x04e80483
                                      0x04e80489
                                      0x04e8048d
                                      0x00000000
                                      0x00000000
                                      0x04ec4ce9
                                      0x04ec4cef
                                      0x04ec4d22
                                      0x04ec4d22
                                      0x00000000
                                      0x04ec4d22
                                      0x04ec4cf1
                                      0x04ec4cf7
                                      0x00000000
                                      0x00000000
                                      0x04ec4cf9
                                      0x04ec4cff
                                      0x00000000
                                      0x00000000
                                      0x04ec4d05
                                      0x04ec4d07
                                      0x00000000
                                      0x00000000
                                      0x04ec4d0d
                                      0x04ec4d0f
                                      0x04ec4d14
                                      0x04ec4d16
                                      0x00000000
                                      0x00000000
                                      0x04ec4d1c
                                      0x04ec4d1c
                                      0x04e80499
                                      0x04e80535
                                      0x04e80535
                                      0x00000000
                                      0x04e80535
                                      0x04e804a6
                                      0x04ec4d2c
                                      0x04ec4d37
                                      0x04ec4d39
                                      0x04ec4d3b
                                      0x00000000
                                      0x00000000
                                      0x04ec4d41
                                      0x04ec4d48
                                      0x04e80527
                                      0x04e8052b
                                      0x04e8052d
                                      0x04e80530
                                      0x04e80530
                                      0x00000000
                                      0x04e8052b
                                      0x04ec4d4e
                                      0x04e804ac
                                      0x04e804ac
                                      0x04e804af
                                      0x04e804b2
                                      0x04e804b7
                                      0x04e804b9
                                      0x04e804bb
                                      0x04e804bd
                                      0x04e804bf
                                      0x04e804c5
                                      0x04e804c9
                                      0x04ec4d53
                                      0x04ec4d59
                                      0x04ec4db9
                                      0x04ec4dba
                                      0x04ec4dbf
                                      0x04ec4dc2
                                      0x04ec4dc4
                                      0x04ec4dc7
                                      0x04ec4dce
                                      0x00000000
                                      0x04ec4dce
                                      0x04ec4d5b
                                      0x04ec4d61
                                      0x00000000
                                      0x00000000
                                      0x04ec4d63
                                      0x04ec4d69
                                      0x00000000
                                      0x00000000
                                      0x04ec4d6b
                                      0x04ec4d6e
                                      0x04ec4d74
                                      0x04ec4d76
                                      0x04ec4d7c
                                      0x04ec4d7e
                                      0x04ec4d84
                                      0x04ec4d89
                                      0x04ec4d8c
                                      0x04ec4d8d
                                      0x04ec4d92
                                      0x04ec4d95
                                      0x04ec4d96
                                      0x04ec4d98
                                      0x04ec4d9a
                                      0x04ec4d9f
                                      0x04ec4da4
                                      0x04ec4da6
                                      0x04ec4da8
                                      0x04ec4daf
                                      0x04ec4db1
                                      0x04ec4db1
                                      0x04ec4daf
                                      0x04ec4da6
                                      0x04ec4d84
                                      0x04ec4d7c
                                      0x00000000
                                      0x04ec4d74
                                      0x04e804d6
                                      0x04ec4de1
                                      0x04e804dc
                                      0x04e804dc
                                      0x04e804dc
                                      0x04e804e4
                                      0x04ec4deb
                                      0x04ec4df1
                                      0x04ec4df8
                                      0x04ec4dfe
                                      0x04ec4e03
                                      0x04ec4e05
                                      0x04ec4e17
                                      0x04ec4e07
                                      0x04ec4e10
                                      0x04ec4e10
                                      0x04ec4e1c
                                      0x04ec4e1f
                                      0x04ec4e35
                                      0x04ec4e35
                                      0x04ec4e1f
                                      0x04ec4df8
                                      0x04e804f1
                                      0x04e804fa
                                      0x04ec4e3f
                                      0x04ec4e47
                                      0x04ec4e5b
                                      0x04ec4e61
                                      0x04ec4e67
                                      0x04ec4e69
                                      0x04ec4e71
                                      0x04ec4e73
                                      0x04e80500
                                      0x04e80500
                                      0x04e80500
                                      0x04e804fa
                                      0x04e80508
                                      0x04e8051d
                                      0x04e8051d
                                      0x04e8051f
                                      0x04e80524
                                      0x00000000
                                      0x04e80524
                                      0x04e80515
                                      0x04e80517
                                      0x04ec4e7a
                                      0x04ec4e7c
                                      0x00000000
                                      0x00000000
                                      0x04ec4e85
                                      0x00000000
                                      0x04ec4e85
                                      0x00000000
                                      0x04e80517

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 637381c7cbea8ee10798b562812776c4c57c71c2c0881cb2a2ca76c24e74eca5
                                      • Instruction ID: 184b89885782389f67dfe14b167e9e0b93ebabc02294ac604d30756f205a3017
                                      • Opcode Fuzzy Hash: 637381c7cbea8ee10798b562812776c4c57c71c2c0881cb2a2ca76c24e74eca5
                                      • Instruction Fuzzy Hash: B2915D31F00214AFEF31AB68C954BAD7BA1EB01728F062269E918AB2D1D774BD05C791
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5C600 Relevance: .2, Instructions: 225COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 67%
                                      			E04E5C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x4f4d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04E66D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E04E9B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4f47b9c; // 0x0
					_t74 = L04E74620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04E99650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L04E777F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E04E9F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E04E913C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L04E777F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04E99650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}










































                                      0x04e5c608
                                      0x04e5c615
                                      0x04e5c625
                                      0x04e5c62d
                                      0x04e5c635
                                      0x04e5c640
                                      0x04e5c680
                                      0x04e5c687
                                      0x04e5c688
                                      0x04e5c689
                                      0x04e5c694
                                      0x04e5c694
                                      0x04e5c642
                                      0x04e5c64a
                                      0x04e5c697
                                      0x04ec7a25
                                      0x04ec7a2b
                                      0x04ec7a2e
                                      0x04ec7a30
                                      0x04ec7bea
                                      0x04ec7bea
                                      0x00000000
                                      0x04ec7bea
                                      0x04ec7a36
                                      0x04ec7a43
                                      0x04ec7a48
                                      0x04ec7a4c
                                      0x04ec7a4e
                                      0x00000000
                                      0x00000000
                                      0x04ec7a58
                                      0x04ec7a5a
                                      0x04ec7a5b
                                      0x04ec7a5c
                                      0x04ec7a5d
                                      0x04ec7a63
                                      0x04ec7a64
                                      0x04ec7a6a
                                      0x04ec7a6c
                                      0x04ec7a6e
                                      0x04ec79cb
                                      0x04ec79cb
                                      0x04ec79ce
                                      0x04ec79d0
                                      0x04ec7a98
                                      0x04ec7a9b
                                      0x04ec7a9b
                                      0x04ec7a9e
                                      0x04ec7aa1
                                      0x04ec7bbe
                                      0x04ec7bbe
                                      0x04ec7bc0
                                      0x04ec7be0
                                      0x04ec7be0
                                      0x04ec7a01
                                      0x04ec7a01
                                      0x04ec7a05
                                      0x04ec7a07
                                      0x04ec7a15
                                      0x04ec7a15
                                      0x04ec7a1a
                                      0x00000000
                                      0x04ec7a1a
                                      0x04ec7bc2
                                      0x04ec7bc6
                                      0x04ec7bc9
                                      0x04ec7bcd
                                      0x04ec7bcf
                                      0x04ec79e6
                                      0x04ec79e6
                                      0x04ec79eb
                                      0x04ec79eb
                                      0x04ec79ef
                                      0x04ec79f1
                                      0x00000000
                                      0x00000000
                                      0x04ec79f3
                                      0x04ec79f5
                                      0x04ec79ff
                                      0x04ec79ff
                                      0x00000000
                                      0x04ec79ff
                                      0x04ec79f7
                                      0x04ec79fd
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04ec79fd
                                      0x04ec7bd5
                                      0x04ec7bd8
                                      0x00000000
                                      0x00000000
                                      0x04ec7ba9
                                      0x04ec7bac
                                      0x04ec7bb0
                                      0x04ec7bb1
                                      0x04ec7bb1
                                      0x04ec7bb6
                                      0x00000000
                                      0x04ec7bb6
                                      0x04ec7aa7
                                      0x04ec7aaa
                                      0x00000000
                                      0x00000000
                                      0x04ec7ab2
                                      0x04ec7ab3
                                      0x04ec7ab5
                                      0x04ec7aec
                                      0x04ec7aef
                                      0x04ec7b25
                                      0x04ec7b28
                                      0x04ec7b62
                                      0x04ec7b64
                                      0x04ec7b8f
                                      0x04ec7b92
                                      0x04ec7b96
                                      0x04ec7b98
                                      0x00000000
                                      0x00000000
                                      0x04ec7b9e
                                      0x04ec7b9f
                                      0x04ec7ba3
                                      0x00000000
                                      0x04ec7ba3
                                      0x04ec7b66
                                      0x04ec7b68
                                      0x04ec7ae2
                                      0x04ec7ae2
                                      0x00000000
                                      0x04ec7ae2
                                      0x04ec7b6e
                                      0x04ec7b72
                                      0x04ec7b75
                                      0x04ec7b81
                                      0x04ec7b85
                                      0x04ec7b87
                                      0x00000000
                                      0x00000000
                                      0x04ec7b31
                                      0x04ec7b34
                                      0x04ec7b3c
                                      0x04ec7b45
                                      0x04ec7b46
                                      0x04ec7b4f
                                      0x04ec7b51
                                      0x04ec7b57
                                      0x04ec7b59
                                      0x04ec7b59
                                      0x00000000
                                      0x04ec7b59
                                      0x04ec7b77
                                      0x00000000
                                      0x04ec7b77
                                      0x04ec7b2a
                                      0x00000000
                                      0x04ec7b2a
                                      0x04ec7af1
                                      0x04ec7af3
                                      0x00000000
                                      0x00000000
                                      0x04ec7afb
                                      0x04ec7afc
                                      0x04ec7afe
                                      0x00000000
                                      0x00000000
                                      0x04ec7b00
                                      0x04ec7b03
                                      0x00000000
                                      0x00000000
                                      0x04ec7b05
                                      0x04ec7b09
                                      0x04ec7b0d
                                      0x04ec7b0f
                                      0x00000000
                                      0x00000000
                                      0x04ec7b18
                                      0x04ec7b1d
                                      0x00000000
                                      0x04ec7b1d
                                      0x04ec7ab7
                                      0x04ec7ab9
                                      0x00000000
                                      0x00000000
                                      0x04ec7abf
                                      0x04ec7ac1
                                      0x00000000
                                      0x00000000
                                      0x04ec7ac3
                                      0x04ec7ac6
                                      0x00000000
                                      0x00000000
                                      0x04ec7ac8
                                      0x04ec7acc
                                      0x04ec7ad0
                                      0x04ec7ad2
                                      0x00000000
                                      0x00000000
                                      0x04ec7adb
                                      0x00000000
                                      0x04ec7adb
                                      0x04ec79d6
                                      0x04ec79d9
                                      0x04ec79dc
                                      0x04ec7a91
                                      0x04ec7a94
                                      0x00000000
                                      0x04ec7a94
                                      0x04ec79e2
                                      0x00000000
                                      0x04ec79e2
                                      0x04ec7a74
                                      0x04ec7a7a
                                      0x00000000
                                      0x00000000
                                      0x04ec7a8a
                                      0x04ec7a21
                                      0x04ec7a21
                                      0x00000000
                                      0x04ec7a21
                                      0x04e5c650
                                      0x04e5c651
                                      0x04e5c656
                                      0x04e5c65c
                                      0x04e5c65d
                                      0x04e5c663
                                      0x04e5c664
                                      0x04e5c66a
                                      0x04e5c66e
                                      0x04ec79c5
                                      0x04ec79c7
                                      0x00000000
                                      0x04ec79c7
                                      0x04e5c67a
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 24e0940ead12fb78dd22a9ec98d70a52b9c1007c81ca857193745d94efd0275a
                                      • Instruction ID: f8944b019c036f6f1fb345307d5370befdc940efdafae24775d11825602f4f7f
                                      • Opcode Fuzzy Hash: 24e0940ead12fb78dd22a9ec98d70a52b9c1007c81ca857193745d94efd0275a
                                      • Instruction Fuzzy Hash: 6C8170756442029BDB25CF14CA80A7A77E5FB84798F15986EED859B240E330FD42CFA2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EEB8D0 Relevance: .2, Instructions: 199COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 39%
                                      			E04EEB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4f47b9c; // 0x0
				_t124 = L04E74620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04E99800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E04E995B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E04E995D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L04E777F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04E99910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E04E995D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4f47b9c; // 0x0
									_t92 = L04E74620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04E99910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E04E5A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E04EEE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E04EEE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E04E995B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}




















                                      0x04eeb8d9
                                      0x04eeb8e4
                                      0x00000000
                                      0x04eeb8e6
                                      0x04eeb8f3
                                      0x04eeb8f5
                                      0x04eeb8f5
                                      0x04eeb8f8
                                      0x04eeb920
                                      0x04eeb924
                                      0x04eeb936
                                      0x04eeb939
                                      0x04eeb93d
                                      0x04eeb948
                                      0x04eeb9a0
                                      0x04eeb9a0
                                      0x04eeb9a4
                                      0x04eeb9bf
                                      0x04eeb9c4
                                      0x04eeb9c6
                                      0x04eeb9cd
                                      0x04eeb9d1
                                      0x04eebad4
                                      0x04eebad8
                                      0x04eebada
                                      0x04eebadc
                                      0x04eebadc
                                      0x04eebadf
                                      0x04eebae0
                                      0x04eebae2
                                      0x04eebae4
                                      0x04eebaec
                                      0x04eebaee
                                      0x04eebaf0
                                      0x04eebaf0
                                      0x04eebaec
                                      0x04eebafb
                                      0x04eebafc
                                      0x04eebafe
                                      0x04eebb01
                                      0x04eebb01
                                      0x00000000
                                      0x04eebb06
                                      0x04eeb9d7
                                      0x04eeb9db
                                      0x04eeb9db
                                      0x04eeb9de
                                      0x04eeb9de
                                      0x04eeb9e4
                                      0x04eeb9e7
                                      0x04eeb9ea
                                      0x04eeb9ec
                                      0x04eeb9ef
                                      0x04eeb9f3
                                      0x04eeba1b
                                      0x04eeba1b
                                      0x04eeba23
                                      0x04eeba24
                                      0x04eeba27
                                      0x04eeba2a
                                      0x04eeba2b
                                      0x04eeba2e
                                      0x04eeba30
                                      0x04eeba37
                                      0x04eeba3f
                                      0x04eeba9c
                                      0x04eebaa2
                                      0x04eebb13
                                      0x04eebb15
                                      0x04eebaae
                                      0x04eebaae
                                      0x04eebab3
                                      0x04eebab5
                                      0x04eebaba
                                      0x04eebac8
                                      0x04eebac8
                                      0x04eebaba
                                      0x04eebacd
                                      0x04eebacf
                                      0x00000000
                                      0x04eebacf
                                      0x04eebb1a
                                      0x00000000
                                      0x04eebb1c
                                      0x04eebaa7
                                      0x04eebb11
                                      0x00000000
                                      0x04eebb11
                                      0x04eebaa9
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eeba41
                                      0x04eeba41
                                      0x04eeba41
                                      0x04eeba58
                                      0x04eeba5d
                                      0x04eeba62
                                      0x00000000
                                      0x00000000
                                      0x04eeba64
                                      0x04eeba67
                                      0x04eeba68
                                      0x04eeba69
                                      0x04eeba6c
                                      0x04eeba6f
                                      0x04eeba71
                                      0x04eeba78
                                      0x04eeba80
                                      0x00000000
                                      0x00000000
                                      0x04eeba90
                                      0x04eeba90
                                      0x04eeba97
                                      0x00000000
                                      0x04eeba97
                                      0x04eeb9f5
                                      0x04eeb9f7
                                      0x04eeb9f7
                                      0x04eeb9fa
                                      0x04eeba03
                                      0x04eeba07
                                      0x04eeba0c
                                      0x04eeba10
                                      0x04eeba17
                                      0x00000000
                                      0x04eeb9f7
                                      0x04eeb9a6
                                      0x04eeb9a8
                                      0x04eeb9af
                                      0x04eeb9b3
                                      0x00000000
                                      0x00000000
                                      0x04eeb9b9
                                      0x00000000
                                      0x04eeb9b9
                                      0x04eeb94d
                                      0x04eeb98f
                                      0x04eeb995
                                      0x04eeb999
                                      0x04eeb960
                                      0x04eeb967
                                      0x04eeb968
                                      0x04eeb96a
                                      0x00000000
                                      0x04eeb96a
                                      0x04eeb99b
                                      0x04eeb99e
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eeb99e
                                      0x04eeb951
                                      0x04eeb954
                                      0x04eeb95a
                                      0x04eeb95e
                                      0x04eeb972
                                      0x04eeb979
                                      0x04eeb97d
                                      0x04eeb97f
                                      0x04eeb980
                                      0x04eeb982
                                      0x04eeb984
                                      0x00000000
                                      0x04eeb984
                                      0x00000000
                                      0x04eeb926
                                      0x00000000
                                      0x04eeb926

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9592a56d6b5c09d7fbe2fc388048ef7a03f48f23a6bb86f91684ca9aca4ac58e
                                      • Instruction ID: 9907daf088b128da48e8ff0576258a64c0ceff9271148149b74c60b82951c9e7
                                      • Opcode Fuzzy Hash: 9592a56d6b5c09d7fbe2fc388048ef7a03f48f23a6bb86f91684ca9aca4ac58e
                                      • Instruction Fuzzy Hash: 6D71FD72200701AFEB32DF16C840F66BBE5EF40728F105928E6998B2E1EB75F941DB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E552A5 Relevance: .2, Instructions: 161COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 80%
                                      			E04E552A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E04E6EEF0(0x4f479a0);
					_t104 =  *0x4f48210; // 0x33e1cd0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E04E6EB70(_t93, 0x4f479a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E04E99890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E04E6EEF0(0x4f479a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E04E6EB70(0, 0x4f479a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0x3e1ce802
								_t13 = _t104 + 0xc; // 0x33e1cdd
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E04E8F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E04E6EEF0(0x4f479a0);
									__eflags =  *0x4f48210 - _t104; // 0x33e1cd0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4f48210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x20033e1c
											_t95 =  *((intOrPtr*)( *_t37));
											E04ED4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E04E6EB70(_t95, 0x4f479a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E04E995D0();
											L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E04E995D0();
											L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E04E6EB70(_t93, 0x4f479a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E04E995D0();
										L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E04E995D0();
										L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x20033e1c
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0x3e1ce802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E04E8F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

























                                      0x04e552a5
                                      0x04e552ad
                                      0x04e552b0
                                      0x04e552b3
                                      0x04e552b7
                                      0x04e552ba
                                      0x04e552bf
                                      0x04e552c4
                                      0x04e552cc
                                      0x00000000
                                      0x00000000
                                      0x04e552ce
                                      0x04e552d1
                                      0x04e552d9
                                      0x04e552dd
                                      0x04e552e7
                                      0x04e552f7
                                      0x04e552f9
                                      0x04e552fd
                                      0x04eb0dcf
                                      0x04eb0dd5
                                      0x04eb0dd6
                                      0x04eb0dd7
                                      0x04eb0dd8
                                      0x04eb0dd9
                                      0x04eb0dde
                                      0x04eb0ddf
                                      0x04eb0de0
                                      0x04eb0de1
                                      0x04eb0de2
                                      0x04eb0de2
                                      0x04eb0de5
                                      0x04eb0dea
                                      0x04eb0dec
                                      0x04eb0f60
                                      0x04eb0f64
                                      0x04eb0f70
                                      0x04eb0f76
                                      0x04eb0f79
                                      0x04eb0f79
                                      0x00000000
                                      0x04eb0f64
                                      0x04eb0df2
                                      0x04eb0df7
                                      0x04eb0e04
                                      0x04eb0e04
                                      0x04eb0e0d
                                      0x04eb0e0d
                                      0x04eb0e10
                                      0x04eb0e1a
                                      0x04eb0e1c
                                      0x04eb0e4c
                                      0x04eb0e52
                                      0x04eb0e61
                                      0x04eb0e67
                                      0x04eb0e6b
                                      0x04eb0e70
                                      0x04eb0e76
                                      0x04eb0ed7
                                      0x04eb0edc
                                      0x04eb0ee0
                                      0x04eb0ee6
                                      0x04eb0eea
                                      0x04eb0eed
                                      0x04eb0ef0
                                      0x04eb0ef3
                                      0x04eb0ef6
                                      0x04eb0ef9
                                      0x04eb0efb
                                      0x04eb0efe
                                      0x04eb0f01
                                      0x04eb0f01
                                      0x04eb0f0b
                                      0x04eb0f12
                                      0x04eb0f16
                                      0x04eb0f18
                                      0x04eb0f18
                                      0x04eb0f1b
                                      0x04eb0f2c
                                      0x04eb0f31
                                      0x04eb0f31
                                      0x04eb0f35
                                      0x04eb0f39
                                      0x04eb0f3a
                                      0x04eb0f3c
                                      0x04eb0f3c
                                      0x04eb0f3f
                                      0x04eb0f50
                                      0x04eb0f55
                                      0x04eb0f55
                                      0x04eb0f59
                                      0x04e552eb
                                      0x04e552f1
                                      0x04e552f1
                                      0x04eb0e7d
                                      0x04eb0e84
                                      0x04eb0e88
                                      0x04eb0e8a
                                      0x04eb0e8a
                                      0x04eb0e8d
                                      0x04eb0e9e
                                      0x04eb0ea3
                                      0x04eb0ea3
                                      0x04eb0ea7
                                      0x04eb0eaf
                                      0x04eb0eb3
                                      0x04eb0eb9
                                      0x04eb0eb9
                                      0x04eb0ebc
                                      0x04eb0ecd
                                      0x04eb0ecd
                                      0x00000000
                                      0x04eb0eb3
                                      0x04eb0e1e
                                      0x04eb0e21
                                      0x04eb0e25
                                      0x04eb0e2b
                                      0x04eb0e2f
                                      0x04eb0e30
                                      0x04eb0e3a
                                      0x04eb0e3f
                                      0x04eb0e41
                                      0x00000000
                                      0x00000000
                                      0x04eb0e47
                                      0x00000000
                                      0x04eb0e47
                                      0x04eb0df9
                                      0x04eb0dfe
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb0dfe
                                      0x04e55303
                                      0x04e55307
                                      0x00000000
                                      0x04e55309
                                      0x00000000
                                      0x04e55309
                                      0x04e55307
                                      0x04e552e9
                                      0x04e552e9
                                      0x00000000
                                      0x04e552e9
                                      0x04e5530e
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 84822437cb00134d0de96b4c11c2db530494e1439863f71a2360edf545bed405
                                      • Instruction ID: d7f1bb834b9b8bbbb0137c1bb40dade358fd32618f10dd2695d1777a92a8ff38
                                      • Opcode Fuzzy Hash: 84822437cb00134d0de96b4c11c2db530494e1439863f71a2360edf545bed405
                                      • Instruction Fuzzy Hash: 2D51E175245341AFEB21EF68C840B67BBE4FF80718F14591EE895876A1EB70F805CB92
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E82AE4 Relevance: .2, Instructions: 159COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E82AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4f48204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4f48208; // 0x4f48207
				_t8 = _t57 + 0x4f48208; // 0x4f48207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4f48450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x4f4821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4f46d5c; // 0x7f530654
							_t72 =  *0x4f46d5c; // 0x7f530654
							_t75 =  *0x4f46d5c; // 0x7f530654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4f46d5c; // 0x7f530654
							_t84 =  *0x4f46d5c; // 0x7f530654
							_t87 =  *0x4f46d5c; // 0x7f530654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E04E9F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}






































                                      0x04e82ae4
                                      0x04e82aec
                                      0x04e82aef
                                      0x04e82af4
                                      0x04e82af7
                                      0x04e82afd
                                      0x04e82b92
                                      0x04e82b92
                                      0x04e82b97
                                      0x04e82b9c
                                      0x04e82b9c
                                      0x04e82b03
                                      0x04e82b06
                                      0x04e82b09
                                      0x04e82b09
                                      0x04e82b0f
                                      0x04e82b15
                                      0x04e82b15
                                      0x04e82b1b
                                      0x04e82b1e
                                      0x04e82b21
                                      0x04e82b26
                                      0x04e82b29
                                      0x04e82b81
                                      0x04e82b84
                                      0x04e82c0e
                                      0x04e82c15
                                      0x04e82c24
                                      0x04e82c24
                                      0x04e82b8a
                                      0x04e82b8a
                                      0x04e82b8a
                                      0x04e82b8a
                                      0x04e82b90
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e82b4a
                                      0x04e82b4a
                                      0x04e82b4d
                                      0x04e82b53
                                      0x00000000
                                      0x00000000
                                      0x04e82b55
                                      0x04e82b58
                                      0x04e82bb7
                                      0x04ec5d1b
                                      0x04ec5d37
                                      0x04ec5d47
                                      0x04ec5d53
                                      0x04e82bbd
                                      0x04e82bbd
                                      0x04e82bbd
                                      0x04e82bb7
                                      0x04e82b5d
                                      0x04e82c2f
                                      0x04ec5d5b
                                      0x04ec5d77
                                      0x04ec5d87
                                      0x04ec5d93
                                      0x04e82c35
                                      0x04e82c35
                                      0x04e82c35
                                      0x04e82c2f
                                      0x04e82b65
                                      0x04e82b9f
                                      0x04e82ba2
                                      0x04e82b67
                                      0x04e82b67
                                      0x04e82b69
                                      0x04e82b6b
                                      0x04e82b6e
                                      0x04e82bc9
                                      0x04e82bcc
                                      0x04e82bcf
                                      0x04e82bd4
                                      0x04e82bd6
                                      0x04e82bd6
                                      0x04e82bdb
                                      0x04e82c02
                                      0x04e82c05
                                      0x04e82c07
                                      0x00000000
                                      0x04e82c07
                                      0x04e82be0
                                      0x04e82c00
                                      0x04e82c3f
                                      0x04e82c3f
                                      0x00000000
                                      0x04e82c00
                                      0x04e82be5
                                      0x04e82be7
                                      0x04e82bec
                                      0x04e82bf4
                                      0x04e82bf6
                                      0x00000000
                                      0x04e82bf6
                                      0x04e82b70
                                      0x04e82b76
                                      0x04e82b2b
                                      0x04e82b2b
                                      0x04e82b2d
                                      0x04e82b2f
                                      0x04e82b32
                                      0x04e82b35
                                      0x04e82b3a
                                      0x00000000
                                      0x04e82b40
                                      0x04e82b43
                                      0x04e82b45
                                      0x04e82b47
                                      0x04e82b4a
                                      0x04e82b4d
                                      0x04e82b53
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e82b53
                                      0x04e82b78
                                      0x04e82b78
                                      0x04e82b7b
                                      0x04e82b7e
                                      0x00000000
                                      0x04e82b7e
                                      0x04e82b76
                                      0x04e82ba5
                                      0x04e82ba5
                                      0x04e82ba8
                                      0x04e82bad
                                      0x00000000
                                      0x00000000
                                      0x04e82baf
                                      0x04e82baf
                                      0x04e82bc2
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c76a6833c5b3fcfd505c4dc63ec3abb9ec5c39e4996f5db7c1c26ef72ed58118
                                      • Instruction ID: 43af84520b70f3e5ba2d8b5572968f334b88ed7ff97aba417e6840d25d9ab041
                                      • Opcode Fuzzy Hash: c76a6833c5b3fcfd505c4dc63ec3abb9ec5c39e4996f5db7c1c26ef72ed58118
                                      • Instruction Fuzzy Hash: F4518D7AB011258BCB14EF18C8909BDB7B1FBD8700715849EE94E9B360E634BE519B90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6EF40 Relevance: .1, Instructions: 147COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 96%
                                      			E04E6EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04E59080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x774ac21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04E52D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}




























                                      0x04e6ef4b
                                      0x04e6ef4d
                                      0x04e6ef57
                                      0x04e6f0bd
                                      0x04e6f0c2
                                      0x04e6f0d2
                                      0x04e6f0d2
                                      0x04e6f0c2
                                      0x04e6ef5d
                                      0x04e6ef5f
                                      0x04e6ef67
                                      0x04e6ef6a
                                      0x04e6ef6d
                                      0x04e6ef74
                                      0x04e6ef7f
                                      0x04e6ef82
                                      0x04e6ef82
                                      0x04e6ef86
                                      0x04e6ef88
                                      0x04e6ef8c
                                      0x04e6ef8f
                                      0x04e6ef8f
                                      0x04e6ef8f
                                      0x00000000
                                      0x04e6ef91
                                      0x04e6ef93
                                      0x04e6efc4
                                      0x04e6efc4
                                      0x04e6efc4
                                      0x04e6efca
                                      0x04e6efd0
                                      0x04e6f0a6
                                      0x00000000
                                      0x00000000
                                      0x04e6f0af
                                      0x04ebbb06
                                      0x04ebbb0a
                                      0x04e6f0b5
                                      0x04e6f0b5
                                      0x04e6f0b5
                                      0x04e6f0b5
                                      0x00000000
                                      0x04e6efd6
                                      0x04e6efd9
                                      0x04e6f0de
                                      0x04e6f0e2
                                      0x04e6efdf
                                      0x04e6efdf
                                      0x04e6efdf
                                      0x04e6efe5
                                      0x04ebbafc
                                      0x04ebbafc
                                      0x04e6efe5
                                      0x04e6efeb
                                      0x04e6efed
                                      0x04e6f00f
                                      0x04e6f011
                                      0x04e6f01a
                                      0x04e6f01d
                                      0x04e6f021
                                      0x04e6f028
                                      0x04e6f029
                                      0x04e6f029
                                      0x04e6f02c
                                      0x00000000
                                      0x04e6f02c
                                      0x04e6eff3
                                      0x04e6eff9
                                      0x04e6f0ea
                                      0x04e6f0ed
                                      0x04e6f0ef
                                      0x00000000
                                      0x04e6f0ef
                                      0x04e6f003
                                      0x04ebbb12
                                      0x04e6f045
                                      0x04e6f049
                                      0x04e6f051
                                      0x04e6f09e
                                      0x04e6f0a0
                                      0x04e6f0a0
                                      0x04e6f09e
                                      0x04e6f053
                                      0x04e6f064
                                      0x04e6f064
                                      0x04e6f06b
                                      0x04ebbb1a
                                      0x04ebbb1a
                                      0x04e6f071
                                      0x04e6f071
                                      0x04e6f07d
                                      0x04e6f082
                                      0x04e6f08f
                                      0x04e6f08f
                                      0x04e6f009
                                      0x04e6f00d
                                      0x00000000
                                      0x04e6f00d
                                      0x04e6efd0
                                      0x04e6ef97
                                      0x04e6efa5
                                      0x04e6efaa
                                      0x00000000
                                      0x04e6efac
                                      0x04e6efac
                                      0x04e6efac
                                      0x00000000
                                      0x04e6efb2
                                      0x04e6f036
                                      0x04e6f03a
                                      0x04e6f040
                                      0x04e6f090
                                      0x00000000
                                      0x04e6f092
                                      0x04e6f042
                                      0x00000000
                                      0x04e6f042
                                      0x04e6efb7
                                      0x04e6efb9
                                      0x04e6efbc
                                      0x04e6efb0
                                      0x04e6efb0
                                      0x00000000
                                      0x04e6efbe
                                      0x04e6efbe
                                      0x04e6efc1
                                      0x00000000
                                      0x04e6efc1
                                      0x04e6efbc
                                      0x04e6efaa
                                      0x04e6ef91

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                      • Instruction ID: 89f12ab04e76235401fd6e0a42f4155d943383a3d58ced42f9a6aaade6e247af
                                      • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                      • Instruction Fuzzy Hash: 04511230E44249EFDB20CF68D1D07EEBBB1AF05358F18A1ACC55697282D376B989D781
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F2740D Relevance: .1, Instructions: 141COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 84%
                                      			E04F2740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E04EAD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E04E9F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04E74620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04E74620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E04E9F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04E74620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}





















                                      0x04f2740d
                                      0x04f2740d
                                      0x04f27412
                                      0x04f27413
                                      0x04f27416
                                      0x04f27418
                                      0x04f2741c
                                      0x04f2741f
                                      0x04f27422
                                      0x04f27422
                                      0x04f27428
                                      0x04f2742a
                                      0x04f2742a
                                      0x04f27451
                                      0x04f27432
                                      0x04f2744f
                                      0x04f2744f
                                      0x00000000
                                      0x04f27434
                                      0x04f27438
                                      0x04f27443
                                      0x04f27517
                                      0x04f27517
                                      0x04f2751a
                                      0x04f27535
                                      0x04f27520
                                      0x04f27527
                                      0x04f2752c
                                      0x04f27531
                                      0x04f27533
                                      0x00000000
                                      0x04f27533
                                      0x00000000
                                      0x04f27531
                                      0x04f2754b
                                      0x04f2754f
                                      0x04f2755c
                                      0x04f2755c
                                      0x04f2755f
                                      0x04f27560
                                      0x04f27561
                                      0x04f27562
                                      0x04f27563
                                      0x04f27568
                                      0x04f2756a
                                      0x04f2756c
                                      0x04f2756d
                                      0x04f2756d
                                      0x04f2756f
                                      0x04f27572
                                      0x04f27574
                                      0x04f27577
                                      0x04f2757c
                                      0x04f2757f
                                      0x00000000
                                      0x04f27551
                                      0x04f27551
                                      0x04f27551
                                      0x04f27553
                                      0x04f27553
                                      0x04f27449
                                      0x04f27449
                                      0x04f2744c
                                      0x04f2744c
                                      0x00000000
                                      0x04f2744c
                                      0x04f27443
                                      0x04f2750e
                                      0x04f27514
                                      0x04f27514
                                      0x04f27455
                                      0x04f27469
                                      0x04f2746d
                                      0x00000000
                                      0x04f27473
                                      0x04f27473
                                      0x04f27476
                                      0x04f27480
                                      0x04f27484
                                      0x04f2748e
                                      0x04f27493
                                      0x04f27493
                                      0x04f27496
                                      0x04f27499
                                      0x04f274a1
                                      0x04f274b1
                                      0x04f274b5
                                      0x00000000
                                      0x04f274bb
                                      0x04f274c1
                                      0x04f274c1
                                      0x04f274c4
                                      0x04f274c5
                                      0x04f274c6
                                      0x04f274c7
                                      0x04f274c8
                                      0x04f274cd
                                      0x00000000
                                      0x04f274d3
                                      0x04f274d3
                                      0x04f274d6
                                      0x04f274d8
                                      0x04f274db
                                      0x04f274dd
                                      0x04f274e0
                                      0x04f274e7
                                      0x04f274ee
                                      0x04f274ee
                                      0x04f274f4
                                      0x04f274f9
                                      0x00000000
                                      0x04f274fb
                                      0x04f274fb
                                      0x04f274fd
                                      0x04f27500
                                      0x04f27503
                                      0x04f27505
                                      0x04f27505
                                      0x04f274f9
                                      0x00000000
                                      0x04f274cd
                                      0x04f274b5
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                      • Instruction ID: c11752442f85a649d10509fff7885e84086e9cc9f009a3018f0b7ba6f7dc0a74
                                      • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                      • Instruction Fuzzy Hash: B2517971A00606EFDB15DF54C981A96FBF5FF49304F1481AAE9089F252E371F986CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E82990 Relevance: .1, Instructions: 133COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 97%
                                      			E04E82990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x4f2ff00);
				E04EAD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x4e31664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E04E9E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x4e31668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E04ED51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x4e3166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04E82AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04E66600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04E82C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E04E6EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04E82AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04E82C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04E82ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E04EAD0D1(_t62);
				goto L28;
			}





















                                      0x04e82990
                                      0x04e82992
                                      0x04e82997
                                      0x04e829a3
                                      0x04e829a6
                                      0x04e829ab
                                      0x04e829ad
                                      0x04e829b2
                                      0x04ec5c80
                                      0x04e829b8
                                      0x04e829b8
                                      0x04e829bb
                                      0x04e829c0
                                      0x04e829c5
                                      0x04e829c6
                                      0x04e829c6
                                      0x04e829cb
                                      0x00000000
                                      0x00000000
                                      0x04e829cd
                                      0x04e829d0
                                      0x04e829d9
                                      0x04e829db
                                      0x04e829dd
                                      0x04e82a7f
                                      0x04e82a84
                                      0x04e82a87
                                      0x04e82a89
                                      0x04ec5ca1
                                      0x04ec5ca3
                                      0x00000000
                                      0x04e82a8f
                                      0x04e82a8f
                                      0x00000000
                                      0x04e82a8f
                                      0x00000000
                                      0x04e829e3
                                      0x04e829e3
                                      0x04e829e3
                                      0x00000000
                                      0x04e829e3
                                      0x04e829dd
                                      0x00000000
                                      0x04e829db
                                      0x04e829e6
                                      0x04e829e9
                                      0x04e829eb
                                      0x04e829ed
                                      0x04e829f3
                                      0x04e829f5
                                      0x04e829f8
                                      0x04e829fa
                                      0x04e82a97
                                      0x04e82a9a
                                      0x04e82a9d
                                      0x04e82add
                                      0x00000000
                                      0x04e82a9f
                                      0x04e82aa2
                                      0x04e82aa5
                                      0x04e82aa8
                                      0x04e82aab
                                      0x04ec5cab
                                      0x04ec5caf
                                      0x04ec5cc5
                                      0x04ec5cda
                                      0x04ec5cdc
                                      0x04ec5cdf
                                      0x04ec5ce5
                                      0x00000000
                                      0x04ec5ceb
                                      0x04ec5ced
                                      0x04ec5cee
                                      0x00000000
                                      0x04ec5cee
                                      0x04ec5cb1
                                      0x04ec5cb4
                                      0x04ec5cb9
                                      0x04ec5cbb
                                      0x00000000
                                      0x04ec5cbd
                                      0x04ec5cbd
                                      0x00000000
                                      0x04ec5cbd
                                      0x04ec5cbb
                                      0x04e82ab1
                                      0x04e82ab1
                                      0x04e82ac4
                                      0x04e82ac6
                                      0x04e82ac6
                                      0x00000000
                                      0x04e82ac6
                                      0x04e82aab
                                      0x00000000
                                      0x04e82a00
                                      0x04e82a09
                                      0x04e82a0e
                                      0x04e82a21
                                      0x04e82a24
                                      0x04e82a35
                                      0x04e82a3a
                                      0x04e82a3d
                                      0x04e82a42
                                      0x04e82a59
                                      0x04e82a59
                                      0x04e82a5c
                                      0x04e82a5f
                                      0x04e82a5f
                                      0x04e829fa
                                      0x04e829f3
                                      0x04e82a64
                                      0x04e82a64
                                      0x04e82a6b
                                      0x04e82a6b
                                      0x04e82a6d
                                      0x04e82a72
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b9dbf10961e45952a9a546295405913564fd67dca64566d07641535da29514d9
                                      • Instruction ID: 6e406c75f710291a87e512ce6b5aed1188b63e486f7100f2ae6b5969cdf3064e
                                      • Opcode Fuzzy Hash: b9dbf10961e45952a9a546295405913564fd67dca64566d07641535da29514d9
                                      • Instruction Fuzzy Hash: 35516C71A00219EFDF25EF94C980ADEBBB5BF08718F059099E9186B250D331ED52DF90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E84D3B Relevance: .1, Instructions: 131COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 78%
                                      			E04E84D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x4f4d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E04E9FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4f47bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E04E9B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04E74620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E04E5CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E04E9B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E04E9F380(_t67 + 0xc, 0x4e35138, 0x10) == 0) {
								 *0x4f460d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04E84F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04E84E70(0x4f486b0, 0x4e85690, 0, 0) != 0) {
					_t46 = E04E5CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}




















                                      0x04e84d3b
                                      0x04e84d4d
                                      0x04e84d53
                                      0x04e84d58
                                      0x04e84d65
                                      0x04e84d6c
                                      0x04e84d71
                                      0x04e84d77
                                      0x04e84d7f
                                      0x04e84d8c
                                      0x04e84d8e
                                      0x04e84dad
                                      0x04e84db0
                                      0x04e84db7
                                      0x04e84db8
                                      0x04e84db9
                                      0x04e84dba
                                      0x04e84dbb
                                      0x04e84dc1
                                      0x04e84dc8
                                      0x04e84dcc
                                      0x04e84dd5
                                      0x04e84dde
                                      0x04e84ddf
                                      0x04e84de0
                                      0x04e84de1
                                      0x04e84de6
                                      0x04e84de7
                                      0x04e84de9
                                      0x04e84df3
                                      0x00000000
                                      0x00000000
                                      0x04ec6c7c
                                      0x04ec6c8a
                                      0x04ec6c8a
                                      0x04ec6c9d
                                      0x04ec6ca7
                                      0x04ec6cac
                                      0x04ec6cb2
                                      0x04ec6cb9
                                      0x00000000
                                      0x04ec6cbf
                                      0x04ec6cbf
                                      0x00000000
                                      0x04ec6cbf
                                      0x04ec6cb9
                                      0x04e84dfb
                                      0x04ec6ccf
                                      0x04ec6cd3
                                      0x04e84e32
                                      0x04e84e39
                                      0x04ec6ce0
                                      0x04ec6cf2
                                      0x04ec6cf2
                                      0x04ec6ce0
                                      0x04e84e3f
                                      0x04e84e41
                                      0x04e84e51
                                      0x04e84e51
                                      0x04e84e03
                                      0x04e84e03
                                      0x04e84e09
                                      0x04e84e0f
                                      0x04e84e57
                                      0x00000000
                                      0x00000000
                                      0x04e84e1b
                                      0x04e84e30
                                      0x04e84e5b
                                      0x04e84e5b
                                      0x00000000
                                      0x04e84e30
                                      0x04e84e11
                                      0x04e84e11
                                      0x04e84e16
                                      0x00000000
                                      0x04e84e16
                                      0x04e84e01
                                      0x00000000
                                      0x04e84e01
                                      0x04e84da5
                                      0x04ec6c6b
                                      0x00000000
                                      0x04e84dab
                                      0x04e84dab
                                      0x00000000
                                      0x04e84dab

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d7a00974ef37a7f633fc061af766374f2a644ebde3dbc0a8f568d1ebe6ea9005
                                      • Instruction ID: b41d9934640cd36362dbfcc3e45ee359422560627791115af4625d40e8c95b45
                                      • Opcode Fuzzy Hash: d7a00974ef37a7f633fc061af766374f2a644ebde3dbc0a8f568d1ebe6ea9005
                                      • Instruction Fuzzy Hash: 67417275640318AFEF21EF14C980FA677A5EB45718F04509DE94D9B2C0E774FD44CA91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E68A0A Relevance: .1, Instructions: 120COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 94%
                                      			E04E68A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x4f4d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E04E9B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E04E6E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x4e31180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04E81DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04E93C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04E68999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}



























                                      0x04e68a0a
                                      0x04e68a1c
                                      0x04e68a23
                                      0x04e68a2e
                                      0x04e68a30
                                      0x04e68a36
                                      0x04e68a3c
                                      0x04e68a3e
                                      0x04e68a4a
                                      0x04e68a52
                                      0x04e68a9c
                                      0x04e68aae
                                      0x04e68a58
                                      0x04e68a5e
                                      0x04e68a6a
                                      0x04e68a6f
                                      0x04e68a75
                                      0x04e68a7d
                                      0x04e68a85
                                      0x04e68a86
                                      0x04e68a89
                                      0x04e68a93
                                      0x04e68a99
                                      0x04e68a9b
                                      0x00000000
                                      0x04e68aaf
                                      0x04e68abe
                                      0x04e68ac3
                                      0x04e68acb
                                      0x04e68ad7
                                      0x04e68ae0
                                      0x04e68af1
                                      0x00000000
                                      0x04e68af1
                                      0x04e68acd
                                      0x04e68ad5
                                      0x04e68afb
                                      0x04e68afd
                                      0x04e68aff
                                      0x04e68b07
                                      0x04e68b22
                                      0x04e68b24
                                      0x04e68b2a
                                      0x04e68b2e
                                      0x04e68b3f
                                      0x04e68b78
                                      0x04e68b41
                                      0x04e68b52
                                      0x04e68b54
                                      0x04e68b5c
                                      0x04e68b74
                                      0x04e68b74
                                      0x04e68b5c
                                      0x04e68b3f
                                      0x04e68b5e
                                      0x04e68b61
                                      0x04e68b64
                                      0x04e68b64
                                      0x04e68b6c
                                      0x04e68b6c
                                      0x04e68b11
                                      0x04eb9cd5
                                      0x04eb9cd5
                                      0x04e68b17
                                      0x04e68b1a
                                      0x04e68b1a
                                      0x00000000
                                      0x04e68ad5
                                      0x04e68a89

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 93f10dfee5cf42174cca0ff97a4a5a38bf62867d0d094e17dc90921b91e9306b
                                      • Instruction ID: d540aae2667bbdf070dad584d52ca38aeae43131b2f77296c7700b0f33114a20
                                      • Opcode Fuzzy Hash: 93f10dfee5cf42174cca0ff97a4a5a38bf62867d0d094e17dc90921b91e9306b
                                      • Instruction Fuzzy Hash: 284174B4A8122C9BDB64DF15CC88AE9B7F8FF44344F1055EAD85A97242E770AE80CF50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED69A6 Relevance: .1, Instructions: 108COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 69%
                                      			E04ED69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x4f4d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04E66C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E04ED6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04E99980() >= 0) {
							E04E72280(_t56, 0x4f48778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4f48774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4f48774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E04E5B6F0(0x4e3c338, 0x4e3c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04E99520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E04E995D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E04E6FFB0(_t68, _t77, 0x4f48778);
				}
				_pop(_t78);
				return E04E9B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}
































                                      0x04ed69b5
                                      0x04ed69be
                                      0x04ed69c3
                                      0x04ed69c9
                                      0x04ed69cc
                                      0x04ed69d1
                                      0x04ed69d3
                                      0x04ed69de
                                      0x04ed69e1
                                      0x04ed69ea
                                      0x04ed69f6
                                      0x04ed69fe
                                      0x04ed6a13
                                      0x04ed6a14
                                      0x04ed6a15
                                      0x04ed6a16
                                      0x04ed6a1e
                                      0x04ed6a26
                                      0x04ed6a31
                                      0x04ed6a36
                                      0x04ed6a37
                                      0x04ed6a40
                                      0x04ed6a49
                                      0x04ed6a4a
                                      0x04ed6a53
                                      0x04ed6a59
                                      0x04ed6a5d
                                      0x04ed6a5e
                                      0x04ed6a64
                                      0x04ed6a67
                                      0x04ed6a6a
                                      0x04ed6a6d
                                      0x04ed6a70
                                      0x04ed6a77
                                      0x04ed6a7d
                                      0x04ed6a86
                                      0x04ed6a89
                                      0x04ed6a9c
                                      0x04ed6a9f
                                      0x04ed6aa2
                                      0x04ed6aa5
                                      0x04ed6aaf
                                      0x04ed6ab1
                                      0x04ed6ab8
                                      0x04ed6ab9
                                      0x04ed6abb
                                      0x04ed6abe
                                      0x04ed6ac5
                                      0x04ed6ac5
                                      0x04ed6aaf
                                      0x04ed6a40
                                      0x04ed6a26
                                      0x04ed69fe
                                      0x04ed6ace
                                      0x04ed6ad0
                                      0x04ed6ad3
                                      0x04ed6ad8
                                      0x04ed6adf
                                      0x04ed6adf
                                      0x04ed6ae8
                                      0x04ed6aef
                                      0x04ed6aef
                                      0x04ed6af9
                                      0x04ed6b06

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e13f73ea3039e2d9c73032bdc7765784dd513f713ea44d3fda18ee8bf9d28bcf
                                      • Instruction ID: 7fbf927a7d6fec2e98227caa4c9affbf13026489cd2ecda22ab5d5d782e9c42b
                                      • Opcode Fuzzy Hash: e13f73ea3039e2d9c73032bdc7765784dd513f713ea44d3fda18ee8bf9d28bcf
                                      • Instruction Fuzzy Hash: 4C418BB5D00208AFDB24DFA5D940BFEBBF4EF48718F14912AE954A7240DB75A906CB50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E93D43 Relevance: .1, Instructions: 106COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E93D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04E67B60(0, _t61, 0x4e311c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04E67B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04E74620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}
















                                      0x04e93d4c
                                      0x04e93d50
                                      0x04e93d55
                                      0x04e93d5e
                                      0x04ece79a
                                      0x00000000
                                      0x04ece79a
                                      0x04e93d68
                                      0x04ece789
                                      0x04e93d9d
                                      0x04e93da3
                                      0x04e93daf
                                      0x04e93db5
                                      0x04e93dbc
                                      0x04e93dc4
                                      0x04e93dc9
                                      0x04e93dce
                                      0x04ece7ae
                                      0x04ece7ae
                                      0x04e93dde
                                      0x04e93de2
                                      0x04e93de7
                                      0x04e93e0d
                                      0x04e93e13
                                      0x04e93e16
                                      0x04e93e1e
                                      0x04e93e25
                                      0x04e93e28
                                      0x00000000
                                      0x00000000
                                      0x04e93e2a
                                      0x04e93e2f
                                      0x04e93e37
                                      0x04e93e37
                                      0x00000000
                                      0x04e93e37
                                      0x04e93e31
                                      0x00000000
                                      0x04e93e31
                                      0x04e93e20
                                      0x04e93e20
                                      0x04e93e35
                                      0x00000000
                                      0x04e93de9
                                      0x04e93de9
                                      0x04e93de9
                                      0x04e93dee
                                      0x04e93dfd
                                      0x04e93dff
                                      0x04e93e02
                                      0x04e93e05
                                      0x04e93e05
                                      0x00000000
                                      0x04e93df0
                                      0x04e93de7
                                      0x04ece78f
                                      0x04ece794
                                      0x04e93d79
                                      0x04e93d84
                                      0x04e93d89
                                      0x04e93d8e
                                      0x00000000
                                      0x04ece7a4
                                      0x04e93d96
                                      0x04e93d9a
                                      0x00000000
                                      0x04e93d9a
                                      0x00000000
                                      0x04ece794
                                      0x04e93d6e
                                      0x04e93d73
                                      0x00000000
                                      0x04ece7b5
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2ee11923f1486bac0f90dc424af1335736d46c609f711bb24e9be5626a2e67b7
                                      • Instruction ID: b158dce18659aa655ae02cc5eb6096053efc6c49664c20aa6edb9f2d36795348
                                      • Opcode Fuzzy Hash: 2ee11923f1486bac0f90dc424af1335736d46c609f711bb24e9be5626a2e67b7
                                      • Instruction Fuzzy Hash: 1C31AD35605615DBCB248F2DC851A6ABBE5EF59708B09A06EEC4ACB390E730EC41D790
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8A61C Relevance: .1, Instructions: 106COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 78%
                                      			E04E8A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4f30220);
				E04EAD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4f47b9c; // 0x0
				_t55 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E04EAD0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4f47b10 =  *0x4f47b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x4f4536c; // 0x33eb930
					if( *_t51 != 0x4f45368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4f45368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x4f4536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E04E8A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}


















                                      0x04e8a61c
                                      0x04e8a61e
                                      0x04e8a623
                                      0x04e8a628
                                      0x04e8a62b
                                      0x04e8a62d
                                      0x04e8a648
                                      0x04e8a64a
                                      0x04e8a64f
                                      0x04ec9b44
                                      0x04e8a6ec
                                      0x04e8a6f1
                                      0x04e8a6f1
                                      0x04e8a655
                                      0x04e8a657
                                      0x04e8a65a
                                      0x04e8a65d
                                      0x04e8a662
                                      0x04e8a663
                                      0x04e8a667
                                      0x04e8a668
                                      0x04e8a66d
                                      0x04e8a706
                                      0x04e8a706
                                      0x04ec9bda
                                      0x04ec9be6
                                      0x04ec9beb
                                      0x00000000
                                      0x04ec9beb
                                      0x04e8a679
                                      0x04ec9b7a
                                      0x00000000
                                      0x04ec9b7a
                                      0x04e8a683
                                      0x04e8a6f4
                                      0x04e8a6f7
                                      0x04e8a6f9
                                      0x04e8a6fd
                                      0x04e8a6a0
                                      0x04e8a6a0
                                      0x04e8a6ad
                                      0x04e8a6af
                                      0x04e8a6b4
                                      0x04ec9ba7
                                      0x04ec9bac
                                      0x00000000
                                      0x00000000
                                      0x04ec9bc6
                                      0x04ec9bce
                                      0x04ec9bd1
                                      0x04ec9bd3
                                      0x04ec9bd3
                                      0x00000000
                                      0x04ec9bd1
                                      0x04e8a6bd
                                      0x04e8a6c3
                                      0x04e8a6c6
                                      0x04e8a6d2
                                      0x04e8a701
                                      0x04e8a704
                                      0x00000000
                                      0x04e8a704
                                      0x04e8a6d4
                                      0x04e8a6d6
                                      0x04e8a6d9
                                      0x04e8a6db
                                      0x04e8a6e1
                                      0x04e8a6e6
                                      0x04e8a6e8
                                      0x04e8a6e8
                                      0x04e8a6ea
                                      0x00000000
                                      0x04e8a6ea
                                      0x04e8a688
                                      0x04e8a692
                                      0x04e8a694
                                      0x04e8a699
                                      0x00000000
                                      0x00000000
                                      0x04e8a69d
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5fdbf784bde3d4d8ee38d3cbb11f19a8f95603a1d0af83df58b56bb0b1a1e23c
                                      • Instruction ID: 969124fd5148c69fd8bf751d51c98a80fb383d260e577c60fdd4485753fa4d67
                                      • Opcode Fuzzy Hash: 5fdbf784bde3d4d8ee38d3cbb11f19a8f95603a1d0af83df58b56bb0b1a1e23c
                                      • Instruction Fuzzy Hash: 534178B5A00209EFDB14DF58D880BA9BBF2FF88704F1490AEE808AB345D774B901DB54
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED7016 Relevance: .1, Instructions: 104COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 76%
                                      			E04ED7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x4f4d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E04ED6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E04ED6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04E77D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04E99AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E04E9B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04E74620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}






















                                      0x04ed7016
                                      0x04ed701e
                                      0x04ed702b
                                      0x04ed7033
                                      0x04ed7037
                                      0x04ed703c
                                      0x04ed703e
                                      0x04ed7041
                                      0x04ed7045
                                      0x04ed704a
                                      0x04ed7050
                                      0x04ed7055
                                      0x04ed705a
                                      0x04ed7062
                                      0x04ed7062
                                      0x04ed705a
                                      0x04ed7064
                                      0x04ed7064
                                      0x04ed7067
                                      0x04ed7071
                                      0x04ed7096
                                      0x04ed709b
                                      0x04ed70a2
                                      0x04ed70a6
                                      0x04ed70a7
                                      0x04ed70ad
                                      0x04ed70b3
                                      0x04ed70b6
                                      0x04ed70bb
                                      0x04ed70c3
                                      0x04ed70c3
                                      0x04ed70c6
                                      0x04ed70cd
                                      0x04ed70dd
                                      0x04ed70e0
                                      0x04ed70e2
                                      0x04ed70e2
                                      0x04ed70ee
                                      0x04ed7101
                                      0x04ed70f0
                                      0x04ed70f9
                                      0x04ed70f9
                                      0x04ed710a
                                      0x04ed710e
                                      0x04ed7112
                                      0x04ed7117
                                      0x04ed7118
                                      0x04ed7118
                                      0x04ed70bb
                                      0x04ed711d
                                      0x04ed7123
                                      0x04ed7131
                                      0x04ed7131
                                      0x04ed7136
                                      0x04ed713d
                                      0x04ed713e
                                      0x04ed713f
                                      0x04ed714a
                                      0x04ed714a
                                      0x04ed7084
                                      0x04ed7088
                                      0x00000000
                                      0x04ed708e
                                      0x04ed708e
                                      0x04ed7092
                                      0x00000000
                                      0x04ed7092

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 55f0f847286b5ce452dd8529ec9056c9bbb42ac7563b8da7dfbe8e88c4eb2cd8
                                      • Instruction ID: 3fe6014f7a60c91ed49c7faca7e3108ad6342d4ddb28395be6fb1504d58c64c3
                                      • Opcode Fuzzy Hash: 55f0f847286b5ce452dd8529ec9056c9bbb42ac7563b8da7dfbe8e88c4eb2cd8
                                      • Instruction Fuzzy Hash: A731A2726047519FC320DF68C940A6AB7E9FFC8704F045A29F89587790E730F905CBA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7C182 Relevance: .1, Instructions: 104COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 68%
                                      			E04E7C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04E77D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04F28D34(_v8, _t80);
					}
					E04E72280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E04E6FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04F28833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E04E6FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E04E9B180();
						if(_a4 != 0) {
							E04E72280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E04E7BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E04E7BB2D(_t16, _t15);
						E04E7B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E04E6FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E04E6FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E04E6FFB0(0, __ecx, _t24);
				}
				return 0;
			}
















                                      0x04e7c18d
                                      0x04e7c18f
                                      0x04e7c191
                                      0x04e7c19b
                                      0x04e7c1a0
                                      0x04e7c1d4
                                      0x04e7c1de
                                      0x04ec2d6e
                                      0x04e7c1e4
                                      0x04e7c1e4
                                      0x04e7c1e4
                                      0x04e7c1ec
                                      0x04ec2d7d
                                      0x04ec2d7d
                                      0x04e7c1f3
                                      0x04e7c1ff
                                      0x04ec2d88
                                      0x04ec2d8d
                                      0x04ec2d94
                                      0x04ec2d94
                                      0x04ec2d9f
                                      0x04ec2da4
                                      0x04ec2dab
                                      0x04ec2db0
                                      0x04ec2db2
                                      0x04ec2db3
                                      0x04ec2db4
                                      0x04ec2dbc
                                      0x04ec2dc3
                                      0x04ec2dc3
                                      0x04e7c205
                                      0x04e7c205
                                      0x04e7c208
                                      0x04e7c20e
                                      0x04e7c211
                                      0x04e7c216
                                      0x04e7c219
                                      0x04e7c21f
                                      0x04e7c222
                                      0x04e7c22c
                                      0x04e7c234
                                      0x04e7c23a
                                      0x04e7c23f
                                      0x04e7c245
                                      0x04e7c24b
                                      0x04e7c251
                                      0x04e7c25a
                                      0x04e7c276
                                      0x04e7c27d
                                      0x04e7c27d
                                      0x04e7c25c
                                      0x04e7c25c
                                      0x00000000
                                      0x04e7c25e
                                      0x04e7c1a4
                                      0x04e7c1aa
                                      0x04e7c1b3
                                      0x04e7c265
                                      0x04e7c26c
                                      0x04e7c26c
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                      • Instruction ID: 70c9a9022c6c9c3b9aef7685130343a121084e63b1cab351082b16b1a8f5b6df
                                      • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                      • Instruction Fuzzy Hash: 35315C71B01586BEE704EBB4C580BE9F768BF4225CF1462AEC61C47241DB347A46D7A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8A70E Relevance: .1, Instructions: 96COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 92%
                                      			E04E8A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4f47b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4f47b10 = 8;
					 *0x4f47b14 = 0x4f47b0c;
					 *0x4f47b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E04E8A990(0x4f47b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L04E8A840(__edx, __ecx, __ecx, _t52, 0x4f47b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4f47b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0x4f47b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4f47b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L04E74620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4f47b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E04E9F3E0(_t50,  *0x4f47b14, _t8 >> 3);
						_t28 =  *0x4f47b14; // 0x775b7b0c
						__eflags = _t28 - 0x4f47b0c;
						if(_t28 != 0x4f47b0c) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0x4f47b14 = _t50;
						_t48 = _v12;
						 *0x4f47b10 = _t9;
						goto L6;
					}
					 *0x4f47b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}
















                                      0x04e8a713
                                      0x04e8a714
                                      0x04e8a717
                                      0x04e8a71d
                                      0x04e8a720
                                      0x04e8a722
                                      0x04e8a727
                                      0x04e8a74a
                                      0x04e8a754
                                      0x04e8a75e
                                      0x04e8a768
                                      0x04e8a76a
                                      0x04e8a773
                                      0x04e8a78b
                                      0x04e8a790
                                      0x04e8a792
                                      0x04e8a741
                                      0x04e8a741
                                      0x04e8a743
                                      0x04e8a749
                                      0x04e8a749
                                      0x04e8a732
                                      0x04e8a73a
                                      0x04e8a797
                                      0x04e8a79d
                                      0x04e8a7a3
                                      0x04e8a7a9
                                      0x04e8a7b6
                                      0x04e8a7bc
                                      0x04e8a7ca
                                      0x04e8a7e0
                                      0x04e8a7e2
                                      0x04e8a7e4
                                      0x04ec9bf2
                                      0x00000000
                                      0x04ec9bf2
                                      0x04e8a7ed
                                      0x04e8a7f2
                                      0x04e8a800
                                      0x04e8a805
                                      0x04e8a80d
                                      0x04e8a812
                                      0x04ec9c08
                                      0x04ec9c08
                                      0x04e8a818
                                      0x04e8a81b
                                      0x04e8a821
                                      0x04e8a824
                                      0x00000000
                                      0x04e8a824
                                      0x04e8a7ae
                                      0x00000000
                                      0x04e8a7ae
                                      0x04e8a73c
                                      0x04e8a73e
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6f6496ec0afc84a2fde1ab3f58a4fa32f02fc53f9a8079f7239b3b76224dc777
                                      • Instruction ID: 6d601491d27896dd148bb33713b3da91035dd855c91ec430f063a5555849fb22
                                      • Opcode Fuzzy Hash: 6f6496ec0afc84a2fde1ab3f58a4fa32f02fc53f9a8079f7239b3b76224dc777
                                      • Instruction Fuzzy Hash: 7831AFB9600618EBDB11EF18E880F657BF9FBD4758F14096EE00987244EB79BD02DB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E861A0 Relevance: .1, Instructions: 93COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 97%
                                      			E04E861A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04E85E50(0x4e367cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04F29D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E04E5F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}



















                                      0x04e861b3
                                      0x04e861b5
                                      0x04e861bd
                                      0x04e861c3
                                      0x04e861c7
                                      0x04e861d2
                                      0x04e861ff
                                      0x04e861ff
                                      0x04e86201
                                      0x04e86207
                                      0x04e86207
                                      0x04e861d4
                                      0x04e861d9
                                      0x00000000
                                      0x00000000
                                      0x04e861df
                                      0x04e861e2
                                      0x00000000
                                      0x00000000
                                      0x04e861e6
                                      0x04e861e8
                                      0x04e861ee
                                      0x04e861ee
                                      0x04e861f9
                                      0x04ec762f
                                      0x04ec7632
                                      0x04ec7635
                                      0x04ec7639
                                      0x04ec7640
                                      0x04ec766e
                                      0x04ec7675
                                      0x00000000
                                      0x00000000
                                      0x04ec7681
                                      0x04ec7689
                                      0x04ec768d
                                      0x04ec7691
                                      0x04ec7695
                                      0x04ec7699
                                      0x04ec76af
                                      0x04ec76b5
                                      0x04ec76b7
                                      0x04ec76b7
                                      0x04ec76d7
                                      0x04ec76dc
                                      0x00000000
                                      0x04ec76dc
                                      0x04ec76a2
                                      0x04ec76a9
                                      0x04ec7651
                                      0x04ec7653
                                      0x04ec7653
                                      0x04ec7656
                                      0x04ec7656
                                      0x00000000
                                      0x04ec7656
                                      0x04ec7644
                                      0x04ec7646
                                      0x04ec7648
                                      0x04ec7648
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a086c5f58118cd4715c555e43563a64b161ad687d7e9b93596b257f0a0992ca1
                                      • Instruction ID: c96914a01f77266efe4c2316a3ae8a93797daa7a518dbfd07261079a1ef5f3a9
                                      • Opcode Fuzzy Hash: a086c5f58118cd4715c555e43563a64b161ad687d7e9b93596b257f0a0992ca1
                                      • Instruction Fuzzy Hash: F4318C716193028FD760EF29C900B2AB7E4FF88B04F05596DE99C9B351E7B0E805CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5AA16 Relevance: .1, Instructions: 93COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 95%
                                      			E04E5AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x4f4d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4f47b9c; // 0x0
					_t53 = L04E74620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E04E9B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E04E9F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04E66C59(_t53, _t51, _t58) != 0) {
							_t28 = E04E85E50(0x4e3c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E04E8B230(_v32, _v28, 0x4e3c2d8, 1,  &_v24);
								_t28 = E04E5F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}




















                                      0x04e5aa25
                                      0x04e5aa29
                                      0x04e5aa2d
                                      0x04e5aa30
                                      0x04e5aa37
                                      0x04e5aa3c
                                      0x04eb4458
                                      0x04eb4458
                                      0x04eb4472
                                      0x04eb4474
                                      0x04eb4476
                                      0x04e5aa64
                                      0x04e5aa74
                                      0x04eb447c
                                      0x04eb4483
                                      0x04eb4492
                                      0x04e5aa52
                                      0x04e5aa54
                                      0x04e5aa5e
                                      0x04eb44a8
                                      0x04eb44ad
                                      0x04eb44af
                                      0x04eb44b6
                                      0x04eb44b6
                                      0x04eb44b9
                                      0x04eb44bc
                                      0x04eb44cd
                                      0x04eb44d3
                                      0x04eb44d6
                                      0x04eb44e1
                                      0x04eb44e1
                                      0x04eb44e6
                                      0x04eb44e8
                                      0x04eb44fb
                                      0x04eb44fb
                                      0x04eb44e8
                                      0x00000000
                                      0x04e5aa5e
                                      0x04eb4476
                                      0x04e5aa42
                                      0x04e5aa46
                                      0x04e5aa48
                                      0x04e5aa4c
                                      0x00000000
                                      0x00000000
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 45b95b83a05b65e4d78b9811eaf1c1f306f9c96f49f513a7fabf5f840c9b2351
                                      • Instruction ID: 6aea10be472c59149c96a358c5d2f1a575246005f38062b0bbd71da680033203
                                      • Opcode Fuzzy Hash: 45b95b83a05b65e4d78b9811eaf1c1f306f9c96f49f513a7fabf5f840c9b2351
                                      • Instruction Fuzzy Hash: 2F31D472A00119ABDF15AF64CD41ABFB7B8EF04704B005469F945E7190E774BD11DBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E98EC7 Relevance: .1, Instructions: 92COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 93%
                                      			E04E98EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x4f4d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04E84E70(0x4f486e4, 0x4e99490, 0, 0);
					if( *0x4f453e8 > 5 && E04E98F33(0x4f453e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x4f453e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x4f453e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x4e3bc46;
						_t48 = E04ED7B9C(0x4f453e8, 0x4e3bc46, _t67, 0x4f453e8, _t70,  &_v140);
					}
				}
				return E04E9B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}











































                                      0x04e98ec7
                                      0x04e98ed9
                                      0x04e98edc
                                      0x04e98ee6
                                      0x04e98ee9
                                      0x04e98eee
                                      0x04e98efc
                                      0x04e98f08
                                      0x04ed1349
                                      0x04ed1353
                                      0x04ed135d
                                      0x04ed1366
                                      0x04ed136f
                                      0x04ed1375
                                      0x04ed137c
                                      0x04ed1385
                                      0x04ed1390
                                      0x04ed1391
                                      0x04ed139c
                                      0x04ed139d
                                      0x04ed13a6
                                      0x04ed13ac
                                      0x04ed13b2
                                      0x04ed13b5
                                      0x04ed13bc
                                      0x04ed13bf
                                      0x04ed13c2
                                      0x04ed13c5
                                      0x04ed13c8
                                      0x04ed13cb
                                      0x04ed13ce
                                      0x04ed13d1
                                      0x04ed13d4
                                      0x04ed13d7
                                      0x04ed13da
                                      0x04ed13dd
                                      0x04ed13e0
                                      0x04ed13e3
                                      0x04ed13e6
                                      0x04ed13e9
                                      0x04ed13f6
                                      0x04ed1400
                                      0x04ed1400
                                      0x04e98f08
                                      0x04e98f32

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 68119db75c5a93507e4cd8cab06ccf5933624e04a1e7bd5365056ae547bcb085
                                      • Instruction ID: 7bff5e05786e273bf4c3079d8a05702e0b9849acd7f33ddc42d86ac2fdda9752
                                      • Opcode Fuzzy Hash: 68119db75c5a93507e4cd8cab06ccf5933624e04a1e7bd5365056ae547bcb085
                                      • Instruction Fuzzy Hash: 9741D1B1D0021C9FDB24DFAAD980AADFBF4FB48704F5051AEE509A7240EB70AA44CF50
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8E730 Relevance: .1, Instructions: 89COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 74%
                                      			E04E8E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04E99670() < 0) {
					L04EADF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4f47b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04E74620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M04E8E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

















                                      0x04e8e730
                                      0x04e8e736
                                      0x04e8e738
                                      0x04e8e73d
                                      0x04e8e73e
                                      0x04e8e740
                                      0x04e8e749
                                      0x04e8e765
                                      0x04e8e76a
                                      0x04e8e76b
                                      0x04e8e76c
                                      0x04e8e76d
                                      0x04e8e76e
                                      0x04e8e76f
                                      0x04e8e775
                                      0x04e8e777
                                      0x04e8e77e
                                      0x04ecb675
                                      0x04e8e784
                                      0x04e8e784
                                      0x04e8e789
                                      0x04e8e7a8
                                      0x04e8e7ac
                                      0x04e8e807
                                      0x04e8e7ae
                                      0x04e8e7ae
                                      0x04e8e7b1
                                      0x04e8e7b4
                                      0x04e8e7b9
                                      0x04e8e7c0
                                      0x04e8e7c4
                                      0x04e8e7ca
                                      0x04e8e7cc
                                      0x00000000
                                      0x04e8e7d3
                                      0x04e8e7d6
                                      0x00000000
                                      0x00000000
                                      0x04e8e7ff
                                      0x04e8e802
                                      0x00000000
                                      0x00000000
                                      0x04e8e7f9
                                      0x04e8e7fc
                                      0x00000000
                                      0x00000000
                                      0x04e8e7f3
                                      0x04e8e7f6
                                      0x00000000
                                      0x00000000
                                      0x04e8e7ed
                                      0x04e8e7f0
                                      0x00000000
                                      0x00000000
                                      0x04e8e7e7
                                      0x04e8e7ea
                                      0x00000000
                                      0x00000000
                                      0x04ecb685
                                      0x04ecb688
                                      0x00000000
                                      0x00000000
                                      0x04ecb682
                                      0x00000000
                                      0x00000000
                                      0x04e8e7cc
                                      0x04e8e7d9
                                      0x04e8e7dc
                                      0x04e8e7de
                                      0x04e8e7de
                                      0x04e8e7ac
                                      0x04e8e7e4
                                      0x04e8e74b
                                      0x04e8e751
                                      0x04e8e759
                                      0x04e8e761
                                      0x04e8e761

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3ffc36faf504b8e811481c162b5869f2704e6d13cc5cc288cd6cd39a6bd72eb6
                                      • Instruction ID: c88a37759f9f8faac71d405b8cc5a95a7f4a01638c220ddf99c388533456ca84
                                      • Opcode Fuzzy Hash: 3ffc36faf504b8e811481c162b5869f2704e6d13cc5cc288cd6cd39a6bd72eb6
                                      • Instruction Fuzzy Hash: 5B318CB5A14249EFEB04DF58D841B9AB7E4FB19314F14965AF908CB341E631EC80CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8BC2C Relevance: .1, Instructions: 88COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 67%
                                      			E04E8BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4f46100; // 0x33
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04E72280(0xd, 0x18c5f1a0);
				_t41 =  *0x4f460f8; // 0x0
				if(_t41 != 0) {
					 *0x4f460f8 =  *_t41;
					 *0x4f460fc =  *0x4f460fc + 0xffff;
				}
				E04E6FFB0(_t41, 0x800, 0x18c5f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x4f460f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04E74620(0x4f46100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4f46100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}










                                      0x04e8bc36
                                      0x04e8bc42
                                      0x04e8bc45
                                      0x04e8bc4a
                                      0x04e8bd35
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e8bc50
                                      0x04e8bc50
                                      0x04e8bc58
                                      0x04e8bc5a
                                      0x04e8bc60
                                      0x00000000
                                      0x00000000
                                      0x04eca4f2
                                      0x04eca4f6
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eca4fc
                                      0x04e8bc79
                                      0x04e8bc7e
                                      0x04e8bc86
                                      0x04e8bd16
                                      0x04e8bd20
                                      0x04e8bd20
                                      0x04e8bc8d
                                      0x04e8bc94
                                      0x04e8bcbd
                                      0x04e8bcca
                                      0x04e8bccb
                                      0x04e8bccc
                                      0x04e8bccd
                                      0x04e8bcce
                                      0x04e8bcd4
                                      0x04e8bcea
                                      0x04e8bcee
                                      0x04e8bcf2
                                      0x04e8bd00
                                      0x04e8bd04
                                      0x00000000
                                      0x04e8bc96
                                      0x04e8bcab
                                      0x04e8bcaf
                                      0x04e8bd2c
                                      0x04e8bd2c
                                      0x04e8bd09
                                      0x00000000
                                      0x04e8bd09
                                      0x04e8bcb1
                                      0x04e8bcb5
                                      0x04e8bcbb
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e8bcbb

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 727ed77d69ad056565e4ce434799f08ca311758a935a3c3f990e4f2d7c1afb73
                                      • Instruction ID: 2eea0363d78f36bc108602b81a0b8e6d565ce72a6efc0d82546a780360c5f73f
                                      • Opcode Fuzzy Hash: 727ed77d69ad056565e4ce434799f08ca311758a935a3c3f990e4f2d7c1afb73
                                      • Instruction Fuzzy Hash: 9231F136A006099FEB11EF58D4807A673A4FB69318F011478ED0CDB241EA78FD068B80
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E81DB5 Relevance: .1, Instructions: 87COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 60%
                                      			E04E81DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E04E7F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04E74620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E04E7F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}












                                      0x04e81dc2
                                      0x04e81dc5
                                      0x04e81dc7
                                      0x04e81dcc
                                      0x04e81dce
                                      0x04e81dd6
                                      0x04e81ddf
                                      0x04e81de0
                                      0x04e81de1
                                      0x04e81de5
                                      0x04e81de8
                                      0x04e81def
                                      0x04e81df0
                                      0x04e81df6
                                      0x04e81df7
                                      0x04e81dfe
                                      0x04e81e1a
                                      0x00000000
                                      0x00000000
                                      0x04e81e0b
                                      0x04e81e12
                                      0x04e81e12
                                      0x04e81e00
                                      0x04e81e00
                                      0x04e81e05
                                      0x04e81e1e
                                      0x04e81e23
                                      0x04ec570f
                                      0x04ec5713
                                      0x00000000
                                      0x00000000
                                      0x04ec5719
                                      0x04ec5719
                                      0x04e81e2c
                                      0x04e81e2d
                                      0x04e81e2e
                                      0x04e81e2f
                                      0x04e81e31
                                      0x04e81e32
                                      0x04e81e35
                                      0x04e81e3d
                                      0x04ec5723
                                      0x04ec573d
                                      0x04ec573d
                                      0x00000000
                                      0x04ec5723
                                      0x04e81e49
                                      0x04e81e4e
                                      0x04e81e4e
                                      0x04e81e09
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                      • Instruction ID: e3e0c08729b6c8d7fd64c72f02a162850f9ba9c796689451cff9ab98b30d8efa
                                      • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                      • Instruction Fuzzy Hash: 9C219F72600118FFDB20DF99CC80EAAFBB9FF85754F115059E90997210DA30BE02CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E59100 Relevance: .1, Instructions: 87COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 76%
                                      			E04E59100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x4f2f6e8);
				E04EAD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E04F288F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E04EAD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x4f486c0; // 0x33e07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x4f486b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04E72280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E04F288F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E04E9AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x4f4b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x4f484c0;
										if(_t69 >=  *0x4f484c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04F29063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E04E5922A(_t82);
							_t53 = E04E77D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04F28B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x4f486c0; // 0x33e07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x4f486b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x4f486bc;
										_t72 = 0x4f486b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04E59240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x4f486c4;
									_t72 = 0x4f486c0;
									L18:
									E04E89B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}


















                                      0x04e59100
                                      0x04e59100
                                      0x04e59100
                                      0x04e59100
                                      0x04e59102
                                      0x04e59107
                                      0x04e5910c
                                      0x04e59110
                                      0x04e59115
                                      0x04e59136
                                      0x04e59143
                                      0x04eb37e4
                                      0x04eb37e4
                                      0x04e59149
                                      0x04e5914e
                                      0x04e5914e
                                      0x04e59117
                                      0x04e5911d
                                      0x00000000
                                      0x00000000
                                      0x04e5911f
                                      0x04e59125
                                      0x00000000
                                      0x04e59151
                                      0x04e59158
                                      0x04e5915d
                                      0x04e59161
                                      0x04e59168
                                      0x04eb3715
                                      0x00000000
                                      0x04e5916e
                                      0x04e5916e
                                      0x04e59175
                                      0x04e59177
                                      0x04e5917e
                                      0x04e5917f
                                      0x04e59182
                                      0x04e59182
                                      0x04e59187
                                      0x04e59187
                                      0x04e5918a
                                      0x04e5918d
                                      0x04e5918f
                                      0x04e59192
                                      0x04e59195
                                      0x04e59198
                                      0x04e59198
                                      0x04e59198
                                      0x04e5919a
                                      0x00000000
                                      0x00000000
                                      0x04eb371f
                                      0x04eb3721
                                      0x04eb3727
                                      0x04eb372f
                                      0x04eb3733
                                      0x04eb3735
                                      0x04eb3738
                                      0x04eb373b
                                      0x04eb373d
                                      0x04eb3740
                                      0x00000000
                                      0x00000000
                                      0x04eb3746
                                      0x04eb3749
                                      0x00000000
                                      0x00000000
                                      0x04eb374f
                                      0x04eb3751
                                      0x00000000
                                      0x00000000
                                      0x04eb3757
                                      0x04eb3759
                                      0x04eb375c
                                      0x04eb375c
                                      0x04eb375e
                                      0x04eb375e
                                      0x04eb3761
                                      0x04eb3764
                                      0x00000000
                                      0x00000000
                                      0x04eb3766
                                      0x04eb3768
                                      0x04eb37a3
                                      0x04eb37a3
                                      0x04eb37a5
                                      0x04eb37a7
                                      0x04eb37ad
                                      0x04eb37b0
                                      0x04eb37b2
                                      0x04eb37bc
                                      0x04eb37c2
                                      0x04eb37c2
                                      0x04eb37b2
                                      0x04e59187
                                      0x04e59187
                                      0x04e5918a
                                      0x04e5918d
                                      0x04e5918f
                                      0x04e59192
                                      0x04e59195
                                      0x00000000
                                      0x04e59195
                                      0x00000000
                                      0x04e59187
                                      0x04eb376a
                                      0x04eb376a
                                      0x04eb376c
                                      0x04eb376c
                                      0x04eb376f
                                      0x04eb3775
                                      0x00000000
                                      0x00000000
                                      0x04eb3777
                                      0x04eb3779
                                      0x00000000
                                      0x00000000
                                      0x04eb3782
                                      0x04eb3787
                                      0x04eb3789
                                      0x04eb3790
                                      0x04eb3790
                                      0x04eb378b
                                      0x04eb378b
                                      0x04eb378b
                                      0x04eb3792
                                      0x04eb3795
                                      0x04eb3795
                                      0x04eb3798
                                      0x04eb3798
                                      0x04eb379b
                                      0x04eb379b
                                      0x04e591a3
                                      0x04e591a9
                                      0x04e591b0
                                      0x04e591b4
                                      0x04e591b4
                                      0x04e591bb
                                      0x04e591c0
                                      0x04e591c5
                                      0x04e591c7
                                      0x04eb37da
                                      0x04e591cd
                                      0x04e591cd
                                      0x04e591cd
                                      0x04e591d2
                                      0x04e591d5
                                      0x04e59239
                                      0x04e59239
                                      0x04e591d7
                                      0x04e591db
                                      0x04e591e1
                                      0x04e591e7
                                      0x04e591fd
                                      0x04e59203
                                      0x04e5921e
                                      0x04e59223
                                      0x00000000
                                      0x04e59223
                                      0x04e59205
                                      0x04e59208
                                      0x04e5920c
                                      0x04e59214
                                      0x04e59214
                                      0x04e591e9
                                      0x04e591e9
                                      0x04e591ee
                                      0x04e591f3
                                      0x04e591f3
                                      0x04e591f3
                                      0x04e591e7
                                      0x00000000
                                      0x04e591db
                                      0x04e59187
                                      0x04e59168

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4e9d966a87b611123dbbb065d1d31f5a1bde81a094981f29c5a36077e9fc7e5c
                                      • Instruction ID: b7a4eafada284fa10862d03341b2aa137d66fbe748d748a9cd3bc6f91fb0169b
                                      • Opcode Fuzzy Hash: 4e9d966a87b611123dbbb065d1d31f5a1bde81a094981f29c5a36077e9fc7e5c
                                      • Instruction Fuzzy Hash: 7531F8B5A00264DFEB61FF68C648BDDBBF1BB88358F199249CC0467262D734B940CB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E70050 Relevance: .1, Instructions: 81COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 53%
                                      			E04E70050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x4f4d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04E89ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E04E9B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04F28A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04E89702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x4f4b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}




















                                      0x04e70055
                                      0x04e7005d
                                      0x04e70062
                                      0x04e7006c
                                      0x04e7006f
                                      0x04e70074
                                      0x04e7007a
                                      0x04e7007a
                                      0x04e70080
                                      0x04e70080
                                      0x04e70087
                                      0x04e7008d
                                      0x04e7008f
                                      0x04e70093
                                      0x04e70095
                                      0x04e7009b
                                      0x04e700f8
                                      0x04e700fb
                                      0x04e700fc
                                      0x04e700ff
                                      0x04e70108
                                      0x04e70108
                                      0x04e700a2
                                      0x04e700a6
                                      0x04e700b3
                                      0x04e700bc
                                      0x04e700c5
                                      0x04e700ca
                                      0x04ebc01e
                                      0x00000000
                                      0x00000000
                                      0x04ebc02d
                                      0x04e700d5
                                      0x04e700d9
                                      0x04ebc03d
                                      0x04ebc046
                                      0x04ebc046
                                      0x04e700df
                                      0x04e700e2
                                      0x04e700ea
                                      0x04e700ef
                                      0x04e700f2
                                      0x04e700f6
                                      0x04e70111
                                      0x04e70117
                                      0x04e70117
                                      0x00000000
                                      0x04e700f6
                                      0x04e700d0
                                      0x04e700d0
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 679419cfe7b7257ec60d327713f737e779fcd1e611affa1359823415c7a2d952
                                      • Instruction ID: af556c3f9442989ca130d7e338ad483255bf1977d77711c737c053bd4634727b
                                      • Opcode Fuzzy Hash: 679419cfe7b7257ec60d327713f737e779fcd1e611affa1359823415c7a2d952
                                      • Instruction Fuzzy Hash: EF315C31601B049FDB25CF28D944BA6B3E5FF88728F14596DE49A87B90EB75BC01CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED6C0A Relevance: .1, Instructions: 79COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 77%
                                      			E04ED6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04E77D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4f47b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04E74620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E04E9F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04E77D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04E99AE0();
						_t23 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}












                                      0x04ed6c0a
                                      0x04ed6c0f
                                      0x04ed6c10
                                      0x04ed6c13
                                      0x04ed6c15
                                      0x04ed6c19
                                      0x04ed6c1c
                                      0x04ed6c21
                                      0x04ed6c28
                                      0x04ed6c3a
                                      0x04ed6c2a
                                      0x04ed6c33
                                      0x04ed6c33
                                      0x04ed6c3f
                                      0x04ed6c48
                                      0x04ed6c4d
                                      0x04ed6c60
                                      0x04ed6c65
                                      0x04ed6c69
                                      0x04ed6c73
                                      0x04ed6c79
                                      0x04ed6c7f
                                      0x04ed6c86
                                      0x04ed6c90
                                      0x04ed6c94
                                      0x04ed6ca6
                                      0x04ed6cb2
                                      0x04ed6cbd
                                      0x04ed6cbd
                                      0x04ed6cc3
                                      0x04ed6cc7
                                      0x04ed6ccb
                                      0x04ed6cd0
                                      0x04ed6cd1
                                      0x04ed6ce2
                                      0x04ed6ce2
                                      0x04ed6c69
                                      0x04ed6ced

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7dac60df966a321d984179fe7aaec43eec937bc40f8e4b80900fa97520b04240
                                      • Instruction ID: ff55597e2088392b2e59d11ad0aeaecb999ef9426341e90ab302e6c16b5f0343
                                      • Opcode Fuzzy Hash: 7dac60df966a321d984179fe7aaec43eec937bc40f8e4b80900fa97520b04240
                                      • Instruction Fuzzy Hash: 2C21ABB1A00644AFD711DB68D880E6AB7B8FF48718F0440AAF904C7791E734ED11CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E990AF Relevance: .1, Instructions: 76COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 82%
                                      			E04E990AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E04EAD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E04E8E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04E74620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E04E9F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E04E8A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}


























                                      0x04e990af
                                      0x04e990b8
                                      0x04e990bb
                                      0x04e990bf
                                      0x04e990c2
                                      0x04e990c2
                                      0x04e990c8
                                      0x04e990cb
                                      0x04e990cd
                                      0x04ed14d7
                                      0x04ed14eb
                                      0x04ed14eb
                                      0x00000000
                                      0x04ed14eb
                                      0x04ed14db
                                      0x04ed14e6
                                      0x00000000
                                      0x04ed14f2
                                      0x04ed14e8
                                      0x00000000
                                      0x04ed14e8
                                      0x04e990d8
                                      0x04e990da
                                      0x04e990dd
                                      0x04e990e5
                                      0x00000000
                                      0x04e99139
                                      0x04e990fa
                                      0x04e990fe
                                      0x04e99142
                                      0x00000000
                                      0x04e99142
                                      0x04e99104
                                      0x04e99107
                                      0x04e9910b
                                      0x04e99110
                                      0x04e99118
                                      0x04e99147
                                      0x04e99148
                                      0x04e9914f
                                      0x04e99150
                                      0x04e99151
                                      0x04e99152
                                      0x04e99156
                                      0x04e9915d
                                      0x04e99160
                                      0x04e99168
                                      0x04e9916c
                                      0x04e991bc
                                      0x04e991be
                                      0x00000000
                                      0x04e991be
                                      0x04e9916e
                                      0x04e99173
                                      0x04e99176
                                      0x00000000
                                      0x00000000
                                      0x04e9917c
                                      0x04e99180
                                      0x04e991b5
                                      0x00000000
                                      0x04e991b5
                                      0x04e99182
                                      0x04e99185
                                      0x04e99189
                                      0x00000000
                                      0x00000000
                                      0x04e9918e
                                      0x04e99190
                                      0x04e99198
                                      0x00000000
                                      0x00000000
                                      0x04e991a0
                                      0x00000000
                                      0x04e991ad
                                      0x04e991ad
                                      0x04e991b0
                                      0x04e991b1
                                      0x00000000
                                      0x04e99185
                                      0x04e9911a
                                      0x04e9911c
                                      0x04e9911f
                                      0x04e99125
                                      0x04e99127
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                      • Instruction ID: f8562f7deaa62b5cf3e15c4470530302e61ab1fb79d257f2f1721f3c43c1eb30
                                      • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                      • Instruction Fuzzy Hash: FE214CB1A00205EFDB20DF59C845AAAFBF8EB44754F15996AE949A7391E330BD408B90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E83B7A Relevance: .1, Instructions: 75COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 59%
                                      			E04E83B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x4f484c4; // 0x0
				_v12 = 1;
				_v8 =  *0x4f484c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x4f484c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E04E9AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E04E9FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x4f484c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x4f484c4; // 0x0
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}












                                      0x04e83b89
                                      0x04e83b96
                                      0x04e83ba1
                                      0x04e83bab
                                      0x04e83bb5
                                      0x04e83bb9
                                      0x04ec6298
                                      0x04e83bbf
                                      0x04e83bc2
                                      0x04e83bc3
                                      0x04e83bc9
                                      0x04e83bca
                                      0x04e83bcc
                                      0x04e83bcd
                                      0x04e83bd4
                                      0x04e83bd6
                                      0x04e83bdb
                                      0x04e83bea
                                      0x04e83bf7
                                      0x04e83bfb
                                      0x04e83bff
                                      0x04e83c09
                                      0x04e83c0a
                                      0x04e83c0b
                                      0x04e83c0f
                                      0x04e83c14
                                      0x04e83c18
                                      0x04e83c18
                                      0x04e83bfb
                                      0x04e83c1b
                                      0x04e83c30
                                      0x04e83c30
                                      0x04e83c3d

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0297555994db6f97c90145c766d72f894dfeee71ebc75e082fa57a8254b3bc36
                                      • Instruction ID: eafddcece5c8bfb411022445505000aed3fef16a54f5a650f7017bb5b68981f5
                                      • Opcode Fuzzy Hash: 0297555994db6f97c90145c766d72f894dfeee71ebc75e082fa57a8254b3bc36
                                      • Instruction Fuzzy Hash: 7721C272600108AFDB04EF58DD81B5AB7BDFB40748F1510A9E908AB251D771FD11CBA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED6CF0 Relevance: .1, Instructions: 74COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 80%
                                      			E04ED6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04E77D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04E77D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x4e35c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E04E8F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E04E8F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E04ED7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04E72400( &_v52);
								}
								_t21 = L04E72400( &_v28);
							}
						}
					}
				}
				return _t21;
			}



















                                      0x04ed6cfb
                                      0x04ed6d00
                                      0x04ed6d02
                                      0x04ed6d06
                                      0x04ed6d0a
                                      0x04ed6d0e
                                      0x04ed6d19
                                      0x04ed6d2b
                                      0x04ed6d1b
                                      0x04ed6d24
                                      0x04ed6d24
                                      0x04ed6d33
                                      0x04ed6d39
                                      0x04ed6d46
                                      0x04ed6d4f
                                      0x04ed6d61
                                      0x04ed6d51
                                      0x04ed6d5a
                                      0x04ed6d5a
                                      0x04ed6d69
                                      0x04ed6d6b
                                      0x04ed6d6d
                                      0x04ed6d6f
                                      0x04ed6d6f
                                      0x04ed6d74
                                      0x04ed6d79
                                      0x04ed6d7a
                                      0x04ed6d7f
                                      0x04ed6d82
                                      0x04ed6d88
                                      0x04ed6d89
                                      0x04ed6d90
                                      0x04ed6d94
                                      0x04ed6da7
                                      0x04ed6db1
                                      0x04ed6db1
                                      0x04ed6dbb
                                      0x04ed6dbb
                                      0x04ed6d90
                                      0x04ed6d69
                                      0x04ed6d46
                                      0x04ed6dc6

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 9d4c3f0651013fbdf3744ac68588be6c3643900a9f0edcdaba9d27772b81ac67
                                      • Instruction ID: 98d267cbc9217f8a7d99077aa499a11deb70b6ed75f413ed1bdce054f18cac64
                                      • Opcode Fuzzy Hash: 9d4c3f0651013fbdf3744ac68588be6c3643900a9f0edcdaba9d27772b81ac67
                                      • Instruction Fuzzy Hash: 7E2122325003449BD721EF78D944BABB7ECEF85758F051956F941C7260E730F90AC6A2
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F2070D Relevance: .1, Instructions: 72COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 67%
                                      			E04F2070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E04F207DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E04F1AFDE( &_v8,  &_v12);
					E04F21293(_t38, _v28, _t60);
					if(E04E77D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E04F114FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}













                                      0x04f2071b
                                      0x04f20724
                                      0x04f20734
                                      0x04f20738
                                      0x04f2074b
                                      0x04f2074b
                                      0x04f20753
                                      0x04f20753
                                      0x04f20759
                                      0x04f2075d
                                      0x04f20774
                                      0x04f20779
                                      0x04f2077d
                                      0x04f20789
                                      0x04f20795
                                      0x04f207a7
                                      0x04f20797
                                      0x04f207a0
                                      0x04f207a0
                                      0x04f207af
                                      0x04f207c4
                                      0x04f207cd
                                      0x04f207cd
                                      0x04f207af
                                      0x04f207dc

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                      • Instruction ID: a2900061f7ec96de3df9b6df106d323473aff208a775f0c2961b64892bc23398
                                      • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                      • Instruction Fuzzy Hash: 56210136604210AFD705DF68CD80B6ABBA5EFD4750F048669FA958B391DB30E90ACB91
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7AE73 Relevance: .1, Instructions: 70COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 96%
                                      			E04E7AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04E77D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04E77D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04E77D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04E77D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E04ED7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}













                                      0x04e7ae78
                                      0x04e7ae7c
                                      0x04e7ae7e
                                      0x04e7ae81
                                      0x04e7ae86
                                      0x04e7ae8d
                                      0x04ec2691
                                      0x04e7ae93
                                      0x04e7ae93
                                      0x04e7ae93
                                      0x04e7ae98
                                      0x04e7ae9d
                                      0x04ec26a2
                                      0x04ec26b4
                                      0x04ec26a4
                                      0x04ec26ad
                                      0x04ec26ad
                                      0x04ec26b9
                                      0x00000000
                                      0x04ec26bb
                                      0x00000000
                                      0x04ec26bb
                                      0x04e7aea3
                                      0x04e7aea3
                                      0x04e7aea3
                                      0x04e7aeaa
                                      0x04ec26c0
                                      0x04ec26c9
                                      0x04ec26c9
                                      0x04e7aeb3
                                      0x04ec26d4
                                      0x04ec26e1
                                      0x00000000
                                      0x00000000
                                      0x04ec26e7
                                      0x04ec26ee
                                      0x04ec26f0
                                      0x04ec26f9
                                      0x04ec26f9
                                      0x04ec2702
                                      0x04ec2708
                                      0x04ec2708
                                      0x04ec270b
                                      0x04ec270f
                                      0x04ec2711
                                      0x04ec2711
                                      0x04ec2725
                                      0x04ec2725
                                      0x00000000
                                      0x04e7aeb9
                                      0x04e7aeb9
                                      0x04e7aebf
                                      0x04e7aebf
                                      0x04e7aeb3

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                      • Instruction ID: c0de03f52f872762b09a19efb8875070bf266db74bdc2672df4f243a467381fe
                                      • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                      • Instruction Fuzzy Hash: 3F21D431A016809FEB259B28CA44B6577E8EF45368F0914E5EE048B792E774FC82D7A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED7794 Relevance: .1, Instructions: 70COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 82%
                                      			E04ED7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4f47b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E04E9F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04E77D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04E99AE0();
					_t24 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}













                                      0x04ed7799
                                      0x04ed779a
                                      0x04ed779b
                                      0x04ed77a3
                                      0x04ed77ab
                                      0x04ed77ae
                                      0x04ed77b1
                                      0x04ed77b1
                                      0x04ed77bf
                                      0x04ed77c4
                                      0x04ed77c8
                                      0x04ed77ce
                                      0x04ed77d4
                                      0x04ed77e0
                                      0x04ed77e0
                                      0x04ed77d6
                                      0x04ed77d6
                                      0x04ed77de
                                      0x00000000
                                      0x00000000
                                      0x04ed77de
                                      0x04ed77e5
                                      0x04ed77f0
                                      0x04ed77f3
                                      0x04ed77f6
                                      0x04ed77fd
                                      0x04ed7800
                                      0x04ed780c
                                      0x04ed7818
                                      0x04ed782b
                                      0x04ed781a
                                      0x04ed7823
                                      0x04ed7823
                                      0x04ed7830
                                      0x04ed7831
                                      0x04ed7838
                                      0x04ed783d
                                      0x04ed783e
                                      0x04ed784f
                                      0x04ed784f
                                      0x04ed785a

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 69935741d2de38dadaf76e61b69e7e81184d6536b84401dd2b005a926bdf5c30
                                      • Instruction ID: 1bb79782728fe316509ef3b2671e0d0a5ddd8dea643c7c76f0ced911c7c71364
                                      • Opcode Fuzzy Hash: 69935741d2de38dadaf76e61b69e7e81184d6536b84401dd2b005a926bdf5c30
                                      • Instruction Fuzzy Hash: 7F21AE72900604AFC725DFA9D890EABB7A8EF48354F10456DF90AC7790E634F901CBA4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8FD9B Relevance: .1, Instructions: 69COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 93%
                                      			E04E8FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E04E676E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}










                                      0x04e8fd9b
                                      0x04e8fda0
                                      0x04e8fda1
                                      0x04e8fdab
                                      0x04e8fdad
                                      0x04e8fdb0
                                      0x04e8fdb8
                                      0x04e8fe0f
                                      0x04e8fde6
                                      0x04e8fde9
                                      0x04e8fdec
                                      0x04ecc0c0
                                      0x04e8fdfe
                                      0x04e8fe06
                                      0x04e8fe06
                                      0x04ecc0c8
                                      0x04e8fe2d
                                      0x04e8fe2d
                                      0x00000000
                                      0x04e8fe2d
                                      0x04ecc0d1
                                      0x04ecc0e0
                                      0x04ecc0e5
                                      0x04ecc0e5
                                      0x04ecc0e8
                                      0x00000000
                                      0x04ecc0e8
                                      0x04e8fdf4
                                      0x00000000
                                      0x00000000
                                      0x04e8fdf6
                                      0x04e8fdfa
                                      0x04e8fe1a
                                      0x04e8fe1f
                                      0x04e8fe1f
                                      0x04e8fdfc
                                      0x00000000
                                      0x04e8fdfc
                                      0x04e8fdcc
                                      0x04e8fdd0
                                      0x04e8fe26
                                      0x00000000
                                      0x04e8fe26
                                      0x04e8fdd8
                                      0x04e8fddb
                                      0x04e8fddd
                                      0x04e8fde0
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                      • Instruction ID: 3eee4620336258932f5068d2d6b56a75e48bcb98c8255befaeb733dc278fa8e6
                                      • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                      • Instruction Fuzzy Hash: 72217972640A40DFDB31EF49C640A66B7E5EB94B29F24956EEA4D87650E730BC01DB80
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E59240 Relevance: .1, Instructions: 63COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 77%
                                      			E04E59240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x4f2f708);
				E04EAD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E04E995D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E04E995D0();
				_t33 =  *0x4f484c4; // 0x0
				L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x4f484c4; // 0x0
				L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x4f484c4; // 0x0
				E04E72280(L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x4f486b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E04E995D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E04E995D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04E59325();
					_t50 =  *0x4f484c4; // 0x0
					return E04EAD0D1(L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}















                                      0x04e59240
                                      0x04e59242
                                      0x04e59247
                                      0x04e5924c
                                      0x04e5924e
                                      0x04e59255
                                      0x04e59257
                                      0x04e5925a
                                      0x04e5925f
                                      0x04e5925f
                                      0x04e59266
                                      0x04e59271
                                      0x04e59276
                                      0x04e59279
                                      0x04e5927e
                                      0x04e59295
                                      0x04e5929a
                                      0x04e592b1
                                      0x04e592b6
                                      0x04e592d7
                                      0x04e592dc
                                      0x04e592e0
                                      0x04e592e6
                                      0x04e592e8
                                      0x04e592ee
                                      0x04e59332
                                      0x04e59333
                                      0x04e59337
                                      0x04e59338
                                      0x04e5933a
                                      0x04e5933a
                                      0x04e5933d
                                      0x04e59342
                                      0x04e59342
                                      0x04e59345
                                      0x04e59349
                                      0x04e5934e
                                      0x04e59352
                                      0x04e59357
                                      0x04e592f4
                                      0x04e592f4
                                      0x04e592f6
                                      0x04e592f9
                                      0x04e59300
                                      0x04e59306
                                      0x04e59324
                                      0x04e59324

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: 756f6af3674cef0e08372a8466dec71630f1388c023fbce4ebfcb795df9b61b9
                                      • Instruction ID: 8f5b2a8ed98ddea0870af7c49b3a6ecaca43811e514f7a9951def3c6e395904a
                                      • Opcode Fuzzy Hash: 756f6af3674cef0e08372a8466dec71630f1388c023fbce4ebfcb795df9b61b9
                                      • Instruction Fuzzy Hash: D8213472040600DFD721EF28DA40F5AB7B9EF18719F0555A8E149866B2CB34F952CB44
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8B390 Relevance: .1, Instructions: 63COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 54%
                                      			E04E8B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04E72280(_t12, 0x4f48608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E04E900C2(0x4f48608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}











                                      0x04e8b395
                                      0x04e8b3a2
                                      0x04e8b3a5
                                      0x04e8b3aa
                                      0x04e8b3b2
                                      0x04e8b3ba
                                      0x04e8b3bd
                                      0x04e8b3c0
                                      0x04e8b3c4
                                      0x04e8b3c9
                                      0x04eca3e9
                                      0x04eca3ed
                                      0x04eca3f0
                                      0x04eca3ff
                                      0x04eca403
                                      0x04eca409
                                      0x00000000
                                      0x00000000
                                      0x04eca40b
                                      0x04eca40b
                                      0x04eca40f
                                      0x04eca415
                                      0x04eca423
                                      0x04eca423
                                      0x04eca415
                                      0x04e8b3d1
                                      0x04e8b3e8
                                      0x04e8b3e8
                                      0x04e8b3d9

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 18aef8234e946ecbd39fe689e655bf1205fa4b5b0a396617cfc0ae8a131f68d3
                                      • Instruction ID: 4ad5623eee3236ba93cb9b3c7357d84246b8377a31489a148e682aff80c1096a
                                      • Opcode Fuzzy Hash: 18aef8234e946ecbd39fe689e655bf1205fa4b5b0a396617cfc0ae8a131f68d3
                                      • Instruction Fuzzy Hash: 781121363511109FDB29EA588E81A7B7696EBC6274B28213DEA1E97280D931BC02D690
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EE4257 Relevance: .1, Instructions: 60COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 90%
                                      			E04EE4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x4f308d0);
				E04EAD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E04EE41E8(__ebx, __edi, __ecx, _t39);
				E04E6EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x4f487e4;
					_t18 =  *0x4f487e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4f45cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x4f487e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x4f487e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04E57055(_t31 + 0xfffffff8);
								_t24 =  *0x4f487e0; // 0x0
								_t18 = _t24 - 1;
								 *0x4f487e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4f45cd0;
				if( *0x4f45cd0 <= 0) {
					L04E57055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x4f487e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x4f487e8 = _t30;
						 *0x4f487e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E04EAD0D1(L04EE4320());
			}















                                      0x04ee4257
                                      0x04ee4257
                                      0x04ee4257
                                      0x04ee4259
                                      0x04ee425e
                                      0x04ee4263
                                      0x04ee4265
                                      0x04ee4273
                                      0x04ee4278
                                      0x04ee427c
                                      0x04ee427f
                                      0x04ee4281
                                      0x04ee4287
                                      0x04ee42d7
                                      0x04ee42d7
                                      0x04ee42da
                                      0x04ee428d
                                      0x04ee428d
                                      0x04ee428f
                                      0x04ee4292
                                      0x04ee4297
                                      0x04ee429c
                                      0x04ee42a0
                                      0x04ee42a6
                                      0x04ee42a8
                                      0x04ee42ae
                                      0x04ee42b3
                                      0x00000000
                                      0x04ee42ba
                                      0x04ee42ba
                                      0x04ee42bf
                                      0x04ee42c5
                                      0x04ee42ca
                                      0x04ee42cf
                                      0x04ee42d0
                                      0x00000000
                                      0x04ee42d0
                                      0x04ee42b3
                                      0x00000000
                                      0x04ee42a6
                                      0x04ee429c
                                      0x04ee42dc
                                      0x04ee42dc
                                      0x04ee42e3
                                      0x04ee4309
                                      0x04ee42e5
                                      0x04ee42e5
                                      0x04ee42e8
                                      0x04ee42ee
                                      0x04ee42f0
                                      0x00000000
                                      0x04ee42f2
                                      0x04ee42f2
                                      0x04ee42f4
                                      0x04ee42f7
                                      0x04ee42f9
                                      0x04ee4300
                                      0x04ee4300
                                      0x04ee42f0
                                      0x04ee430e
                                      0x04ee431f

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8715c1ba6e5c88f83e4b3b519fb6b3f75051e09ec690d24d338a886b5717f23e
                                      • Instruction ID: 94f7a274c2c59831da2f14a6f94321af0d370eec19d444fcafd038f6ba7339ec
                                      • Opcode Fuzzy Hash: 8715c1ba6e5c88f83e4b3b519fb6b3f75051e09ec690d24d338a886b5717f23e
                                      • Instruction Fuzzy Hash: 68218C78600604CFDB15FF66E050A34BBF1FB99398F10A26EC2058B695EB39F881CB00
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED46A7 Relevance: .1, Instructions: 59COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 93%
                                      			E04ED46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E04E9F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E04E8D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L04E777F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}











                                      0x04ed46b7
                                      0x04ed46ba
                                      0x04ed46c5
                                      0x04ed46c8
                                      0x04ed46d0
                                      0x04ed46d4
                                      0x04ed46e6
                                      0x04ed46e9
                                      0x04ed46f4
                                      0x04ed46ff
                                      0x04ed4705
                                      0x04ed4706
                                      0x04ed470c
                                      0x04ed4713
                                      0x04ed471b
                                      0x04ed4723
                                      0x04ed4725
                                      0x04ed46d6
                                      0x04ed46d9
                                      0x04ed46db
                                      0x04ed46db
                                      0x04ed4732

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                      • Instruction ID: 556acbb4a3ef0f1c70997c0feb296a112bed81328a28dba74dc075faddff7595
                                      • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                      • Instruction Fuzzy Hash: A311E572504208BFDB059F5CD8808BEB7B9EF95314F1090AEF944C7390DA31AD55D7A4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E82397 Relevance: .1, Instructions: 59COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 34%
                                      			E04E82397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x4f4848c != 0) {
					L04E7FAD0(0x4f48610);
					if( *0x4f4848c == 0) {
						E04E7FA00(0x4f48610, _t19, _t27, 0x4f48610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04E82581(0x4f48610, 0x4e350a0, _t26, _t27, _t28);
						E04E7FA00(0x4f48610, 0x4e350a0, _t27, 0x4f48610);
					}
				} else {
					L1:
					_t11 =  *0x4f48614; // 0x0
					if(_t11 == 0) {
						_t11 = E04E94886(0x4e31088, 1, 0x4f48614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04E82581(0x4f48610, (_t11 << 4) + 0x4e35070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}















                                      0x04e823b0
                                      0x04e823b6
                                      0x04e82409
                                      0x04e82415
                                      0x04ec5ae9
                                      0x00000000
                                      0x04e8241b
                                      0x04e8241b
                                      0x04e8241d
                                      0x04e82427
                                      0x04e8242e
                                      0x04e82430
                                      0x04e82430
                                      0x04e823b8
                                      0x04e823b8
                                      0x04e823b8
                                      0x04e823bf
                                      0x04e823fc
                                      0x04e823fc
                                      0x04e823c1
                                      0x04e823c3
                                      0x04e823d0
                                      0x04e823d8
                                      0x04e823d8
                                      0x04e823dc
                                      0x04e823de
                                      0x04e823e1
                                      0x04e823e1
                                      0x04e823ec

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ab0e766408b1d0ad0ee81bac1b7981dd9a7edc192469f6487df3a8a267a1df5d
                                      • Instruction ID: 2bca720d572f81d8f7eb80fed9cf240e8972130b66d10f0d1815b9cca2e7d710
                                      • Opcode Fuzzy Hash: ab0e766408b1d0ad0ee81bac1b7981dd9a7edc192469f6487df3a8a267a1df5d
                                      • Instruction Fuzzy Hash: 94116B3574030067FB71BB29AC90B26B6C8EBA0768F14646EF70EA7290D9B4FC01C755
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5C962 Relevance: .1, Instructions: 57COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 42%
                                      			E04E5C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x4f4d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E04E6EEF0(0x4f470a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E04EDF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E04E6EB70(_t29, 0x4f470a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E04E9B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E04EDF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x4f470c0; // 0x0
					while(_t38 != 0x4f470c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x4f4b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}


















                                      0x04e5c96a
                                      0x04e5c974
                                      0x04e5c988
                                      0x04e5c98a
                                      0x04ec7c9d
                                      0x04ec7c9f
                                      0x04ec7ca4
                                      0x04ec7cae
                                      0x04ec7cf0
                                      0x04ec7cf5
                                      0x04ec7cfa
                                      0x04e5c992
                                      0x04e5c996
                                      0x04e5c997
                                      0x04e5c998
                                      0x04e5c9a3
                                      0x04e5c9a3
                                      0x04ec7cb0
                                      0x04ec7cb7
                                      0x04ec7cbb
                                      0x00000000
                                      0x00000000
                                      0x04ec7cbd
                                      0x04ec7ce8
                                      0x04ec7cc5
                                      0x04ec7cc8
                                      0x04ec7cca
                                      0x04ec7cd0
                                      0x04ec7cd6
                                      0x04ec7cde
                                      0x04ec7ce4
                                      0x04ec7ce4
                                      0x04ec7cd0
                                      0x00000000
                                      0x04ec7ce8
                                      0x04e5c990
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ca09e5d7604865264e40e58ee190fd9bed19822688c97604df5f2d7d86fd8234
                                      • Instruction ID: 9a197cbe941d2f5922bcc0daf8e43c464b5a779f1c7eaae69725c096ff193e97
                                      • Opcode Fuzzy Hash: ca09e5d7604865264e40e58ee190fd9bed19822688c97604df5f2d7d86fd8234
                                      • Instruction Fuzzy Hash: 1F11A0323006079BD714AF6DD985A6A7BE5FB88658B002968E84283651EF20FC12CBD1
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E937F5 Relevance: .1, Instructions: 57COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 87%
                                      			E04E937F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04E72280(_t6, 0x4f48550);
				}
				_t29 = E04E9387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E04E6FFB0(0x4f48550, _t27, 0x4f48550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}











                                      0x04e937fa
                                      0x04e937fc
                                      0x04e93805
                                      0x04e93808
                                      0x04e93808
                                      0x04e93814
                                      0x04e93818
                                      0x04e93846
                                      0x04e93848
                                      0x04e9384b
                                      0x04e9384b
                                      0x04e93852
                                      0x00000000
                                      0x04e93854
                                      0x04e93856
                                      0x00000000
                                      0x00000000
                                      0x04e93863
                                      0x00000000
                                      0x04e93863
                                      0x04e9381a
                                      0x04e9381a
                                      0x04e9381f
                                      0x04e9386e
                                      0x04e9386e
                                      0x04e93871
                                      0x04e93873
                                      0x04e93873
                                      0x04e93868
                                      0x00000000
                                      0x04e93868
                                      0x04e93821
                                      0x04e93826
                                      0x00000000
                                      0x00000000
                                      0x04e93828
                                      0x04e9382a
                                      0x04e93841
                                      0x00000000
                                      0x04e93841

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 82aa9325e71d4525b2d01aad6ed1abad4b2ee21aa5d165043a0104d14c3164a5
                                      • Instruction ID: 5ff2508b772a2b40aa6a6911e1b3d4fa1f01e6f5034fa4591ca3f729fb3bcadb
                                      • Opcode Fuzzy Hash: 82aa9325e71d4525b2d01aad6ed1abad4b2ee21aa5d165043a0104d14c3164a5
                                      • Instruction Fuzzy Hash: 8901C4B2A416109BDB379F19A940A26BBE6DF89B687156069ED468B2D4DB30FC01C780
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8002D Relevance: .1, Instructions: 55COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E8002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04E77D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04E77D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04E77D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04E77D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}








                                      0x04e80032
                                      0x04e80037
                                      0x04e80043
                                      0x04ec4b3a
                                      0x04e80049
                                      0x04e80049
                                      0x04e80049
                                      0x04e8004e
                                      0x04e80053
                                      0x04ec4b48
                                      0x04ec4b5a
                                      0x04ec4b4a
                                      0x04ec4b53
                                      0x04ec4b53
                                      0x04ec4b5f
                                      0x00000000
                                      0x04ec4b61
                                      0x00000000
                                      0x04ec4b61
                                      0x04e80059
                                      0x04e80059
                                      0x04e80060
                                      0x04ec4b6f
                                      0x04ec4b6f
                                      0x04e80069
                                      0x04ec4b83
                                      0x00000000
                                      0x00000000
                                      0x04ec4b90
                                      0x04ec4b9b
                                      0x04ec4b9b
                                      0x04ec4ba4
                                      0x00000000
                                      0x00000000
                                      0x04ec4baa
                                      0x00000000
                                      0x04e8006f
                                      0x04e8006f
                                      0x00000000
                                      0x04e8006f
                                      0x04e80069

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                      • Instruction ID: 2dfed10f11205ad1712c52f7464523f1e51580f17a5be31cd5876ea5959f0130
                                      • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                      • Instruction Fuzzy Hash: AB1108317016818FEB229B64CE64B7537D4AF4175CF0A20A9DD1C877D2F728F842E260
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6766D Relevance: .1, Instructions: 54COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 94%
                                      			E04E6766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E04E8F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E04E8F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04E74620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}










                                      0x04e67672
                                      0x04e6767f
                                      0x04e67689
                                      0x04e676de
                                      0x04e676de
                                      0x04e6768b
                                      0x04e67691
                                      0x04e67693
                                      0x04e67697
                                      0x00000000
                                      0x04e67699
                                      0x04e676a8
                                      0x00000000
                                      0x04e676aa
                                      0x04e676ad
                                      0x04e676b1
                                      0x00000000
                                      0x04e676b3
                                      0x04e676b3
                                      0x04e676b5
                                      0x04e676ba
                                      0x04e676bc
                                      0x04e676bc
                                      0x04e676c0
                                      0x00000000
                                      0x04e676c2
                                      0x04e676ce
                                      0x04e676ce
                                      0x04e676c0
                                      0x04e676b1
                                      0x04e676a8
                                      0x04e67697
                                      0x04e676d9

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                      • Instruction ID: 9bf35ffce3844797c1f2f5721c300385d4bcba08abdc62e075152d46fe4ba9c2
                                      • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                      • Instruction Fuzzy Hash: 64018832741119AFD721BE5ECC41E5FB7ADEB847A4F141964B90ACB250DA30ED0187A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E59080 Relevance: .1, Instructions: 53COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 69%
                                      			E04E59080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x4f485ec;
				E04E72280(_t48, 0x4f485ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E04E6FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x4f4538c; // 0x775b68c8
					if( *_t84 != 0x4f45388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x4f2f6e8);
						E04EAD0E8(0x4f485ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E04F288F5(_t80, _t85, 0x4f45388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x4f486c0; // 0x33e07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x4f486b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04E72280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E04F288F5(0x4f485ec, _t85, 0x4f45388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E04E9AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x4f4b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x4f484c0;
																			if(_t82 >=  *0x4f484c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04F29063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E04E5922A(_t99);
										_t64 = E04E77D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04F28B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x4f486c0; // 0x33e07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x4f486b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x4f486bc;
													_t87 = 0x4f486b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04E59240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x4f486c4;
												_t87 = 0x4f486c0;
												L27:
												E04E89B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E04EAD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4f45388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x4f4538c = _t51;
						goto L6;
					}
				}
			}




















                                      0x04e59082
                                      0x04e59083
                                      0x04e59084
                                      0x04e59085
                                      0x04e59087
                                      0x04e59096
                                      0x04e59098
                                      0x04e59098
                                      0x04e5909e
                                      0x04e590a8
                                      0x04e590e7
                                      0x04e590e7
                                      0x04e590aa
                                      0x04e590b0
                                      0x04e590b7
                                      0x04e590bd
                                      0x04e590dd
                                      0x04e590e6
                                      0x04e590bf
                                      0x04e590bf
                                      0x04e590c7
                                      0x04e590cf
                                      0x04e590f1
                                      0x04e590f2
                                      0x04e590f4
                                      0x04e590f5
                                      0x04e590f6
                                      0x04e590f7
                                      0x04e590f8
                                      0x04e590f9
                                      0x04e590fa
                                      0x04e590fb
                                      0x04e590fc
                                      0x04e590fd
                                      0x04e590fe
                                      0x04e590ff
                                      0x04e59100
                                      0x04e59102
                                      0x04e59107
                                      0x04e5910c
                                      0x04e59110
                                      0x04e59113
                                      0x04e59115
                                      0x04e59136
                                      0x04e5913f
                                      0x04e59143
                                      0x04eb37e4
                                      0x04eb37e4
                                      0x04e59117
                                      0x04e59117
                                      0x04e5911d
                                      0x00000000
                                      0x04e5911f
                                      0x04e5911f
                                      0x04e59125
                                      0x00000000
                                      0x04e59127
                                      0x04e5912d
                                      0x04e59130
                                      0x04e59134
                                      0x04e59158
                                      0x04e5915d
                                      0x04e59161
                                      0x04e59168
                                      0x04eb3715
                                      0x04e5916e
                                      0x04e5916e
                                      0x04e59175
                                      0x04e59177
                                      0x04e5917e
                                      0x04e5917f
                                      0x04e59182
                                      0x04e59182
                                      0x04e59187
                                      0x04e59187
                                      0x04e5918a
                                      0x04e5918d
                                      0x04e5918f
                                      0x04e59192
                                      0x04e59195
                                      0x04e59198
                                      0x04e59198
                                      0x04e59198
                                      0x04e5919a
                                      0x00000000
                                      0x00000000
                                      0x04eb371f
                                      0x04eb3721
                                      0x04eb3727
                                      0x04eb372f
                                      0x04eb3733
                                      0x04eb3735
                                      0x04eb3738
                                      0x04eb373b
                                      0x04eb373d
                                      0x04eb3740
                                      0x00000000
                                      0x04eb3746
                                      0x04eb3746
                                      0x04eb3749
                                      0x00000000
                                      0x04eb374f
                                      0x04eb374f
                                      0x04eb3751
                                      0x04eb3757
                                      0x04eb3759
                                      0x04eb375c
                                      0x04eb375c
                                      0x04eb375e
                                      0x04eb375e
                                      0x04eb3761
                                      0x04eb3764
                                      0x00000000
                                      0x00000000
                                      0x04eb3766
                                      0x04eb3768
                                      0x04eb37a3
                                      0x04eb37a3
                                      0x04eb37a5
                                      0x04eb37a7
                                      0x04eb37ad
                                      0x04eb37b0
                                      0x04eb37b2
                                      0x04eb37bc
                                      0x04eb37c2
                                      0x04eb37c2
                                      0x04eb37b2
                                      0x04e59187
                                      0x04e59187
                                      0x04e5918a
                                      0x04e5918d
                                      0x04e5918f
                                      0x04e59192
                                      0x04e59195
                                      0x00000000
                                      0x04e59195
                                      0x00000000
                                      0x04eb376a
                                      0x04eb376a
                                      0x04eb376a
                                      0x04eb376c
                                      0x04eb376c
                                      0x04eb376f
                                      0x04eb3775
                                      0x00000000
                                      0x00000000
                                      0x04eb3777
                                      0x04eb3779
                                      0x04eb3782
                                      0x04eb3787
                                      0x04eb3789
                                      0x04eb3790
                                      0x04eb3790
                                      0x04eb378b
                                      0x04eb378b
                                      0x04eb378b
                                      0x04eb3792
                                      0x04eb3795
                                      0x00000000
                                      0x04eb3795
                                      0x00000000
                                      0x04eb3779
                                      0x04eb3798
                                      0x00000000
                                      0x04eb3798
                                      0x00000000
                                      0x04eb3768
                                      0x04eb379b
                                      0x04eb379b
                                      0x04eb3751
                                      0x04eb3749
                                      0x00000000
                                      0x04eb3740
                                      0x04e591a0
                                      0x04e591a3
                                      0x04e591a9
                                      0x04e591b0
                                      0x00000000
                                      0x04e591b0
                                      0x04e59187
                                      0x04e591b4
                                      0x04e591b4
                                      0x04e591bb
                                      0x04e591c0
                                      0x04e591c5
                                      0x04e591c7
                                      0x04eb37da
                                      0x04e591cd
                                      0x04e591cd
                                      0x04e591cd
                                      0x04e591d2
                                      0x04e591d5
                                      0x04e59239
                                      0x04e59239
                                      0x04e591d7
                                      0x04e591db
                                      0x04e591e1
                                      0x04e591e7
                                      0x04e591fd
                                      0x04e59203
                                      0x04e5921e
                                      0x04e59223
                                      0x00000000
                                      0x04e59205
                                      0x04e59205
                                      0x04e59208
                                      0x04e5920c
                                      0x04e59214
                                      0x04e59214
                                      0x04e5920c
                                      0x04e591e9
                                      0x04e591e9
                                      0x04e591ee
                                      0x04e591f3
                                      0x04e591f3
                                      0x04e591f3
                                      0x04e591e7
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e59134
                                      0x04e59125
                                      0x04e5911d
                                      0x04e5914e
                                      0x04e590d1
                                      0x04e590d1
                                      0x04e590d3
                                      0x04e590d6
                                      0x04e590d8
                                      0x00000000
                                      0x04e590d8
                                      0x04e590cf

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b5cecb8bee9aabe68aa6d324fb95f1dcef2b365dce12d3b3c58745346ca38183
                                      • Instruction ID: 8bc3b22153869a3b82f40ff903e4631523f86a4cf05f4524e01b0cbee09cecb1
                                      • Opcode Fuzzy Hash: b5cecb8bee9aabe68aa6d324fb95f1dcef2b365dce12d3b3c58745346ca38183
                                      • Instruction Fuzzy Hash: DF0128B2601204DFE3149F14D840B617BF9EF81728F256466EA019F7A2C775FC41CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EEC450 Relevance: .1, Instructions: 53COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 46%
                                      			E04EEC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04E99910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E04E995B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E04E995D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E04E995D0();
				return L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}






                                      0x04eec458
                                      0x04eec45d
                                      0x04eec466
                                      0x04eec468
                                      0x04eec469
                                      0x04eec46a
                                      0x04eec46b
                                      0x04eec46e
                                      0x04eec46f
                                      0x04eec471
                                      0x04eec476
                                      0x04eec476
                                      0x04eec47c
                                      0x04eec47e
                                      0x04eec480
                                      0x04eec480
                                      0x04eec483
                                      0x04eec484
                                      0x04eec486
                                      0x04eec488
                                      0x04eec48f
                                      0x04eec491
                                      0x04eec493
                                      0x04eec493
                                      0x04eec48f
                                      0x04eec498
                                      0x04eec49e
                                      0x04eec4ad
                                      0x04eec4ad
                                      0x04eec4b2
                                      0x04eec4b4
                                      0x04eec4cd

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: InitializeThunk
                                      • String ID:
                                      • API String ID: 2994545307-0
                                      • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                      • Instruction ID: da0602a0f727ab38745b9da8d3e2f83de8d3e09d80eb41785da06a10d27c8e95
                                      • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                      • Instruction Fuzzy Hash: 3F0152B2140605BFEB21AF66CC80E63FB7DFF54799F105529F254476A0DB21BCA1CAA0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F24015 Relevance: .0, Instructions: 49COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 86%
                                      			E04F24015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04E72280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04E72280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x4f486ac);
					E04E5F900(0x4f486d4, _t28);
					E04E6FFB0(0x4f486ac, _t28, 0x4f486ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E04E6FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}







                                      0x04f2401a
                                      0x04f2401e
                                      0x04f24023
                                      0x04f24028
                                      0x04f24029
                                      0x04f2402b
                                      0x04f2402f
                                      0x04f24043
                                      0x04f24046
                                      0x04f24051
                                      0x04f24057
                                      0x04f2405f
                                      0x04f24062
                                      0x04f24067
                                      0x04f2406f
                                      0x04f2407c
                                      0x04f2407c
                                      0x04f2408c
                                      0x04f2408c
                                      0x04f24097

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c873fddfed356ebefcd1d3c8e5d509db19b26d3dd3347a45e873e4dd0c21a770
                                      • Instruction ID: 12efbc227dd00c1e05b8ec264701bace40f75d659680440f1e9d649a8d19cd32
                                      • Opcode Fuzzy Hash: c873fddfed356ebefcd1d3c8e5d509db19b26d3dd3347a45e873e4dd0c21a770
                                      • Instruction Fuzzy Hash: 0B01A7716419457FE351BF79CE80E13B7ACFF85668B001629F60883A11DB64FC52C6E4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F114FB Relevance: .0, Instructions: 48COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 61%
                                      			E04F114FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4f4d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04E9FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04E77D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                      0x04f114fb
                                      0x04f114fb
                                      0x04f1150a
                                      0x04f11514
                                      0x04f11519
                                      0x04f1151b
                                      0x04f11526
                                      0x04f1152c
                                      0x04f11534
                                      0x04f11537
                                      0x04f1153a
                                      0x04f11545
                                      0x04f11557
                                      0x04f11547
                                      0x04f11550
                                      0x04f11550
                                      0x04f11562
                                      0x04f11563
                                      0x04f11565
                                      0x04f1156a
                                      0x04f1157f

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c19acd99da91ed18932f133294091946bed37309ab539d277d8fa77cad6f85b2
                                      • Instruction ID: d60e29829b40f02ecc2bc0b9fbe4c323a119faa31deb79dcc629911cb7fa75fb
                                      • Opcode Fuzzy Hash: c19acd99da91ed18932f133294091946bed37309ab539d277d8fa77cad6f85b2
                                      • Instruction Fuzzy Hash: 74019275A00248AFDB10DFA8D841EAEB7B8EF44710F004056F905EB380DA74EE01CB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F1138A Relevance: .0, Instructions: 48COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 61%
                                      			E04F1138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4f4d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04E9FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04E77D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                      0x04f1138a
                                      0x04f1138a
                                      0x04f11399
                                      0x04f113a3
                                      0x04f113a8
                                      0x04f113aa
                                      0x04f113b5
                                      0x04f113bb
                                      0x04f113c3
                                      0x04f113c6
                                      0x04f113c9
                                      0x04f113d4
                                      0x04f113e6
                                      0x04f113d6
                                      0x04f113df
                                      0x04f113df
                                      0x04f113f1
                                      0x04f113f2
                                      0x04f113f4
                                      0x04f113f9
                                      0x04f1140e

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 69a01d95dd7d6e91ffb19366d5764a955616bb1633d754b057c444e9b442d0ba
                                      • Instruction ID: 468a0bb42963770adde77775a1610d9e589662dc52618f71e7f72f36672d6b1e
                                      • Opcode Fuzzy Hash: 69a01d95dd7d6e91ffb19366d5764a955616bb1633d754b057c444e9b442d0ba
                                      • Instruction Fuzzy Hash: 30015271E01218AFDB14DFA9D941EAEB7B8EF44710F004056B944EB381EA74EE01D794
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F21074 Relevance: .0, Instructions: 46COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04F21074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E04F2165E(__ebx, 0x4f48ae4, (__edx -  *0x4f48b04 >> 0x14) + (__edx -  *0x4f48b04 >> 0x14), __edi, __ecx, (__edx -  *0x4f48b04 >> 0x14) + (__edx -  *0x4f48b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E04F1AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04E77D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E04F0FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}











                                      0x04f21074
                                      0x04f21080
                                      0x04f21082
                                      0x04f2108a
                                      0x04f2108f
                                      0x04f21093
                                      0x04f210ab
                                      0x04f210ab
                                      0x04f210c3
                                      0x04f210cf
                                      0x04f210e1
                                      0x04f210d1
                                      0x04f210da
                                      0x04f210da
                                      0x04f210e9
                                      0x04f210f5
                                      0x04f210f5
                                      0x04f210fe

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ac75736ee54d25f19495d15be5f61868390d92dcf2c279ce7c7357cca3a986b4
                                      • Instruction ID: 111ac56527b438d73015466cd266d1d0080b2b80bd1e00f152b4fb52b55eb2c5
                                      • Opcode Fuzzy Hash: ac75736ee54d25f19495d15be5f61868390d92dcf2c279ce7c7357cca3a986b4
                                      • Instruction Fuzzy Hash: 75012872904751AFD710EF68CA44B1A77D5ABC4314F04C519F88583291EE70F942CB96
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6B02A Relevance: .0, Instructions: 46COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E6B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04E77D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E04ED7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}







                                      0x04e6b037
                                      0x04e6b039
                                      0x04e6b03b
                                      0x04e6b040
                                      0x04eba60e
                                      0x00000000
                                      0x00000000
                                      0x04eba61d
                                      0x04e6b04b
                                      0x04e6b04e
                                      0x04eba627
                                      0x04eba634
                                      0x00000000
                                      0x00000000
                                      0x04eba641
                                      0x04eba653
                                      0x04eba643
                                      0x04eba64c
                                      0x04eba64c
                                      0x04eba65b
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eba66c
                                      0x04e6b057
                                      0x04e6b057
                                      0x04e6b057
                                      0x04e6b046
                                      0x04e6b046
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                      • Instruction ID: 3eed28116a78fc3e8a0fc8cf61c668308c6ddad18787ca84d6702de18b8912f7
                                      • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                      • Instruction Fuzzy Hash: 6C01D472340584DFD722C71CC984FA77BD8EB41798F0914B1F916CB691E628FC40C660
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F0FEC0 Relevance: .0, Instructions: 46COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 59%
                                      			E04F0FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4f4d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04E9FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04E77D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                      0x04f0fec0
                                      0x04f0fec0
                                      0x04f0fecf
                                      0x04f0fed9
                                      0x04f0fede
                                      0x04f0fee0
                                      0x04f0feeb
                                      0x04f0fef3
                                      0x04f0fef6
                                      0x04f0fef9
                                      0x04f0ff04
                                      0x04f0ff16
                                      0x04f0ff06
                                      0x04f0ff0f
                                      0x04f0ff0f
                                      0x04f0ff21
                                      0x04f0ff22
                                      0x04f0ff24
                                      0x04f0ff29
                                      0x04f0ff3e

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: aacf92211bd5cba75eeda1011ededd0eeb211fca8cfa425f77208b98313e08e2
                                      • Instruction ID: 44b6db363794137c75517618b084714c263488045901fd2a133a4b278722c528
                                      • Opcode Fuzzy Hash: aacf92211bd5cba75eeda1011ededd0eeb211fca8cfa425f77208b98313e08e2
                                      • Instruction Fuzzy Hash: CF018471E00208AFDB14DBA9D845FAEB7B8EF85714F004066B900EB381EA74EE01C794
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F0FE3F Relevance: .0, Instructions: 46COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 59%
                                      			E04F0FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4f4d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04E9FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04E77D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                      0x04f0fe3f
                                      0x04f0fe3f
                                      0x04f0fe4e
                                      0x04f0fe58
                                      0x04f0fe5d
                                      0x04f0fe5f
                                      0x04f0fe6a
                                      0x04f0fe72
                                      0x04f0fe75
                                      0x04f0fe78
                                      0x04f0fe83
                                      0x04f0fe95
                                      0x04f0fe85
                                      0x04f0fe8e
                                      0x04f0fe8e
                                      0x04f0fea0
                                      0x04f0fea1
                                      0x04f0fea3
                                      0x04f0fea8
                                      0x04f0febd

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b4f0b59f86d706b06b0a23c5e8668b3c459577ebf30813b74af35c5c40e288d0
                                      • Instruction ID: 3fe2e63ecf8e82c788dbda3a84602703003b0b1783e5f8696de37b94f35643a4
                                      • Opcode Fuzzy Hash: b4f0b59f86d706b06b0a23c5e8668b3c459577ebf30813b74af35c5c40e288d0
                                      • Instruction Fuzzy Hash: 3E017171E04208ABDB14DBA9D845EAEB7B8EF84714F004066F900AB381DA74A901C7A4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28ED6 Relevance: .0, Instructions: 44COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 54%
                                      			E04F28ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x4f4d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04E77D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}


















                                      0x04f28ed6
                                      0x04f28ee5
                                      0x04f28eed
                                      0x04f28ef0
                                      0x04f28efa
                                      0x04f28f03
                                      0x04f28f0c
                                      0x04f28f15
                                      0x04f28f24
                                      0x04f28f27
                                      0x04f28f31
                                      0x04f28f43
                                      0x04f28f33
                                      0x04f28f3c
                                      0x04f28f3c
                                      0x04f28f4e
                                      0x04f28f4f
                                      0x04f28f51
                                      0x04f28f56
                                      0x04f28f69

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fa801f54cc5c340f6b0fa37595aab521fb6f26828d35ebea2fad0947bef32abc
                                      • Instruction ID: 006e88432d8911197b4387f07d124f09961dbdcfdb6d1f8de7a3fb9ff40b3616
                                      • Opcode Fuzzy Hash: fa801f54cc5c340f6b0fa37595aab521fb6f26828d35ebea2fad0947bef32abc
                                      • Instruction Fuzzy Hash: 16112170E002599FDB04DFA8D541BAEF7F4FF08300F0442AAE518EB382E634A941CB90
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28A62 Relevance: .0, Instructions: 44COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 54%
                                      			E04F28A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x4f4d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04E77D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04E9B640(E04E99AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                      0x04f28a62
                                      0x04f28a71
                                      0x04f28a79
                                      0x04f28a82
                                      0x04f28a85
                                      0x04f28a89
                                      0x04f28a8c
                                      0x04f28a8f
                                      0x04f28a92
                                      0x04f28a95
                                      0x04f28a9f
                                      0x04f28ab1
                                      0x04f28aa1
                                      0x04f28aaa
                                      0x04f28aaa
                                      0x04f28abc
                                      0x04f28abd
                                      0x04f28abf
                                      0x04f28ac4
                                      0x04f28ada

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 198fad757134945ce9c526e2b1e0d98d8c87420cce02702d1f57ed8388aec140
                                      • Instruction ID: 0c4d1afe3b0f95dfa3cb33791172cd54cb01e7df73feb4283a3df3c5f8a1f454
                                      • Opcode Fuzzy Hash: 198fad757134945ce9c526e2b1e0d98d8c87420cce02702d1f57ed8388aec140
                                      • Instruction Fuzzy Hash: 7F011AB1A0021CAFDB00DFA9D9419AEB7B8EF58750F10405AF904E7381EA34AD018BA5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5DB60 Relevance: .0, Instructions: 43COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E5DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E04E5DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E04E5E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L04E5E8B0(__ecx, _t14, 0xfff);
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}







                                      0x04e5db64
                                      0x04e5db66
                                      0x04e5db6b
                                      0x04e5dbaa
                                      0x04e5db71
                                      0x04e5db76
                                      0x04e5db7a
                                      0x04e5dba3
                                      0x04e5db7c
                                      0x04e5db87
                                      0x04e5db8b
                                      0x04eb4fa1
                                      0x04eb4fb3
                                      0x04eb4fb8
                                      0x04e5db91
                                      0x04e5db96
                                      0x04e5db98
                                      0x04e5db98
                                      0x04e5db8b
                                      0x04e5db7a
                                      0x04e5db9d
                                      0x04e5dba2

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                      • Instruction ID: 71b4c89424bb2f408cde8c7ca40df027c457c38bc166c57a1ab455efe0c30f44
                                      • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                      • Instruction Fuzzy Hash: F1F0FC332015229FE3B25B598C84F97B6AB8FC1AA5F155035F9059B364CA60BC0296D0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5B1E1 Relevance: .0, Instructions: 42COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E5B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04E77D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04E77D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E04ED7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}






                                      0x04e5b1e8
                                      0x04e5b1ea
                                      0x04e5b1f3
                                      0x04eb4a17
                                      0x04e5b1f9
                                      0x04e5b1f9
                                      0x04e5b1f9
                                      0x04e5b201
                                      0x04eb4a21
                                      0x04eb4a2e
                                      0x00000000
                                      0x00000000
                                      0x04eb4a3b
                                      0x04eb4a4d
                                      0x04eb4a3d
                                      0x04eb4a46
                                      0x04eb4a46
                                      0x04eb4a55
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e5b20a
                                      0x04e5b20a
                                      0x04e5b20a
                                      0x04e5b20a

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                      • Instruction ID: c62e247b741ddc67a40364f7b29c1c4f421101ab53127542bb9430b198685199
                                      • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                      • Instruction Fuzzy Hash: FD01F9327005849FD322975DC808FAA7B98EF41758F086061FD548B6F2F674F800D365
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EEFE87 Relevance: .0, Instructions: 38COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 46%
                                      			E04EEFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x4f4d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04E77D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}
















                                      0x04eefe96
                                      0x04eefe9e
                                      0x04eefea1
                                      0x04eefead
                                      0x04eefeb3
                                      0x04eefeb9
                                      0x04eefec3
                                      0x04eefed5
                                      0x04eefec5
                                      0x04eefece
                                      0x04eefece
                                      0x04eefee0
                                      0x04eefee1
                                      0x04eefee3
                                      0x04eefee8
                                      0x04eefefb

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 522333de61e9c68383ff8058b7b19a33f91f79b95eacbbb5d8fcc359b4ea4ef0
                                      • Instruction ID: 247528fdcb87bbf9123d8c61d814ccbaee89c6ba4f28bbe91bb47e92dba39cd3
                                      • Opcode Fuzzy Hash: 522333de61e9c68383ff8058b7b19a33f91f79b95eacbbb5d8fcc359b4ea4ef0
                                      • Instruction Fuzzy Hash: 95016270A0020CAFDB14DFA8D541A6EB7F4FF04314F105159A504EB392EA35FD01CB40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28F6A Relevance: .0, Instructions: 36COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 48%
                                      			E04F28F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4f4d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04E77D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                      0x04f28f6a
                                      0x04f28f79
                                      0x04f28f81
                                      0x04f28f84
                                      0x04f28f8b
                                      0x04f28f91
                                      0x04f28f94
                                      0x04f28f9e
                                      0x04f28fb0
                                      0x04f28fa0
                                      0x04f28fa9
                                      0x04f28fa9
                                      0x04f28fbb
                                      0x04f28fbc
                                      0x04f28fbe
                                      0x04f28fc3
                                      0x04f28fd6

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b62d4fe52a3fd880d583ee73ff08d6076bccd09ae8dd4a744c793070f3422500
                                      • Instruction ID: eb7b0a7e26a50c8bc095a87b38838991b475426784277853df7d5a2714bea36f
                                      • Opcode Fuzzy Hash: b62d4fe52a3fd880d583ee73ff08d6076bccd09ae8dd4a744c793070f3422500
                                      • Instruction Fuzzy Hash: 12013C74A0020CAFDB00EFA8D545AAEB7F4FF48300F10845AB905EB381EA74EA00DB94
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F1131B Relevance: .0, Instructions: 36COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 48%
                                      			E04F1131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4f4d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04E77D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                      0x04f1131b
                                      0x04f1132a
                                      0x04f11330
                                      0x04f11336
                                      0x04f1133e
                                      0x04f11341
                                      0x04f11344
                                      0x04f1134f
                                      0x04f11361
                                      0x04f11351
                                      0x04f1135a
                                      0x04f1135a
                                      0x04f1136c
                                      0x04f1136d
                                      0x04f1136f
                                      0x04f11374
                                      0x04f11387

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 5b33380cd1862e609794866f6d5f6b72f6e6c4a22e4273ad4235587df0674bc0
                                      • Instruction ID: f26e4d7620e817376206b16c8e5e6b3669ca1ebcfd29a1375cd7179c1dcc4a4b
                                      • Opcode Fuzzy Hash: 5b33380cd1862e609794866f6d5f6b72f6e6c4a22e4273ad4235587df0674bc0
                                      • Instruction Fuzzy Hash: 5E013C71E0120CAFDB04EFA9D545AAEB7F4FF48700F00805AB945EB391EA74AA00DB54
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7C577 Relevance: .0, Instructions: 33COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E7C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E04E7C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x4e311cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E04F288F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}









                                      0x04e7c577
                                      0x04e7c57d
                                      0x04e7c581
                                      0x04e7c5b5
                                      0x04e7c5b9
                                      0x04e7c5ce
                                      0x04e7c5ce
                                      0x04e7c5ca
                                      0x00000000
                                      0x04e7c5ca
                                      0x04e7c5c4
                                      0x04e7c5c8
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e7c5ad
                                      0x00000000
                                      0x04e7c5af

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: dc0c5ebe305a55f4b3daa811a6449b80f3c2d5ff04df05f824ea05fec3d970f1
                                      • Instruction ID: 18f90790a8a5afbcb5498dece8cce1ebc60fdc1a6ea85d161f1eff75a4b8322a
                                      • Opcode Fuzzy Hash: dc0c5ebe305a55f4b3daa811a6449b80f3c2d5ff04df05f824ea05fec3d970f1
                                      • Instruction Fuzzy Hash: 31F0B4B2D15AA19FE732DF14C044B627BDC9B05778F746567D50587141C6A6FC80C351
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F12073 Relevance: .0, Instructions: 32COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 94%
                                      			E04F12073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E04F0FD22(__ecx);
				_t19 =  *0x4f4849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4f48748; // 0x0
					if(__eflags <= 0) {
						E04F11C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4f48724 & 0x00000004;
							if(( *0x4f48724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4f48724; // 0x0
					return E04F08DF1(__ebx, 0xc0000374, 0x4f45890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}







                                      0x04f12076
                                      0x04f12078
                                      0x04f1207d
                                      0x04f12083
                                      0x04f120a4
                                      0x04f120aa
                                      0x04f120ac
                                      0x04f120b7
                                      0x04f120ba
                                      0x04f120bc
                                      0x04f120c9
                                      0x04f120c9
                                      0x04f120d0
                                      0x04f120d2
                                      0x00000000
                                      0x04f120d2
                                      0x04f120be
                                      0x04f120c3
                                      0x04f120c5
                                      0x04f120c7
                                      0x00000000
                                      0x00000000
                                      0x04f120c7
                                      0x04f120bc
                                      0x04f120d4
                                      0x04f12085
                                      0x04f12085
                                      0x04f120a3
                                      0x04f120a3

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1991957a19e07b6e4ec7d60b4c67708ab9026978d54cf84f882f041c5c5e547f
                                      • Instruction ID: a68fe913519020a208ca5bc49c1fa7d392ccbd96e3bd68ca1df72761dca8ac70
                                      • Opcode Fuzzy Hash: 1991957a19e07b6e4ec7d60b4c67708ab9026978d54cf84f882f041c5c5e547f
                                      • Instruction Fuzzy Hash: 54F0A06E8161CC4AEF327F6975112E23B90DBD5298B1B15C5D59067211CD3DAC83DA20
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28D34 Relevance: .0, Instructions: 32COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 43%
                                      			E04F28D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x4f4d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04E77D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}













                                      0x04f28d34
                                      0x04f28d43
                                      0x04f28d4b
                                      0x04f28d4e
                                      0x04f28d52
                                      0x04f28d5c
                                      0x04f28d6e
                                      0x04f28d5e
                                      0x04f28d67
                                      0x04f28d67
                                      0x04f28d79
                                      0x04f28d7a
                                      0x04f28d7c
                                      0x04f28d81
                                      0x04f28d94

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 67176dfda3968e3177acc51fff2622b08763a1f69fffac36b470f9ec883e9fe7
                                      • Instruction ID: fbae0c1450c3814401006ff6d353968d1f55da6ba3f4665267633716195fd39d
                                      • Opcode Fuzzy Hash: 67176dfda3968e3177acc51fff2622b08763a1f69fffac36b470f9ec883e9fe7
                                      • Instruction Fuzzy Hash: 28F09A70E04618AFEB14EBB8E541A6EB7B4EB18700F508099E905AB381EA38F9008B54
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E9927A Relevance: .0, Instructions: 32COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 54%
                                      			E04E9927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E04E9FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E04E992C6(_t11, _t14);
				}
				return _t11;
			}





                                      0x04e99295
                                      0x04e99299
                                      0x04e9929f
                                      0x04e992aa
                                      0x04e992ad
                                      0x04e992ae
                                      0x04e992af
                                      0x04e992b0
                                      0x04e992b4
                                      0x04e992bb
                                      0x04e992bb
                                      0x04e992c5

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                      • Instruction ID: 67366c384f9485de2dc6bea813e75193bfd366f8eb3be5c86c499e2394e99235
                                      • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                      • Instruction Fuzzy Hash: B8E0E5722405006BEB119F45DC80B0336999F82724F0040BCB5045E282C6E5EC0887A0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28CD6 Relevance: .0, Instructions: 31COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 36%
                                      			E04F28CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4f4d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04E77D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                      0x04f28ce5
                                      0x04f28ced
                                      0x04f28cf0
                                      0x04f28cfb
                                      0x04f28d0d
                                      0x04f28cfd
                                      0x04f28d06
                                      0x04f28d06
                                      0x04f28d18
                                      0x04f28d19
                                      0x04f28d1b
                                      0x04f28d20
                                      0x04f28d33

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: df793a82c140d92bbe98ba3f486fac55aa628687e5222d56f83801a7b1917993
                                      • Instruction ID: e9320f938c1e9372ebc333674f480b6209dd67b866a0cd04c7f2d3626055e689
                                      • Opcode Fuzzy Hash: df793a82c140d92bbe98ba3f486fac55aa628687e5222d56f83801a7b1917993
                                      • Instruction Fuzzy Hash: E9F08270A04218AFDB04EBB8E945E6E77B4EF59304F501199E915EB3C1EA34FD04C754
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E7746D Relevance: .0, Instructions: 31COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 88%
                                      			E04E7746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E04E6EB70(__ecx, 0x4f479a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E04E995D0();
							L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}









                                      0x04e7746d
                                      0x04e7746d
                                      0x04e7746d
                                      0x04e77471
                                      0x04e77488
                                      0x04ebf92d
                                      0x04e7748e
                                      0x04e77491
                                      0x04e77495
                                      0x04ebf937
                                      0x04ebf93a
                                      0x04ebf94e
                                      0x04ebf953
                                      0x04ebf956
                                      0x04ebf956
                                      0x04e77495
                                      0x00000000
                                      0x04e77488
                                      0x04e77473
                                      0x04e77478
                                      0x04e7747d
                                      0x04e77481
                                      0x00000000
                                      0x04e77481
                                      0x04e7747d
                                      0x04e7747a
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: caee526a937967c7f5fb1795b4340564102ff0a669647b042654fc01683fcc4d
                                      • Instruction ID: 0ec1bbe4dbcae9b942167a80e237ecb264c5a8acbfe03d21fcc797f258daeeda
                                      • Opcode Fuzzy Hash: caee526a937967c7f5fb1795b4340564102ff0a669647b042654fc01683fcc4d
                                      • Instruction Fuzzy Hash: 2BF08235A84244EBDF119BACC940BBABFB1AF0437CF042655D891AB1A1F765F801CBD5
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F28B58 Relevance: .0, Instructions: 31COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 36%
                                      			E04F28B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4f4d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04E77D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04E9B640(E04E99AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                      0x04f28b67
                                      0x04f28b6f
                                      0x04f28b72
                                      0x04f28b7d
                                      0x04f28b8f
                                      0x04f28b7f
                                      0x04f28b88
                                      0x04f28b88
                                      0x04f28b9a
                                      0x04f28b9b
                                      0x04f28b9d
                                      0x04f28ba2
                                      0x04f28bb5

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 82418ed7da41e00c75ac5f6ad8aaa28ccceeafd590a799df381372301c546efe
                                      • Instruction ID: 2d7ae4ab9258a921b8c9c95443106dc0d1de57a8343bcb978e5c684e3c9b66d5
                                      • Opcode Fuzzy Hash: 82418ed7da41e00c75ac5f6ad8aaa28ccceeafd590a799df381372301c546efe
                                      • Instruction Fuzzy Hash: 02F05EB0A14258ABEB10EBA8EA06A7E73A4EB04704F040559AA059B3C1EA74F900C798
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E54F2E Relevance: .0, Instructions: 31COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E54F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E04F288F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E04E7C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x4e31030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}









                                      0x04e54f2e
                                      0x04e54f34
                                      0x04e54f38
                                      0x04eb0b85
                                      0x04eb0b85
                                      0x04eb0b89
                                      0x04eb0b9a
                                      0x04eb0b9a
                                      0x04eb0b9f
                                      0x00000000
                                      0x04eb0b9f
                                      0x04eb0b94
                                      0x04eb0b98
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04eb0b98
                                      0x04e54f3e
                                      0x04e54f48
                                      0x00000000
                                      0x04e54f6e
                                      0x00000000
                                      0x04e54f70

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2ad42747983ba2271cc2c74b7c5bfb189bc355765c1276b1fd2895c77834c07e
                                      • Instruction ID: be254cf05a67633ac8d6b275030a16e2e8b20b697b794ca4f09f2791ff4e61e2
                                      • Opcode Fuzzy Hash: 2ad42747983ba2271cc2c74b7c5bfb189bc355765c1276b1fd2895c77834c07e
                                      • Instruction Fuzzy Hash: FCF0BE329217948FE772DB18C2C4FA3B7D8AB007BCF447464D48587920D724FC80C680
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8A44B Relevance: .0, Instructions: 29COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E8A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4f47b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E04E9FA60(_t17, 0, _t15 << 2);
				return _t17;
			}







                                      0x04e8a44b
                                      0x04e8a453
                                      0x04e8a472
                                      0x04e8a476
                                      0x00000000
                                      0x04e8a493
                                      0x04e8a47a
                                      0x04e8a47f
                                      0x04e8a486
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: efe584615ed7d4e3b7ec88efc4fc40cc221552e4d8a2f67e308f68b53ab871fa
                                      • Instruction ID: cbd436651ee684cf3f62711dcc79b71b77a86a0f28bff89a156559e528275c70
                                      • Opcode Fuzzy Hash: efe584615ed7d4e3b7ec88efc4fc40cc221552e4d8a2f67e308f68b53ab871fa
                                      • Instruction Fuzzy Hash: 07E092B2A01421ABD6226B58BC00F66739DDBE4655F095439E508C7264DA68ED01C7E0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5F358 Relevance: .0, Instructions: 28COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 79%
                                      			E04E5F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E04E8F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04E74620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}






                                      0x04e5f35d
                                      0x04e5f361
                                      0x04e5f367
                                      0x04e5f372
                                      0x04e5f38c
                                      0x04e5f38c
                                      0x04e5f394

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                      • Instruction ID: 0e987eceb72c6ae732e7558f6060306165ab2eebf3ba6ef1d7f85269c1a6699f
                                      • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                      • Instruction Fuzzy Hash: 2BE0DF32A42118FBEB31ABD99E05FAABBACDB48B60F001195BD08D71A0D570AE00C6D0
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6FF60 Relevance: .0, Instructions: 22COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E6FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x4e311a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E04F288F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04E70050(_t14);
				}
			}










                                      0x04e6ff66
                                      0x04e6ff6b
                                      0x00000000
                                      0x04e6ff8f
                                      0x00000000
                                      0x04e6ff8f

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 05b311449623f284d1e5b4ed2d0cf861dcaf8e6aca16a556d1235b2ac893190c
                                      • Instruction ID: 3555dd939197d5510bbb7bfdf418c8f225e52e326cbd6860f1ba76c7a406a993
                                      • Opcode Fuzzy Hash: 05b311449623f284d1e5b4ed2d0cf861dcaf8e6aca16a556d1235b2ac893190c
                                      • Instruction Fuzzy Hash: B6E026B0245204DFE735DF51F140F65779EEF427BDF19A51DE00A4B101CA21F881D206
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EE41E8 Relevance: .0, Instructions: 21COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 82%
                                      			E04EE41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x4f308f0);
				_t5 = E04EAD08C(__ebx, __edi, __esi);
				if( *0x4f487ec == 0) {
					E04E6EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x4f487ec == 0) {
						 *0x4f487f0 = 0x4f487ec;
						 *0x4f487ec = 0x4f487ec;
						 *0x4f487e8 = 0x4f487e4;
						 *0x4f487e4 = 0x4f487e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L04EE4248();
				}
				return E04EAD0D1(_t5);
			}





                                      0x04ee41e8
                                      0x04ee41ea
                                      0x04ee41ef
                                      0x04ee41fb
                                      0x04ee4206
                                      0x04ee420b
                                      0x04ee4216
                                      0x04ee421d
                                      0x04ee4222
                                      0x04ee422c
                                      0x04ee4231
                                      0x04ee4231
                                      0x04ee4236
                                      0x04ee423d
                                      0x04ee423d
                                      0x04ee4247

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3bf01403bb42571962048a5e592a5bf31fa024c96f6665dfe15fc861e4b23014
                                      • Instruction ID: c867a08099d76b5a15ed8d43fe3bf79bd51f319ce0cf307cfdf4feb025648749
                                      • Opcode Fuzzy Hash: 3bf01403bb42571962048a5e592a5bf31fa024c96f6665dfe15fc861e4b23014
                                      • Instruction Fuzzy Hash: 3CF01C7C890708CFEB60FF6BB5207283AA5F7D439AF006116810087684DB7C6841CF01
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04F0D380 Relevance: .0, Instructions: 21COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04F0D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L04E5E8B0(__ecx, _a4, 0xfff);
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}




                                      0x04f0d38a
                                      0x04f0d39b
                                      0x04f0d3b1
                                      0x00000000
                                      0x04f0d3b6
                                      0x00000000

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                      • Instruction ID: 6ca88fc3ffc155871756644f1d2497ca89de46c6365ec1083860b7d6e5df1013
                                      • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                      • Instruction Fuzzy Hash: 4BE01232285654FBEB225F84CC00F69BB5ADF907A5F108031FE485A6E0C675BD92E6D4
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E8A185 Relevance: .0, Instructions: 20COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E8A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x4f467e4 >= 0xa) {
					if(_t5 < 0x4f46800 || _t5 >= 0x4f46900) {
						return L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04E70010(0x4f467e0, _t5);
				}
			}





                                      0x04e8a190
                                      0x04e8a1a6
                                      0x04e8a1c2
                                      0x00000000
                                      0x00000000
                                      0x00000000
                                      0x04e8a192
                                      0x04e8a192
                                      0x04e8a19f
                                      0x04e8a19f

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b8848ba8b2870d0c2d10299d70b2f1f76d38b4f0b58c45aeb5810e6858fb7e5a
                                      • Instruction ID: 120141c368794133da705eab7a5457ab653606805c1787ae9a3aa0607fcec5ce
                                      • Opcode Fuzzy Hash: b8848ba8b2870d0c2d10299d70b2f1f76d38b4f0b58c45aeb5810e6858fb7e5a
                                      • Instruction Fuzzy Hash: FDD012A11A100056FB2D6750A954B252612EBC5B2DF305D1EF10E9A990DE5CF8D69108
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E816E0 Relevance: .0, Instructions: 17COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E816E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04E81710(0x4f467e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04E74620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}





                                      0x04e816e8
                                      0x04e816ef
                                      0x04e816f3
                                      0x04e816fe
                                      0x00000000
                                      0x04e81700
                                      0x04e8170d
                                      0x04e8170d
                                      0x04e816f2
                                      0x04e816f2
                                      0x04e816f2
                                      0x04e816f2

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c016113b2e9743a54635bed63108768ca3e02a353e1a741d1178eb5afc265b5b
                                      • Instruction ID: d9f2317b2143307011bc296075c4e66edb9dd8c37d6ca7e5aa8adff02ed20625
                                      • Opcode Fuzzy Hash: c016113b2e9743a54635bed63108768ca3e02a353e1a741d1178eb5afc265b5b
                                      • Instruction Fuzzy Hash: D9D05E3114014092FE2D6B109844B146251AB80799F38145CB10E598C0CEA5EC93E448
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04ED53CA Relevance: .0, Instructions: 16COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04ED53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E04E6EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}








                                      0x04ed53ca
                                      0x04ed53ce
                                      0x04ed53d9
                                      0x04ed53de
                                      0x04ed53e1
                                      0x04ed53e1
                                      0x04ed53e6
                                      0x04ed53f3
                                      0x00000000
                                      0x04ed53f8
                                      0x04ed53fb

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                      • Instruction ID: f921ed8d093682a6cbd6bf4cfb861689efa2f80df0dd9291bae3890d5e22b3ca
                                      • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                      • Instruction Fuzzy Hash: 24E08C31940680ABCF12EB48C650F5EB7F9FB44B44F140004A0085B660C634BC01CB00
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E835A1 Relevance: .0, Instructions: 12COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E835A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E04E6EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}






                                      0x04e835a1
                                      0x04e835a1
                                      0x04e835a5
                                      0x04e835ab
                                      0x04e835ab
                                      0x04e835b5
                                      0x00000000
                                      0x04e835c1
                                      0x04e835b7

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                      • Instruction ID: 0902be6d4a5ebce84f52aa6fe31addff7ffe027f31881ec724bdceb8c8c3330e
                                      • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                      • Instruction Fuzzy Hash: 86D0A931D411809AEF11BB10C2187A837B2BB00B0CF58346D880E06892C33B6A0AD700
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E6AAB0 Relevance: .0, Instructions: 12COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E6AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}




                                      0x04e6aab6
                                      0x04e6aabb
                                      0x04eba442
                                      0x00000000
                                      0x04eba448
                                      0x04eba454
                                      0x04eba454
                                      0x04e6aac1
                                      0x04e6aac1
                                      0x04e6aac6
                                      0x04e6aac6

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                      • Instruction ID: f60583469b0d9483f6b579829fdb22cd3a6eddb55a36211b086188917587fa90
                                      • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                      • Instruction Fuzzy Hash: 3ED0E935352980CFD716CF1DC554B5673A4BB45B84FC514A0E541CBB61E62CE944CA10
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EDA537 Relevance: .0, Instructions: 11COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04EDA537(intOrPtr _a4, intOrPtr _a8) {

				return L04E78E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}



                                      0x04eda553

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                      • Instruction ID: 313bc1e68ce1b0606c8e0065daccb0ca9d987a698da4abd2b50d9001d370dfa7
                                      • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                      • Instruction Fuzzy Hash: 18C01232080248BBCB126F81CC00F067B2AFBA4B60F108010BA080A5608632E970EA84
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5DB40 Relevance: .0, Instructions: 11COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E5DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04E74620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}





                                      0x04e5db4d
                                      0x04e5db54
                                      0x04e5db5f
                                      0x04e5db56
                                      0x04e5db56
                                      0x04e5db5c
                                      0x04e5db5c

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                      • Instruction ID: 6a838e08a468dfe2f5e221a943eccd638befd1e722274ccb8193f0903c0dbe26
                                      • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                      • Instruction Fuzzy Hash: 09C08C30280A00AAEB622F20CD01F0036A1BB00B09F4404A06700DA0F0EB78E801EA00
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E5AD30 Relevance: .0, Instructions: 10COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E5AD30(intOrPtr _a4) {

				return L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}



                                      0x04e5ad49

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                      • Instruction ID: 656614ee664f4b534215704f09d3c5e06d2be383bc1fe0aad8f14843a30b135b
                                      • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                      • Instruction Fuzzy Hash: F2C08C32080248BBC7126B45CD00F017B29EB90B60F000020F6040A661CA32F861D588
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E676E2 Relevance: .0, Instructions: 10COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E676E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L04E777F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}




                                      0x04e676e4
                                      0x00000000
                                      0x04e676f8
                                      0x04e676fd

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                      • Instruction ID: 3d0d90c2d40b0171d8b5f61905c62b0d082db0f96692c6048ec6dec9e5ba37bd
                                      • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                      • Instruction Fuzzy Hash: D5C08C701811805AEB2A6B08CE20B283651AF0874EF68359CAA02094A1C36CB803C208
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E836CC Relevance: .0, Instructions: 10COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E836CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04E74620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}



                                      0x04e836d2
                                      0x04e836e8
                                      0x04e836d4
                                      0x04e836e5
                                      0x04e836e5

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                      • Instruction ID: ad368b4897dd51c1b1bd4e7847444058c06364efae4fe9d1ca7f308822a3f104
                                      • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                      • Instruction Fuzzy Hash: 57C08C70150840EAEA156B208D40B147254A700A25F640A987224494E0D529BC00E500
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E73A1C Relevance: .0, Instructions: 10COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E73A1C(intOrPtr _a4) {
				void* _t5;

				return L04E74620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}




                                      0x04e73a35

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                      • Instruction ID: 39819826ccfd22c720f017bdc2476430f85842b85e7faeca240acde4dba34f71
                                      • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                      • Instruction Fuzzy Hash: ECC08C32080248BBC7126F81DC00F017B29E790B60F000020B6040A5A08532EC60D988
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E77D50 Relevance: .0, Instructions: 7COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E77D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}




                                      0x04e77d56
                                      0x04e77d5b
                                      0x04e77d60
                                      0x04e77d5d
                                      0x04e77d5d
                                      0x04e77d5d

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                      • Instruction ID: a91010e536429dee0dd22c10704f1da141a492205c9c61f98f600c602b02410c
                                      • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                      • Instruction Fuzzy Hash: E8B092343119408FCF16DF18C080B1533E4BB49A44B8440D0E400CBA20D229F8009900
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04E82ACB Relevance: .0, Instructions: 5COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 100%
                                      			E04E82ACB() {
				void* _t5;

				return E04E6EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}




                                      0x04e82adc

                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                      • Instruction ID: ea49a5facfc896eff7000be757026e51c201bd4db5edcd60f3acdb0993f010b3
                                      • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                      • Instruction Fuzzy Hash: DCB01232C50440CFCF12EF44C610B197735FB00790F054490900227970C229BC01CB40
                                      Uniqueness

                                      Uniqueness Score: -1.00%

                                      Function 04EEFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                      Download Yara Rule
                                      C-Code - Quality: 53%
                                      			E04EEFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E04E9CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04EE5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04EE5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                      0x04eefdda
                                      0x04eefde2
                                      0x04eefde5
                                      0x04eefdec
                                      0x04eefdfa
                                      0x04eefdff
                                      0x04eefe0a
                                      0x04eefe0f
                                      0x04eefe17
                                      0x04eefe1e
                                      0x04eefe19
                                      0x04eefe19
                                      0x04eefe19
                                      0x04eefe20
                                      0x04eefe21
                                      0x04eefe22
                                      0x04eefe25
                                      0x04eefe40

                                      APIs
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04EEFDFA
                                      Strings
                                      • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04EEFE01
                                      • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04EEFE2B
                                      Memory Dump Source
                                      • Source File: 0000000B.00000002.644924217.0000000004E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E30000, based on PE: true
                                      • Associated: 0000000B.00000002.665173458.0000000004F4B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      • Associated: 0000000B.00000002.665198804.0000000004F4F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_11_2_4e30000_control.jbxd
                                      Similarity
                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                      • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                      • API String ID: 885266447-3903918235
                                      • Opcode ID: a4cc86a2aa8825e6421083047546e1eae9eee9cc800865720d73dec63d45a288
                                      • Instruction ID: 249fd879f174f7c7f984477f10eb7c8c1a485eb1716659121c3cc72530bc0047
                                      • Opcode Fuzzy Hash: a4cc86a2aa8825e6421083047546e1eae9eee9cc800865720d73dec63d45a288
                                      • Instruction Fuzzy Hash: B2F0C8762001017BE6241A86DC01E337B5ADB84774F141254F614561E1D962B83097A4
                                      Uniqueness

                                      Uniqueness Score: -1.00%